ci.yml

name: CI

on:
  push:
    branches: [dev]
  pull_request:
    branches: [dev, production]
  # The Update screenshots workflow starts this on the branch it committed to,
  # since its own pushes don't trigger workflows.
  workflow_dispatch:

jobs:
  typecheck-test-build:
    runs-on: ubuntu-latest
    # Databases for the store packages' conformance tests. Locally those tests
    # skip unless the CHATCOPS_TEST_* variables below are set.
    services:
      redis:
        image: redis:7-alpine
        ports: ['6379:6379']
        options: >-
          --health-cmd "redis-cli ping" --health-interval 5s --health-timeout 3s --health-retries 10
      # The Upstash REST API in front of the redis service, for @upstash/redis.
      upstash:
        image: hiett/serverless-redis-http:0.0.10
        ports: ['8079:80']
        env:
          SRH_MODE: env
          SRH_TOKEN: chatcops_test_token
          SRH_CONNECTION_STRING: redis://redis:6379
      postgres:
        image: pgvector/pgvector:pg17
        ports: ['5432:5432']
        env:
          POSTGRES_PASSWORD: postgres
        options: >-
          --health-cmd "pg_isready -U postgres" --health-interval 5s --health-timeout 3s --health-retries 10
    env:
      CHATCOPS_TEST_REDIS_URL: redis://localhost:6379
      CHATCOPS_TEST_UPSTASH_URL: http://localhost:8079
      CHATCOPS_TEST_UPSTASH_TOKEN: chatcops_test_token
      CHATCOPS_TEST_POSTGRES_URL: postgres://postgres:postgres@localhost:5432/postgres
    steps:
      - uses: actions/checkout@v4

      # Some editors save files with a UTF-8 BOM, and a tool that reads UTF-8 with
      # the wrong encoding turns a dash or an arrow into two or three other
      # characters. Both have reached PRs here, so catch them before review.
      - name: No BOM or garbled characters
        run: |
          if git grep -n -I -F -e $'\xEF\xBB\xBF' -e $'\xCE\x93\xC3\x87' -e $'\xCE\x93\xC3\xA5\xC3\x86' \
              -e $'\xE2\x94\xAC\xE2\x95\x96' -e $'\xC3\xA2\xE2\x82\xAC' -e $'\xC3\x83\xC2\xA9'; then
            echo "::error::The lines above start with a UTF-8 BOM or have text garbled by the wrong encoding. Save the file as UTF-8 without a BOM, and copy garbled lines back from the base branch."
            exit 1
          fi

      # Recorded provider responses are replayed in tests. The recording script
      # refuses to write a key, and this catches one added by hand.
      - name: No API keys in test fixtures or eval recordings
        run: |
          if git grep -n -I -E '(^|[^A-Za-z0-9_])(sk-ant-|sk-proj-|sk-[A-Za-z0-9]{20,})|AIza[0-9A-Za-z_-]{35}' -- 'packages/*/tests/fixtures'; then
            echo "::error::A test fixture above looks like it contains an API key. Remove it and rotate the key."
            exit 1
          fi
          # Eval recordings keep request bodies as JSON and long responses as
          # base64, so the Google key pattern needs a boundary here: random
          # base64 can contain "AIza" followed by 35 letters.
          if git grep -n -I -E '(^|[^A-Za-z0-9_])(sk-ant-|sk-proj-|sk-[A-Za-z0-9]{20,})|(^|[^A-Za-z0-9+/_-])AIza[0-9A-Za-z_-]{35}' -- '**/__cassettes__/**'; then
            echo "::error::An eval recording above looks like it contains an API key. Remove it, rotate the key, and record again."
            exit 1
          fi

      - uses: pnpm/action-setup@v4

      - uses: actions/setup-node@v4
        with:
          node-version: 22
          cache: pnpm

      - run: pnpm install --frozen-lockfile

      - name: Lint
        run: pnpm lint

      - name: Build
        run: pnpm -r build

      - name: Check documentation TypeScript samples
        run: pnpm docs:check

      # Checks each package's exports, types and files the way npm will see them.
      - name: Package checks
        run: pnpm publint

      # api/*.api.md is each package's public types. A change to them has to
      # come with the updated snapshot, so it's seen in review.
      - name: Public API snapshot
        run: pnpm api:check

      # Gzip budgets for the widget bundles are in .size-limit.json.
      - name: Widget size budget
        run: pnpm size

      - name: Typecheck
        run: pnpm -r typecheck

      # Per-package coverage minimums are in vitest.config.ts.
      - name: Test
        run: pnpm test:coverage

      # The docs bot's evals, replayed from website/evals/__cassettes__, so
      # nothing calls an API and no key is needed. A change to its prompt or
      # FAQ fails here until the recordings are made again with
      # `npm run evals:record` in website/.
      - name: Docs bot evals
        run: pnpm --filter @chatcops/website evals

      # 50 questions, each with the page that answers it. Passes when at
      # least 85% of the replayed answers cite that page.
      - name: Docs bot citations
        run: pnpm --filter @chatcops/website evals:citations

      # Warns, without failing, when the docs pages changed since the docs
      # bot's index (website/public/docs-index) was built.
      - name: Docs bot index
        run: pnpm --filter @chatcops/website docs-index:check

  changeset:
    if: github.event_name == 'pull_request' && github.base_ref == 'dev'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      # A change under packages/*/src needs a changeset so it shows up in the
      # next release. `pnpm changeset --empty` covers changes that shouldn't.
      - name: Changeset for package source changes
        run: bash .github/scripts/check-changeset.sh origin/${{ github.base_ref }}

  e2e:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: pnpm/action-setup@v4

      - uses: actions/setup-node@v4
        with:
          node-version: 22
          cache: pnpm

      - run: pnpm install --frozen-lockfile

      # e2e/server.mjs runs the real server handler, so build it and core too.
      - name: Build the widget and the server
        run: pnpm --filter @chatcops/widget --filter "@chatcops/server..." build

      - name: Install Chromium
        run: pnpm exec playwright install --with-deps chromium

      - name: Browser tests
        run: pnpm e2e

      - name: Upload the report
        if: failure()
        uses: actions/upload-artifact@v4
        with:
          name: playwright-report
          path: e2e/playwright-report
          retention-days: 7