evOo-local/.github/workflows/ci.yml

# Product merge gate: the `Product CI` job aggregates lint, typecheck, builds, unit,
# Postgres journeys, and Web E2E. Branch protection should require only that check.
# Deploy, OTA, and artifact uploads here are post-merge or soft-fail infra helpers.
name: ci
on:
  push:
    branches: [main]
    paths:
      - "apps/**"
      - "packages/**"
      - "infra/**"
      - "scripts/**"
      - "ops/**"
      - ".github/**"
      - "package.json"
      - "pnpm-lock.yaml"
      - "pnpm-workspace.yaml"
      - "turbo.json"
      - "biome.json"
      - "vitest.config.ts"
      - "tsconfig*.json"
  pull_request:

permissions:
  contents: read
  pull-requests: read

concurrency:
  group: ci-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

# Jobs that only need Node/pnpm/bash use [self-hosted, evoo-ci] so macOS runners (air, mini)
# can share load. Linux-only work keeps the Linux label (Docker, xvfb, local Postgres :5433).

jobs:
  changes:
    name: Detect product changes
    runs-on: [self-hosted, evoo-ci]
    outputs:
      product: ${{ steps.filter.outputs.product }}
    steps:
      - uses: actions/checkout@v5
        with:
          persist-credentials: false
          fetch-depth: 0
      - uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
        id: filter
        with:
          filters: |
            product:
              - 'apps/**'
              - 'packages/**'
              - 'infra/**'
              - 'scripts/**'
              - 'ops/**'
              - '.github/**'
              - 'package.json'
              - 'pnpm-lock.yaml'
              - 'pnpm-workspace.yaml'
              - 'turbo.json'
              - 'biome.json'
              - 'vitest.config.ts'
              - 'tsconfig*.json'

  lint:
    name: Lint
    needs: changes
    if: needs.changes.outputs.product == 'true'
    runs-on: [self-hosted, evoo-ci]
    steps:
      - uses: actions/checkout@v5
        with:
          persist-credentials: false
      - uses: pnpm/action-setup@v4
        id: pnpm-setup
        with:
          dest: ${{ runner.temp }}/setup-pnpm-${{ github.run_id }}-${{ github.job }}
      - name: Isolate pnpm store and PATH
        shell: bash
        run: |
          set -euo pipefail
          bin="${{ steps.pnpm-setup.outputs.bin_dest }}"
          dest="${{ steps.pnpm-setup.outputs.dest }}"
          if [[ -z "$bin" || -z "$dest" ]]; then
            echo "pnpm setup did not report install paths" >&2
            exit 1
          fi
          echo "PNPM_HOME=${dest}" >> "$GITHUB_ENV"
          echo "${bin}" >> "$GITHUB_PATH"
          echo "${dest}" >> "$GITHUB_PATH"
          store="${RUNNER_TOOL_CACHE}/pnpm-store"
          mkdir -p "$store"
          echo "npm_config_store_dir=${store}" >> "$GITHUB_ENV"
      - uses: actions/setup-node@v4
        with:
          node-version: 22
          cache: pnpm
      - run: pnpm install --frozen-lockfile
      - run: pnpm lint

  check:
    name: Typecheck
    needs: changes
    if: needs.changes.outputs.product == 'true'
    runs-on: [self-hosted, evoo-ci]
    steps:
      - uses: actions/checkout@v5
        with:
          persist-credentials: false
      - uses: pnpm/action-setup@v4
        id: pnpm-setup
        with:
          dest: ${{ runner.temp }}/setup-pnpm-${{ github.run_id }}-${{ github.job }}
      - name: Isolate pnpm store and PATH
        shell: bash
        run: |
          set -euo pipefail
          bin="${{ steps.pnpm-setup.outputs.bin_dest }}"
          dest="${{ steps.pnpm-setup.outputs.dest }}"
          if [[ -z "$bin" || -z "$dest" ]]; then
            echo "pnpm setup did not report install paths" >&2
            exit 1
          fi
          echo "PNPM_HOME=${dest}" >> "$GITHUB_ENV"
          echo "${bin}" >> "$GITHUB_PATH"
          echo "${dest}" >> "$GITHUB_PATH"
          store="${RUNNER_TOOL_CACHE}/pnpm-store"
          mkdir -p "$store"
          echo "npm_config_store_dir=${store}" >> "$GITHUB_ENV"
      - uses: actions/setup-node@v4
        with:
          node-version: 22
          cache: pnpm
      - run: pnpm install --frozen-lockfile
      - run: pnpm db:generate
        env:
          DATABASE_URL: postgres://rakazo:rakazo@127.0.0.1:5433/rakazo
      - run: pnpm check

  build:
    name: Production builds
    needs: changes
    if: needs.changes.outputs.product == 'true'
    runs-on: [self-hosted, evoo-ci, Linux]
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@v5
        with:
          persist-credentials: false
      - uses: pnpm/action-setup@v4
        id: pnpm-setup
        with:
          dest: ${{ runner.temp }}/setup-pnpm-${{ github.run_id }}-${{ github.job }}
      - name: Isolate pnpm store and PATH
        shell: bash
        run: |
          set -euo pipefail
          bin="${{ steps.pnpm-setup.outputs.bin_dest }}"
          dest="${{ steps.pnpm-setup.outputs.dest }}"
          if [[ -z "$bin" || -z "$dest" ]]; then
            echo "pnpm setup did not report install paths" >&2
            exit 1
          fi
          echo "PNPM_HOME=${dest}" >> "$GITHUB_ENV"
          echo "${bin}" >> "$GITHUB_PATH"
          echo "${dest}" >> "$GITHUB_PATH"
          store="${RUNNER_TOOL_CACHE}/pnpm-store"
          mkdir -p "$store"
          echo "npm_config_store_dir=${store}" >> "$GITHUB_ENV"
      - uses: actions/setup-node@v4
        with:
          node-version: 22
          cache: pnpm
      - run: pnpm install --frozen-lockfile
      - run: pnpm build
        env:
          DATABASE_URL: postgres://rakazo:rakazo@127.0.0.1:5433/rakazo
          BETTER_AUTH_SECRET: ci-build-auth-secret-at-least-32-characters
          ENCRYPTION_KEY: ci-build-encryption-key-at-least-32-characters
      - name: Electron smoke
        run: xvfb-run --auto-servernum pnpm --filter @rakazo/desktop exec playwright test --config e2e/playwright.config.ts
      - name: Upload desktop setup screenshots
        if: always()
        continue-on-error: true
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        with:
          name: desktop-e2e-screenshots
          path: apps/desktop/e2e/screenshots
          if-no-files-found: ignore
          retention-days: 7

  test:
    name: Unit tests
    needs: changes
    if: needs.changes.outputs.product == 'true'
    runs-on: [self-hosted, evoo-ci]
    steps:
      - uses: actions/checkout@v5
        with:
          persist-credentials: false
      - uses: pnpm/action-setup@v4
        id: pnpm-setup
        with:
          dest: ${{ runner.temp }}/setup-pnpm-${{ github.run_id }}-${{ github.job }}
      - name: Isolate pnpm store and PATH
        shell: bash
        run: |
          set -euo pipefail
          bin="${{ steps.pnpm-setup.outputs.bin_dest }}"
          dest="${{ steps.pnpm-setup.outputs.dest }}"
          if [[ -z "$bin" || -z "$dest" ]]; then
            echo "pnpm setup did not report install paths" >&2
            exit 1
          fi
          echo "PNPM_HOME=${dest}" >> "$GITHUB_ENV"
          echo "${bin}" >> "$GITHUB_PATH"
          echo "${dest}" >> "$GITHUB_PATH"
          store="${RUNNER_TOOL_CACHE}/pnpm-store"
          mkdir -p "$store"
          echo "npm_config_store_dir=${store}" >> "$GITHUB_ENV"
      - uses: actions/setup-node@v4
        with:
          node-version: 22
          cache: pnpm
      - run: pnpm install --frozen-lockfile
      - run: pnpm db:generate
        env:
          DATABASE_URL: postgres://rakazo:rakazo@127.0.0.1:5433/rakazo
      - run: pnpm test

  test-integration:
    name: Postgres journeys
    needs: changes
    if: needs.changes.outputs.product == 'true'
    runs-on: [self-hosted, evoo-ci, Linux]
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@v5
        with:
          persist-credentials: false
      - uses: pnpm/action-setup@v4
        id: pnpm-setup
        with:
          dest: ${{ runner.temp }}/setup-pnpm-${{ github.run_id }}-${{ github.job }}
      - name: Isolate pnpm store and PATH
        shell: bash
        run: |
          set -euo pipefail
          bin="${{ steps.pnpm-setup.outputs.bin_dest }}"
          dest="${{ steps.pnpm-setup.outputs.dest }}"
          if [[ -z "$bin" || -z "$dest" ]]; then
            echo "pnpm setup did not report install paths" >&2
            exit 1
          fi
          echo "PNPM_HOME=${dest}" >> "$GITHUB_ENV"
          echo "${bin}" >> "$GITHUB_PATH"
          echo "${dest}" >> "$GITHUB_PATH"
          store="${RUNNER_TOOL_CACHE}/pnpm-store"
          mkdir -p "$store"
          echo "npm_config_store_dir=${store}" >> "$GITHUB_ENV"
      - uses: actions/setup-node@v4
        with:
          node-version: 22
          cache: pnpm
      - run: pnpm install --frozen-lockfile
      - run: pnpm test:integration

  test-e2e:
    name: Web E2E
    needs: changes
    if: needs.changes.outputs.product == 'true'
    uses: ./.github/workflows/playwright.yml
    with:
      upload_artifacts: true

  product-gate:
    name: Product CI
    if: always()
    needs: [changes, lint, check, build, test, test-integration, test-e2e]
    runs-on: [self-hosted, evoo-ci]
    steps:
      - name: Verify product checks
        env:
          PRODUCT: ${{ needs.changes.outputs.product }}
          LINT: ${{ needs.lint.result }}
          CHECK: ${{ needs.check.result }}
          BUILD: ${{ needs.build.result }}
          TEST: ${{ needs.test.result }}
          TEST_INTEGRATION: ${{ needs.test-integration.result }}
          TEST_E2E: ${{ needs.test-e2e.result }}
        run: |
          set -euo pipefail
          if [[ "$PRODUCT" != "true" ]]; then
            echo "No product-impacting paths changed; Product CI satisfied."
            exit 0
          fi
          failed=0
          for name in LINT CHECK BUILD TEST TEST_INTEGRATION TEST_E2E; do
            result="${!name}"
            printf '%s=%s\n' "$name" "$result"
            if [[ "$result" == "skipped" ]]; then
              echo "$name was skipped although product paths changed." >&2
              failed=1
            elif [[ "$result" != "success" ]]; then
              failed=1
            fi
          done
          if [[ "$failed" -ne 0 ]]; then
            echo "One or more product checks failed." >&2
            exit 1
          fi
          echo "All product checks passed."

  publish-mobile-update:
    name: Publish compatible mobile update
    if: github.event_name == 'push' && github.ref == 'refs/heads/main' && needs.changes.outputs.product == 'true'
    continue-on-error: true
    needs: [changes, lint, check, build, test, test-integration, test-e2e]
    runs-on: [self-hosted, evoo-ci, Linux]
    timeout-minutes: 20
    concurrency:
      group: mobile-production-update
      cancel-in-progress: false
    steps:
      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
        with:
          fetch-depth: 0
          persist-credentials: false

      - name: Check whether the change is safe for OTA
        id: ota
        shell: bash
        env:
          BEFORE_SHA: ${{ github.event.before }}
        run: |
          set -euo pipefail
          base="$BEFORE_SHA"
          if [[ -z "$base" || "$base" =~ ^0+$ ]] || ! git cat-file -e "${base}^{commit}"; then
            {
              echo "### Mobile OTA skipped"
              echo
              echo "Could not resolve \`github.event.before\` for the full push range, so this job will not publish a partial-range update."
            } >> "$GITHUB_STEP_SUMMARY"
            echo "publish=false" >> "$GITHUB_OUTPUT"
            exit 0
          fi

          mapfile -t files < <(
            git diff --name-only "$base" "$GITHUB_SHA" -- \
              .github/workflows/ci.yml \
              apps/mobile \
              package.json \
              packages/chat-ui \
              packages/contracts \
              packages/core \
              pnpm-lock.yaml
          )

          publish=false
          blocked=false
          for file in "${files[@]}"; do
            case "$file" in
              *.test.ts|*.test.tsx|*.d.ts)
                continue
                ;;
            esac

            eligible=false
            case "$file" in
              apps/mobile/app/*|apps/mobile/components/*|apps/mobile/lib/*)
                case "$file" in
                  *.ts|*.tsx) eligible=true ;;
                esac
                ;;
              packages/chat-ui/src/*)
                case "$file" in
                  *.ts|*.tsx|*.css) eligible=true ;;
                esac
                ;;
              packages/contracts/src/*|packages/core/src/*)
                case "$file" in
                  *.ts|*.tsx) eligible=true ;;
                esac
                ;;
            esac

            if [[ "$eligible" == true ]]; then
              publish=true
            else
              blocked=true
            fi
          done

          if [[ "$blocked" == true ]]; then
            publish=false
            {
              echo "### Mobile OTA skipped"
              echo
              echo "This revision changes native-sensitive mobile configuration, dependencies, modules, assets, or workflow files. Create new iOS and Android builds instead of publishing it to an older native runtime."
            } >> "$GITHUB_STEP_SUMMARY"
          elif [[ "$publish" == true ]]; then
            {
              echo "### Mobile OTA eligible"
              echo
              echo "The revision only changes JavaScript, TypeScript, or bundled CSS used by the mobile client."
            } >> "$GITHUB_STEP_SUMMARY"
          else
            {
              echo "### No mobile OTA needed"
              echo
              echo "This revision does not change the shipped mobile bundle."
            } >> "$GITHUB_STEP_SUMMARY"
          fi
          echo "publish=$publish" >> "$GITHUB_OUTPUT"

      - name: Check Expo automation token
        id: expo_token
        if: steps.ota.outputs.publish == 'true'
        env:
          EXPO_TOKEN: ${{ secrets.EXPO_TOKEN }}
        run: |
          if [[ -z "$EXPO_TOKEN" ]]; then
            {
              echo "### Mobile OTA skipped"
              echo
              echo "No \`EXPO_TOKEN\` repository secret is configured, so CI will not publish a production update. Add a token with access to the inbox-zero/rakazo Expo project when OTA from main is desired."
            } >> "$GITHUB_STEP_SUMMARY"
            echo "ready=false" >> "$GITHUB_OUTPUT"
            exit 0
          fi
          echo "ready=true" >> "$GITHUB_OUTPUT"

      - uses: pnpm/action-setup@f40ffcd9367d9f12939873eb1018b921a783ffaa # v4
        if: steps.ota.outputs.publish == 'true' && steps.expo_token.outputs.ready == 'true'
        id: pnpm-setup
        with:
          dest: ${{ runner.temp }}/setup-pnpm-${{ github.run_id }}-${{ github.job }}
      - name: Isolate pnpm store and PATH
        if: steps.ota.outputs.publish == 'true' && steps.expo_token.outputs.ready == 'true'
        shell: bash
        run: |
          set -euo pipefail
          bin="${{ steps.pnpm-setup.outputs.bin_dest }}"
          dest="${{ steps.pnpm-setup.outputs.dest }}"
          if [[ -z "$bin" || -z "$dest" ]]; then
            echo "pnpm setup did not report install paths" >&2
            exit 1
          fi
          echo "PNPM_HOME=${dest}" >> "$GITHUB_ENV"
          echo "${bin}" >> "$GITHUB_PATH"
          echo "${dest}" >> "$GITHUB_PATH"
          store="${RUNNER_TOOL_CACHE}/pnpm-store"
          mkdir -p "$store"
          echo "npm_config_store_dir=${store}" >> "$GITHUB_ENV"
      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
        if: steps.ota.outputs.publish == 'true' && steps.expo_token.outputs.ready == 'true'
        with:
          node-version: 24
          cache: pnpm
      - name: Set up Expo
        if: steps.ota.outputs.publish == 'true' && steps.expo_token.outputs.ready == 'true'
        uses: expo/expo-github-action@eab7a230208c952974db8c3245cfd78402c7b385 # v9
        with:
          eas-version: latest
          packager: pnpm
          token: ${{ secrets.EXPO_TOKEN }}
      - name: Install dependencies
        if: steps.ota.outputs.publish == 'true' && steps.expo_token.outputs.ready == 'true'
        run: pnpm install --frozen-lockfile
      - name: Verify mobile project
        if: steps.ota.outputs.publish == 'true' && steps.expo_token.outputs.ready == 'true'
        run: pnpm --filter @rakazo/mobile check
      - name: Publish production update
        if: steps.ota.outputs.publish == 'true' && steps.expo_token.outputs.ready == 'true'
        working-directory: apps/mobile
        run: |
          set -euo pipefail
          head="$(git ls-remote origin refs/heads/main | awk '{print $1}')"
          if [[ -z "$head" ]]; then
            echo "Could not resolve the current main head before publishing." >&2
            exit 1
          fi
          if [[ "$GITHUB_SHA" != "$head" ]]; then
            {
              echo "### Mobile OTA skipped"
              echo
              echo "This run is for \`$GITHUB_SHA\`, but \`main\` is now \`$head\`. Skipping so an older revision cannot overwrite a newer production update."
            } >> "$GITHUB_STEP_SUMMARY"
            exit 0
          fi
          eas update --platform all --channel production --environment production --message "$GITHUB_SHA" --non-interactive