ci.yml

name: CI

on:
  push:
    branches:
      - main
  pull_request:
  workflow_dispatch:

concurrency:
  group: ci-${{ github.ref }}
  cancel-in-progress: true

jobs:
  hadolint:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
      - name: Lint Dockerfile
        run: docker run --rm -i hadolint/hadolint < Dockerfile

  ruby:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6

      - uses: ruby/setup-ruby@v1
        with:
          bundler-cache: true

      - name: Run RuboCop
        run: bundle exec rubocop -F

      - name: Verify Yard documentation
        run: bundle exec yard doc --fail-on-warning --no-output

      - name: Run RSpec
        run: bundle exec rspec

      - name: Upload coverage report
        uses: actions/upload-artifact@v7
        if: always()
        with:
          name: coverage-report
          path: coverage/
          retention-days: 30

  openapi:
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - uses: actions/checkout@v6
        with:
          token: ${{ secrets.RELEASE_PLEASE_TOKEN || github.token }}
          ref: ${{ (github.event_name == 'pull_request' && startsWith(github.head_ref, 'release-please--')) && github.head_ref || github.sha }}
          fetch-depth: 0

      - uses: ruby/setup-ruby@v1
        with:
          bundler-cache: true

      - name: Setup pnpm
        uses: pnpm/action-setup@v6
        with:
          cache: true
          cache_dependency_path: frontend/pnpm-lock.yaml
          package_json_file: frontend/package.json

      - name: Setup Node.js for OpenAPI lint tooling
        uses: actions/setup-node@v6
        with:
          node-version-file: ".tool-versions"

      - name: Install frontend dependencies for OpenAPI client verification
        run: pnpm install --frozen-lockfile
        working-directory: frontend

      - name: Verify generated OpenAPI spec and client are up to date
        id: verify
        run: make openapi-verify
        continue-on-error: ${{ startsWith(github.head_ref, 'release-please--') }}

      - name: Regenerate and commit OpenAPI artifacts on release PRs
        if: steps.verify.outcome == 'failure' && startsWith(github.head_ref, 'release-please--')
        run: |
          git config --global user.name "github-actions[bot]"
          git config --global user.email "github-actions[bot]@users.noreply.github.com"
          
          make openapi
          make openapi-client
          
          git add public/openapi.yaml frontend/src/api/generated/
          
          if git diff --staged --quiet; then
            echo "No changes to commit"
          else
            git commit -m "chore: regenerate openapi spec and client for version bump"
            git push origin ${{ github.head_ref }}
            
            echo "## OpenAPI artifacts regenerated" >> "$GITHUB_STEP_SUMMARY"
            echo "Version bump detected; OpenAPI spec and frontend client have been regenerated and committed." >> "$GITHUB_STEP_SUMMARY"
          fi

      - name: Lint OpenAPI contract
        run: make openapi-lint

  frontend:
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: frontend
    steps:
      - uses: actions/checkout@v6

      - name: Setup pnpm
        uses: pnpm/action-setup@v6
        with:
          cache: true
          cache_dependency_path: frontend/pnpm-lock.yaml
          package_json_file: frontend/package.json

      - name: Setup Node.js
        uses: actions/setup-node@v6
        with:
          node-version-file: ".tool-versions"

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Typecheck frontend
        run: pnpm run typecheck

      - name: Lint CSS with Stylelint
        run: pnpm exec stylelint "**/*.css"

      - name: Check formatting
        run: pnpm run format:check

      - name: Audit dependencies
        run: pnpm audit --audit-level=moderate

      - name: Run frontend tests
        run: pnpm run test:ci

      - name: Install Playwright Chromium
        run: pnpm exec playwright install --with-deps chromium

      - name: Run frontend smoke test
        run: pnpm run test:e2e

  docker-build-smoke-image:
    needs:
      - hadolint
      - ruby
      - openapi
      - frontend
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
      - uses: docker/setup-buildx-action@v4
      - name: Build Docker smoke image
        uses: docker/build-push-action@v7
        with:
          context: .
          load: true
          tags: html2rss/web
          cache-from: type=gha
          cache-to: type=gha,mode=max

  docker-test:
    needs:
      - docker-build-smoke-image
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        smoke_auto_source_enabled: ["false", "true"]
    steps:
      - uses: actions/checkout@v6

      - uses: ruby/setup-ruby@v1
        with:
          bundler-cache: true

      - uses: docker/setup-buildx-action@v4

      - name: Load Docker smoke image from cache
        uses: docker/build-push-action@v7
        with:
          context: .
          load: true
          tags: html2rss/web
          cache-from: type=gha

      - name: Run Docker smoke test
        env:
          DOCKER_SMOKE_SKIP_BUILD: "true"
          SMOKE_AUTO_SOURCE_ENABLED: ${{ matrix.smoke_auto_source_enabled }}
        run: bundle exec rake