lint.yml

name: Lint

on:
  pull_request:
  push:
    branches:
      - main
concurrency:
  group: '${{ github.workflow }}-${{ github.head_ref || github.ref }}'
  cancel-in-progress: true

# These jobs only check out the repo and run checks, so read access to the
# repo contents is all the GITHUB_TOKEN needs.
permissions:
  contents: read

jobs:
  node-versions:
    name: Verify Node versions
    runs-on: ubuntu-latest
    steps:
      # Temporary until fixed runner images roll out:
      # https://github.com/actions/runner-images/issues/15018
      - name: Update Ubuntu CA certificates
        run: |
          sudo apt-get update -qq
          sudo apt-get install --only-upgrade --no-install-recommends -y ca-certificates

      - name: ⬇️ Check out Git repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
      - name: 🔧 Install node
        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
        with:
          node-version-file: package.json
          cache: pnpm
      - name: 🔍 Verify Node versions against package.json
        run: |
          set -euo pipefail
          version_range=$(node -p "require('./package.json').engines.node")
          version_exact=$(node -p "require('./package.json').engines.node.replace(/[^0-9.]/g, '')")
          rc=0
          check() {
            if [ "$2" != "$version_exact" ]; then
              echo "::error file=$1::Node version mismatch: $1 pins '$2' but package.json is '$version_exact'"
              rc=1
            fi
          }
          for f in Dockerfile.bskylink Dockerfile.bskyogcard; do
            images=$(grep -oE '^FROM node:[^[:space:]]+' "$f" | cut -d ' ' -f2 | sort -u)
            for image in $images; do
              v=$(docker run --rm --entrypoint node "$image" --version)
              if ! pnpm dlx semver@7 "$v" --range "$version_range"; then
                echo "::error file=$f::Node version mismatch: $image runs '$v' but package.json requires '$version_range'"
                rc=1
              fi
            done
          done
          # eas.json "node": "X.Y.Z"
          v=$(grep -oE '"node":[[:space:]]*"[0-9]+\.[0-9]+\.[0-9]+"' eas.json | grep -oE '[0-9]+\.[0-9]+\.[0-9]+' | sort -u)
          check "eas.json" "$v"
          exit $rc
  linting:
    name: Run linters
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        job:
          [
            lint,
            'intl:lint',
            prettier,
            'lexicons:verify',
            'typecheck:ios',
            'typecheck:android',
            'typecheck:web',
          ]
    steps:
      # Temporary until fixed runner images roll out:
      # https://github.com/actions/runner-images/issues/15018
      - name: Update Ubuntu CA certificates
        run: |
          sudo apt-get update -qq
          sudo apt-get install --only-upgrade --no-install-recommends -y ca-certificates

      - name: ⬇️ Check out Git repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
      - name: 🔧 Install node
        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
        with:
          node-version-file: package.json
          cache: pnpm
      - name: 📦 pnpm install
        run: pnpm install --frozen-lockfile
      - name: 🔤 Check & compile i18n
        run: pnpm intl:build
      - name: 🧹 Lint checks
        run: pnpm ${{ matrix.job }}
  # Aggregates the matrix results into a single stable check name so branch
  # protection can require "Run linters" regardless of how many matrix jobs run.
  # The result is asserted in `run` (not `if`) so a malformed expression can
  # never silently skip the check and report a false pass.
  linting-summary:
    name: Run linters
    if: always()
    needs: [linting, node-versions]
    runs-on: ubuntu-latest
    steps:
      - name: ✅ Require linting to have succeeded
        env:
          RESULT: ${{ needs.linting.result }}
          NODE_VERSIONS_RESULT: ${{ needs.node-versions.result }}
        run: |
          echo "linting result: $RESULT"
          test "$RESULT" = "success"
          echo "Node versions result: $NODE_VERSIONS_RESULT"
          test "$NODE_VERSIONS_RESULT" = "success"
  testing:
    name: Run tests
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        shard: [1, 2, 3, 4]
    steps:
      # Temporary until fixed runner images roll out:
      # https://github.com/actions/runner-images/issues/15018
      - name: Update Ubuntu CA certificates
        run: |
          sudo apt-get update -qq
          sudo apt-get install --only-upgrade --no-install-recommends -y ca-certificates

      - name: ⬇️ Check out Git repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
      - name: 🔧 Install node
        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
        with:
          node-version-file: package.json
          cache: pnpm
      - name: 📦 pnpm install
        run: pnpm install --frozen-lockfile
      - name: 🔤 Check & compile i18n
        run: pnpm intl:build
      - name: 🧪 Run tests
        run: |
          NODE_ENV=test pnpm test --forceExit --shard=${{ matrix.shard }}/${{ strategy.job-total }}
  # Aggregates the sharded test results into a single stable check name so branch
  # protection can require "Run tests" regardless of how many shards run.
  # The result is asserted in `run` (not `if`) so a malformed expression can
  # never silently skip the check and report a false pass.
  testing-summary:
    name: Run tests
    if: always()
    needs: [testing]
    runs-on: ubuntu-latest
    steps:
      - name: ✅ Require testing to have succeeded
        env:
          RESULT: ${{ needs.testing.result }}
        run: |
          echo "testing result: $RESULT"
          test "$RESULT" = "success"