ci.yaml

name: CI
on:
  merge_group: {}
  pull_request:
    branches:
      - main

defaults:
  run:
    shell: bash

concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true

jobs:
  lint:
    name: lint
    runs-on: ubuntu-latest
    steps:
      - name: 🏗 Setup repo
        uses: actions/checkout@v4
      - name: 🏗 Setup pnpm
        uses: pnpm/action-setup@v4
      - name: 🏗 Setup Node
        uses: actions/setup-node@v4
        with:
          node-version: 22.x
          cache: pnpm
      - name: 📦 Install dependencies
        run: pnpm ii
        shell: bash
      - name: 🧹 Run lint
        run: pnpm lint
      - name: 🧹 Run eslint
        run: pnpm eslint
      - name: 🧹 Check type assertions
        run: pnpm verify-type-assertions

  build:
    name: build
    environment: Preview
    runs-on: ubuntu-latest
    steps:
      - name: 🏗 Setup repo
        uses: actions/checkout@v4
      - name: 🏗 Setup pnpm
        uses: pnpm/action-setup@v4
      - name: 🏗 Setup Node
        uses: actions/setup-node@v4
        with:
          node-version: 22.x
          cache: pnpm
      - name: 📦 Install dependencies
        run: pnpm ii
        shell: bash
      - name: 📦 Opt out of image optimization
        run: "sed -i 's/unoptimized: false/unoptimized: true/' next.config.js"
        shell: bash
      - name: 🧹 Run seed
        run: pnpm seed:standalone
        shell: bash
        env:
          DATABASE_URI: 'file:./dev.db'
          PAYLOAD_SECRET: ${{ secrets.PAYLOAD_SECRET }}
          ALLOW_SIMPLE_PASSWORDS: 'true'
      - name: 🧹 Run build
        run: pnpm build
        shell: bash
        env:
          DATABASE_URI: 'file:./dev.db'
          PAYLOAD_SECRET: ${{ secrets.PAYLOAD_SECRET }}

  prettier:
    name: prettier
    runs-on: ubuntu-latest
    steps:
      - name: 🏗 Setup repo
        uses: actions/checkout@v4
      - name: 🏗 Setup pnpm
        uses: pnpm/action-setup@v4
      - name: 🏗 Setup Node
        uses: actions/setup-node@v4
        with:
          node-version: 22.x
          cache: pnpm
      - name: 📦 Install dependencies
        run: pnpm ii
        shell: bash
      - name: 🧹 Run pnpm generate:type
        run: |
          set -o errexit
          set -o nounset
          set -o pipefail

          pnpm generate:types
          if [[ ! -z "$(git status --short)" ]]
          then
            echo "there are some modified files, rerun 'pnpm generate:types' to update them and check the changes in"
            git status
            exit 1
          fi
      - name: 🧹 Run pnpm generate:importmap
        run: |
          set -o errexit
          set -o nounset
          set -o pipefail

          pnpm generate:importmap
          if [[ ! -z "$(git status --short)" ]]
          then
            echo "there are some modified files, rerun 'pnpm generate:importmap' to update them and check the changes in"
            git status
            exit 1
          fi
      - name: 🧹 Run prettier
        run: if ! pnpm prettier --check .; then echo "⚠️  Run 'pnpm prettify' to fix prettier errors & commit the result"; exit 1; fi

  test:
    name: test
    runs-on: ubuntu-latest
    steps:
      - name: 🏗 Setup repo
        uses: actions/checkout@v4
      - name: 🏗 Setup pnpm
        uses: pnpm/action-setup@v4
      - name: 🏗 Setup Node
        uses: actions/setup-node@v4
        with:
          node-version: 22.x
          cache: pnpm
      - name: 📦 Install dependencies
        run: pnpm ii
        shell: bash
      - name: 🧪 Run tests
        run: pnpm test

  e2e:
    name: e2e
    if: github.event_name == 'merge_group'
    environment: Preview
    runs-on: ubuntu-latest
    env:
      DATABASE_URI: 'file:./dev.db'
      PAYLOAD_SECRET: ${{ secrets.PAYLOAD_SECRET }}
      ALLOW_SIMPLE_PASSWORDS: 'true'
      LOCAL_FLAG_ENABLE_LOCAL_PRODUCTION_BUILDS: 'true'
    steps:
      - name: 🏗 Setup repo
        uses: actions/checkout@v4
      - name: 🏗 Setup pnpm
        uses: pnpm/action-setup@v4
      - name: 🏗 Setup Node
        uses: actions/setup-node@v4
        with:
          node-version: 22.x
          cache: pnpm
      - name: 📦 Install dependencies
        run: pnpm ii
        shell: bash
      - name: 🎭 Install Playwright Chromium
        run: pnpm exec playwright install --with-deps chromium
      - name: 📦 Opt out of image optimization
        run: "sed -i 's/unoptimized: false/unoptimized: true/' next.config.js"
        shell: bash
      - name: 🌱 Seed database
        run: pnpm seed:standalone
      - name: 🔨 Build
        run: pnpm build
      - name: 🚀 Start server
        run: pnpm start &
      - name: ⏳ Wait for server
        run: timeout 120 bash -c 'until curl -sf http://localhost:3000/admin/login > /dev/null; do sleep 2; done'
      - name: 🧪 Run E2E tests
        run: pnpm test:e2e
      - name: 📤 Upload Playwright report
        uses: actions/upload-artifact@v4
        if: ${{ !cancelled() }}
        with:
          name: playwright-report
          path: playwright-report/
          retention-days: 14

  migrations-check:
    name: migrations-check
    runs-on: ubuntu-latest
    steps:
      - name: 🏗 Setup repo
        uses: actions/checkout@v4
      - name: 🏗 Setup pnpm
        uses: pnpm/action-setup@v4
      - name: 🏗 Setup Node
        uses: actions/setup-node@v4
        with:
          node-version: 22.x
          cache: pnpm
      - name: 📦 Install dependencies
        run: pnpm ii
        shell: bash
      - name: Check if a migration is needed
        run: |
          set -o errexit
          set -o nounset
          set -o pipefail

          output=$(pnpm payload migrate:create --skip-empty 2>&1)
          echo "$output"
          if echo "$output" | grep -q "Migration created at"; then
            echo "❌ A migration was created, which means the schema is out of sync"
            echo "Please run 'pnpm payload migrate:create' locally and commit the migration"
            exit 1
          else
            echo "✅ No migration needed - schema is up to date"
          fi
        env:
          DATABASE_URI: 'file:./dev.db'
          PAYLOAD_SECRET: ${{ secrets.PAYLOAD_SECRET }}

  migration-safety:
    name: migration-safety
    runs-on: ubuntu-latest
    permissions:
      pull-requests: write
    steps:
      - name: 🏗 Setup repo
        uses: actions/checkout@v4
        with:
          fetch-depth: 0 # Need full history to compare with base branch
      - name: 🏗 Setup pnpm
        uses: pnpm/action-setup@v4
      - name: 🏗 Setup Node
        uses: actions/setup-node@v4
        with:
          node-version: 22.x
          cache: pnpm
      - name: 📦 Install dependencies
        run: pnpm ii
        shell: bash
      - name: 🔍 Check migration safety
        id: check-migrations
        run: |
          # Get the base branch (main for PRs, or previous commit for direct pushes)
          if [ "${{ github.event_name }}" = "pull_request" ]; then
            BASE_REF="origin/${{ github.base_ref }}"
          else
            BASE_REF="HEAD^"
          fi

          # Find new or modified migration files
          MIGRATION_FILES=$(git diff --name-only --diff-filter=AM "$BASE_REF" HEAD | grep "^src/migrations/.*\.ts$" | grep -v "index.ts" || true)

          if [ -z "$MIGRATION_FILES" ]; then
            echo "✅ No new or modified migrations detected"
            echo "has_migrations=false" >> $GITHUB_OUTPUT
            exit 0
          fi

          echo "🔍 Checking migration safety for:"
          echo "$MIGRATION_FILES"
          echo ""
          echo "has_migrations=true" >> $GITHUB_OUTPUT

          # Run safety check on each migration (don't exit on failure)
          set +e
          HAS_ISSUES=false
          for file in $MIGRATION_FILES; do
            echo "Checking: $file"
            if ! pnpm migrate:check "$(basename $file)"; then
              HAS_ISSUES=true
              echo "⚠️  Safety issues detected in $file"
              echo ""
            fi
          done
          set -e

          if [ "$HAS_ISSUES" = "true" ]; then
            echo "has_issues=true" >> $GITHUB_OUTPUT
            echo ""
            echo "⚠️  Migration safety issues detected - will post comment on PR"
          else
            echo "has_issues=false" >> $GITHUB_OUTPUT
            echo "✅ All migration safety checks passed"
          fi
      - name: Find existing migration safety comment
        if: steps.check-migrations.outputs.has_issues == 'true' && github.event_name == 'pull_request'
        id: find-comment
        uses: peter-evans/find-comment@v2
        with:
          issue-number: ${{ github.event.pull_request.number }}
          comment-author: 'github-actions[bot]'
          body-includes: '### Migration Safety Check'
      - name: Create or update PR comment
        if: steps.check-migrations.outputs.has_issues == 'true' && github.event_name == 'pull_request'
        uses: peter-evans/create-or-update-comment@v3
        with:
          comment-id: ${{ steps.find-comment.outputs.comment-id }}
          issue-number: ${{ github.event.pull_request.number }}
          body: ${{ steps.check-migrations.outputs.comment }}
          edit-mode: replace