ci.yml

name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
    types: [opened, synchronize, reopened, labeled]
  workflow_call:
    inputs:
      skip_windows:
        type: boolean
        required: false
        default: false

permissions: {}

jobs:
  checks:
    name: build and typecheck (${{ matrix.os }})
    runs-on: ${{ matrix.os == 'ubuntu-latest' && github.repository == 'voidzero-dev/void' && 'blacksmith-4vcpu-ubuntu-2404' || matrix.os }}
    permissions:
      contents: read
    strategy:
      fail-fast: false
      matrix:
        os: '${{ ((github.event_name == ''push'' || contains(github.event.pull_request.labels.*.name, ''test: windows'')) && !inputs.skip_windows) && fromJSON(''["ubuntu-latest","windows-latest"]'') || fromJSON(''["ubuntu-latest"]'') }}'
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - uses: ./.github/actions/test-setup
      # Build every playground once per OS for complete build/type coverage.
      # Integration tests build their own selected fixtures in separate checkouts.
      - run: vp run build:all
      - run: vp run build:docs
      - run: node test/check-playground-build-artifacts.mjs
      - run: vp run check

  test:
    name: test (${{ matrix.os }}, ${{ matrix.shard }})
    runs-on: ${{ matrix.os == 'ubuntu-latest' && github.repository == 'voidzero-dev/void' && 'blacksmith-4vcpu-ubuntu-2404' || matrix.os }}
    permissions:
      contents: read
    # No Cloudflare creds in this job. The credentialed live deploy e2e runs in the separate
    # `live-e2e` job (below), whose secrets are bound to the `cloudflare-e2e` environment. Here the
    # live suite (part of `vp run test:all`) sees empty creds and self-skips on every event.
    strategy:
      fail-fast: false
      matrix:
        # Windows runs on branch/tag pushes and on PRs labeled "test: windows",
        # unless a reusable workflow caller explicitly disables it.
        os: '${{ ((github.event_name == ''push'' || contains(github.event.pull_request.labels.*.name, ''test: windows'')) && !inputs.skip_windows) && fromJSON(''["ubuntu-latest","windows-latest"]'') || fromJSON(''["ubuntu-latest"]'') }}'
        # Weighted integration shards own separate checkouts and build only the
        # fixtures they exercise. No generated playground state crosses runners.
        shard: [unit, '1/2', '2/2']
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - uses: ./.github/actions/test-setup
        with:
          browser: ${{ matrix.shard != 'unit' }}

      - run: vp check
        if: ${{ matrix.shard == 'unit' }}

      # Unit suites import the core package and its workspace dependencies through public exports and
      # exercise generated CLI assets, so they need the transitive core stack even though they skip
      # playground builds.
      - run: vp run build:core
        if: ${{ matrix.shard == 'unit' }}

      - run: vp test run --project unit --project unit-pglite --project cli-unit
        if: ${{ matrix.shard == 'unit' }}

      - run: vp run build
        if: ${{ matrix.shard != 'unit' }}

      - run: vp test run --project parallel-integration --shard=${{ matrix.shard }}
        if: ${{ matrix.shard != 'unit' }}

  # Credentialed live Cloudflare deploy e2e, ISOLATED from `test` so the account token exists ONLY in
  # a job bound to the `cloudflare-e2e` GitHub Environment. That environment's deployment branch policy
  # allows `main` ONLY and the ref is enforced server-side, so a `pull_request` run (ref
  # refs/pull/<n>/merge) can never reach the secret — even a PR that edits this file — and a modified
  # workflow cannot exfiltrate it. The `if` also keeps the job off everything except a direct push to
  # the `main` branch: tag pushes and `workflow_call` (release) carry a non-main ref, so they are
  # skipped — which both avoids a branch-policy failure and matches where the secret is allowed, and
  # it is scoped to the canonical repo so forks don't run it. It deploys a UNIQUELY-named worker
  # (VOID_E2E_RUN_ID) to a throwaway account and tears it down. A preflight step fails the job when a
  # credential is empty (unset / deleted / not-yet-rotated token), so a missing secret can never turn
  # the live-deploy gate into a silent green no-op (the `test` job's uncredentialed run still skips).
  live-e2e:
    if: ${{ github.event_name == 'push' && github.ref == 'refs/heads/main' && github.repository == 'voidzero-dev/void' }}
    runs-on: blacksmith-4vcpu-ubuntu-2404
    permissions:
      contents: read
    environment: cloudflare-e2e
    env:
      VOID_E2E_CF_TOKEN: ${{ secrets.VOID_E2E_CF_TOKEN }}
      VOID_E2E_CF_ACCOUNT_ID: ${{ secrets.VOID_E2E_CF_ACCOUNT_ID }}
      VOID_E2E_RUN_ID: ${{ github.run_id }}-${{ github.run_attempt }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - uses: voidzero-dev/setup-vp@2dec1e33f4ab2c6d5bce1b0c4607961bb1a3f7a1 # v1.12.0
        with:
          node-version-file: .node-version
          cache: true
      # Fail closed BEFORE the build: a missing/empty credential must fail this job, not self-skip. The
      # `${VAR:?}` expansion exits nonzero when the secret is unset OR empty (GitHub resolves an unset
      # secret to '').
      - name: Require live Cloudflare credentials
        run: |
          : "${VOID_E2E_CF_TOKEN:?empty — set it as a cloudflare-e2e environment secret}"
          : "${VOID_E2E_CF_ACCOUNT_ID:?empty — set it as a cloudflare-e2e environment secret}"
      # build:core produces the core package and its workspace dependencies, including
      # dist/cli/cli.mjs and the built `void` plugin the deploy uses to build the app.
      - run: vp run build:core
      - run: vp test run packages/void/test/e2e/cloudflare-deploy-live.test.ts

  done:
    runs-on: ubuntu-latest
    if: always()
    needs:
      - checks
      - test
      - live-e2e
    steps:
      - run: exit 1
        if: ${{ contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled') }}