pull-request.yml

name: Pull Request

on:
  pull_request:
    branches: [main, canary, AgentHits-Dev]
  # deps-auto-update.yml starts the checks of its branch this way: a push with
  # GITHUB_TOKEN creates no pull_request event.
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: pull-request-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true

jobs:
  audit:
    name: audit and typecheck
    # Only the owner's own PRs reach the Mac mini runners. A fork PR could rewrite
    # this line, so the repo also requires approval for every outside contributor.
    runs-on: ${{ (github.event.pull_request.user.login == github.repository_owner && github.event.pull_request.head.repo.full_name == github.repository) && fromJSON('["self-hosted", "dokploy-ci"]') || 'ubuntu-24.04' }}
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@v7
        with:
          persist-credentials: false
      - uses: oven-sh/setup-bun@v2
        with:
          bun-version: 1.4.4
      - run: bun audit --audit-level=moderate
      - uses: actions/setup-node@v7
        if: ${{ !cancelled() }}
        with:
          node-version: 26.13.0
      - run: bun install --frozen-lockfile
        if: ${{ !cancelled() }}
      - run: bun run server:build
        if: ${{ !cancelled() }}
      - run: bun run typecheck
        if: ${{ !cancelled() }}

  pr-check:
    runs-on: ${{ (github.event.pull_request.user.login == github.repository_owner && github.event.pull_request.head.repo.full_name == github.repository) && fromJSON('["self-hosted", "dokploy-ci"]') || 'ubuntu-24.04' }}
    timeout-minutes: 30
    strategy:
      fail-fast: false
      matrix:
        job: [build, test]
    steps:
      - uses: actions/checkout@v7
        with:
          persist-credentials: false
      - uses: oven-sh/setup-bun@v2
        with:
          bun-version: 1.4.4
      - uses: actions/setup-node@v7
        with:
          node-version: 26.13.0
      
      - name: Install Nixpacks
        if: matrix.job == 'test' && runner.environment == 'github-hosted'
        run:  |
          export NIXPACKS_VERSION=1.41.0
          curl -sSL https://nixpacks.com/install.sh | bash
          echo "Nixpacks installed $NIXPACKS_VERSION"

      - name: Install Railpack
        if: matrix.job == 'test' && runner.environment == 'github-hosted'
        run:  |
          export RAILPACK_VERSION=0.42.0
          curl -sSL https://railpack.com/install.sh | bash
          echo "Railpack installed $RAILPACK_VERSION"
      
      - name: Add build tools to PATH
        if: matrix.job == 'test'
        run: echo "$HOME/.local/bin" >> $GITHUB_PATH
      
      - name: Initialize Docker Swarm
        if: matrix.job == 'test'
        run: |
          # The Mac mini keeps its swarm between runs.
          if [ "$(docker info --format '{{.Swarm.LocalNodeState}}')" != "active" ]; then
            docker swarm init
          fi
          docker network create --driver overlay dokploy-network || true
          echo "✅ Docker Swarm initialized"
      
      - run: bun install --frozen-lockfile
      - run: bun run server:build
      - run: bun run ${{ matrix.job }}
        env:
          # The fork's db module throws without a password in production, and the Next build imports it.
          POSTGRES_PASSWORD: ${{ matrix.job == 'build' && 'build-time-postgres-password' || '' }}

      # Tests remove their swarm services, but a cancelled or timed-out run skips
      # that. Docker is shared by all Mac mini runners, so only this checkout's
      # apps go (see CHECKOUT_ID in application.real.test.ts).
      - name: Remove leftover real-test services
        if: always() && matrix.job == 'test'
        working-directory: apps/dokploy
        run: |
          id="$(printf %s "$PWD" | shasum -a 256 | cut -c1-8)"
          docker service ls --format '{{.Name}}' | grep -E "^real-[a-z]+-${id}" | xargs -r docker service rm