ci.yml

name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

concurrency:
  group: ci-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

# Principle of least privilege: every job in this workflow only reads the
# repo (checkout, build, test, upload-artifact within the workflow run).
# No job pushes, comments, opens PRs, or touches deployments — so the
# default token scope is restricted to `contents: read`. The Codecov
# upload uses `secrets.CODECOV_TOKEN` and does not need GITHUB_TOKEN
# write scopes. Adding a write permission here would expand blast radius
# without enabling any current job. The `e2e` / `e2e-consumer` / `examples` container
# jobs additionally grant `packages: read` at the job level so the runner
# can pull the Playwright image from our GHCR mirror (still read-only).
permissions:
  contents: read

# Version Packages PRs (opened by changesets/action on `changeset-release/*`
# branches) intentionally skip the real CI work — every check already ran on
# the feature PR that produced the changeset. To keep branch-protection
# happy, each required job still STARTS (so a status is reported) but its
# steps no-op when the branch matches `changeset-release/*`. The job-level
# env flag `IS_VP` drives that gate; do NOT replace it with a job-level `if:`
# because a skipped job reports no status and required-check rules will
# block the PR forever.
#
# For workflows to fire on the VP PR at all, the changesets/action push must
# be made with a non-`GITHUB_TOKEN` identity — see publish.yml.

jobs:
  lint:
    runs-on: ubuntu-latest
    env:
      IS_VP: ${{ startsWith(github.head_ref, 'changeset-release/') || startsWith(github.ref_name, 'changeset-release/') }}
    steps:
      - name: Skip on Version Packages PR
        if: env.IS_VP == 'true'
        run: echo "Skipped — Version Packages PR. Original checks ran on the producing PR."
      - if: env.IS_VP != 'true'
        uses: actions/checkout@v7
      - if: env.IS_VP != 'true'
        uses: ./.github/actions/setup
      - if: env.IS_VP != 'true'
        uses: actions/cache@v6
        with:
          path: node_modules/.cache/eslint
          key: eslint-${{ runner.os }}-${{ hashFiles('eslint.config.mjs', 'pnpm-lock.yaml') }}-${{ github.sha }}
          restore-keys: |
            eslint-${{ runner.os }}-${{ hashFiles('eslint.config.mjs', 'pnpm-lock.yaml') }}-
            eslint-${{ runner.os }}-
      - if: env.IS_VP != 'true'
        run: pnpm run format:check
      - if: env.IS_VP != 'true'
        run: pnpm run lint
      - if: env.IS_VP != 'true'
        run: pnpm run deps:check

  typecheck:
    runs-on: ubuntu-latest
    env:
      IS_VP: ${{ startsWith(github.head_ref, 'changeset-release/') || startsWith(github.ref_name, 'changeset-release/') }}
    steps:
      - name: Skip on Version Packages PR
        if: env.IS_VP == 'true'
        run: echo "Skipped — Version Packages PR."
      - if: env.IS_VP != 'true'
        uses: actions/checkout@v7
      - if: env.IS_VP != 'true'
        uses: ./.github/actions/setup
      - if: env.IS_VP != 'true'
        run: pnpm run typecheck

  build:
    runs-on: ubuntu-latest
    needs: [lint, typecheck]
    env:
      IS_VP: ${{ startsWith(github.head_ref, 'changeset-release/') || startsWith(github.ref_name, 'changeset-release/') }}
    steps:
      - name: Skip on Version Packages PR
        if: env.IS_VP == 'true'
        run: echo "Skipped — Version Packages PR."
      - if: env.IS_VP != 'true'
        uses: actions/checkout@v7
      - if: env.IS_VP != 'true'
        uses: ./.github/actions/setup
      - if: env.IS_VP != 'true'
        run: pnpm run build
      # Docs are otherwise never built in CI, and Renovate auto-merges
      # devDependency bumps (including vitepress prerelease updates) — this is
      # the only gate against a docs-breaking upgrade landing unnoticed.
      - if: env.IS_VP != 'true'
        run: pnpm --filter @templatical/docs run build
      # Guard the editor's published-tarball install footprint. Catches anyone
      # adding a runtime `dependency` that re-bloats consumer node_modules or
      # re-introduces the duplicate-Vue-instance bug. See packages/editor/scripts/verify-pack.mjs.
      - if: env.IS_VP != 'true'
        run: pnpm --filter @templatical/editor run verify:pack
      # Hard gate: every showcase template must pass the accessibility linter.
      # Runs after build because the script imports the built quality dist —
      # tsx can't evaluate `import.meta.glob` from source.
      - if: env.IS_VP != 'true'
        run: pnpm --filter @templatical/playground run lint:templates
      # The playground's production build (what play.templatical.com serves) is
      # otherwise only built by the deploy, and e2e runs `vite dev`. It compiles
      # the editor from source, so this is where its own CSS could reach the
      # editor's shadow root. See apps/playground/scripts/verify-shadow-sheet.mjs.
      - if: env.IS_VP != 'true'
        run: pnpm --filter @templatical/playground run build
      - if: env.IS_VP != 'true'
        run: pnpm --filter @templatical/playground run verify:shadow-sheet
      - if: env.IS_VP != 'true'
        uses: actions/upload-artifact@v7
        with:
          name: dist
          path: packages/*/dist
          retention-days: 1
          include-hidden-files: true

  test:
    runs-on: ubuntu-latest
    needs: [build]
    env:
      IS_VP: ${{ startsWith(github.head_ref, 'changeset-release/') || startsWith(github.ref_name, 'changeset-release/') }}
    steps:
      - name: Skip on Version Packages PR
        if: env.IS_VP == 'true'
        run: echo "Skipped — Version Packages PR."
      - if: env.IS_VP != 'true'
        uses: actions/checkout@v7
      - if: env.IS_VP != 'true'
        uses: ./.github/actions/setup
      - if: env.IS_VP != 'true'
        uses: actions/download-artifact@v8
        with:
          name: dist
          path: packages/
      - if: env.IS_VP != 'true'
        run: pnpm run test:coverage
      - if: env.IS_VP != 'true'
        uses: codecov/codecov-action@v7
        with:
          token: ${{ secrets.CODECOV_TOKEN }}
          directory: .
          # The CLI can report a queued upload while Codecov never processes
          # it (deactivated repo, rejected token). The README badge then sits
          # on a stale percentage with a green test job. Failing here is the
          # signal that the badge has gone stale.
          fail_ci_if_error: true

  e2e:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: read
    # Playwright's official image ships Chromium + every system dep
    # preinstalled, skipping the ~5 min `playwright install-deps` step that
    # fresh ubuntu-latest runners would otherwise pay every run (apt state
    # isn't cacheable across runs).
    #
    # Pulled from our GHCR mirror, NOT mcr.microsoft.com directly: MCR's Azure
    # edge intermittently throttles concurrent pulls ("The request is
    # blocked."), which fails "Initialize containers" and turns this job red at
    # random. GHCR is co-located with the runners and isn't throttled. The
    # mirror is kept in sync by .github/workflows/mirror-playwright.yml. The tag
    # must match the pinned `@playwright/test` version in pnpm-lock.yaml AND the
    # tag that workflow mirrors.
    container:
      image: ghcr.io/templatical/playwright:v1.64.1-jammy
      credentials:
        username: ${{ github.actor }}
        password: ${{ secrets.GITHUB_TOKEN }}
    needs: [build]
    strategy:
      fail-fast: false
      matrix:
        shard: [1, 2, 3]
    env:
      IS_VP: ${{ startsWith(github.head_ref, 'changeset-release/') || startsWith(github.ref_name, 'changeset-release/') }}
    steps:
      - name: Skip on Version Packages PR
        if: env.IS_VP == 'true'
        run: echo "Skipped — Version Packages PR."
      - if: env.IS_VP != 'true'
        uses: actions/checkout@v7
      - if: env.IS_VP != 'true'
        uses: ./.github/actions/setup
      - if: env.IS_VP != 'true'
        uses: actions/download-artifact@v8
        with:
          name: dist
          path: packages/
      - if: env.IS_VP != 'true'
        run: pnpm exec playwright test --shard=${{ matrix.shard }}/3
      - if: env.IS_VP != 'true' && !cancelled()
        uses: actions/upload-artifact@v7
        with:
          name: blob-report-${{ matrix.shard }}
          path: blob-report/
          retention-days: 1

  e2e-consumer:
    # Smoke-test the editor as a real consumer would: pack, install into a
    # fresh project, mount, click. Catches the duplicate-Vue-instance class of
    # bug that the workspace-resolved playground e2e cannot see.
    #
    # Skipped on Version Packages PRs (changeset-release/*) because the packed
    # tarballs reference the about-to-be-released workspace versions, which
    # aren't on npm yet — `npm install` would fail with ETARGET. The original
    # gate already ran on the producing PR; the post-merge run on `main` (after
    # publish) re-covers the surface.
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: read
    # Same rationale as the `e2e` job — the Playwright image skips the
    # system-dep install step, pulled from our GHCR mirror to dodge MCR's
    # intermittent edge throttling (see the `e2e` job + mirror-playwright.yml).
    container:
      image: ghcr.io/templatical/playwright:v1.64.1-jammy
      credentials:
        username: ${{ github.actor }}
        password: ${{ secrets.GITHUB_TOKEN }}
    needs: [build]
    env:
      IS_VP: ${{ startsWith(github.head_ref, 'changeset-release/') || startsWith(github.ref_name, 'changeset-release/') }}
    steps:
      - name: Skip on Version Packages PR
        if: env.IS_VP == 'true'
        run: echo "Skipped — Version Packages PR. Tarballs reference unreleased versions."
      - if: env.IS_VP != 'true'
        uses: actions/checkout@v7
      - if: env.IS_VP != 'true'
        uses: ./.github/actions/setup
      # No dist download: the prep script builds what it packs, and every
      # workspace package those builds read from dist/, from this checkout
      # (`buildOrder` in packages/editor/scripts/consumer-fixture.mjs). A
      # downloaded dist would hide a missing build edge until a fresh local
      # checkout hit it.
      - if: env.IS_VP != 'true'
        run: pnpm run test:e2e:consumer
      - if: env.IS_VP != 'true' && failure()
        uses: actions/upload-artifact@v7
        with:
          name: e2e-consumer-report
          path: playwright-report/
          retention-days: 7

  webpack-consumer:
    # Build the editor as a real Webpack 5 consumer would. Catches issue #63:
    # if anyone adds a dynamic `import()` to an optional peer without try/catch,
    # webpack escalates "Module not found" from warning to error and breaks the
    # consumer's production build. See packages/editor/scripts/webpack-consumer-verify.mjs.
    runs-on: ubuntu-latest
    needs: [build]
    env:
      IS_VP: ${{ startsWith(github.head_ref, 'changeset-release/') || startsWith(github.ref_name, 'changeset-release/') }}
    steps:
      - name: Skip on Version Packages PR
        if: env.IS_VP == 'true'
        run: echo "Skipped — Version Packages PR."
      - if: env.IS_VP != 'true'
        uses: actions/checkout@v7
      - if: env.IS_VP != 'true'
        uses: ./.github/actions/setup
      # No dist download, for the same reason as e2e-consumer.
      - if: env.IS_VP != 'true'
        run: pnpm run test:webpack-consumer

  examples:
    # Build and run each examples/<name> app the way a new user would, against
    # this PR's packed packages: materialize it with every @templatical
    # dependency pointed at a tarball, npm install, production build, typecheck,
    # start, then the Playwright smoke spec. The nextjs build is Next.js 16's
    # Turbopack build, which fails on a UMD/AMD define() wrapper in the editor
    # bundle with `error TP1200` (issue #67).
    # See packages/editor/scripts/examples-verify.mjs.
    runs-on: ubuntu-latest
    timeout-minutes: 30
    permissions:
      contents: read
      packages: read
    # Same image and mirror as the `e2e` job.
    container:
      image: ghcr.io/templatical/playwright:v1.64.1-jammy
      credentials:
        username: ${{ github.actor }}
        password: ${{ secrets.GITHUB_TOKEN }}
    needs: [build]
    strategy:
      fail-fast: false
      matrix:
        example: [nextjs, nuxt, sveltekit, react-router, react-vite]
    env:
      IS_VP: ${{ startsWith(github.head_ref, 'changeset-release/') || startsWith(github.ref_name, 'changeset-release/') }}
    steps:
      - name: Skip on Version Packages PR
        if: env.IS_VP == 'true'
        run: echo "Skipped — Version Packages PR."
      - if: env.IS_VP != 'true'
        uses: actions/checkout@v7
      - if: env.IS_VP != 'true'
        uses: ./.github/actions/setup
      # The packages are packed from the build job's dist, not rebuilt.
      - if: env.IS_VP != 'true'
        uses: actions/download-artifact@v8
        with:
          name: dist
          path: packages/
      - if: env.IS_VP != 'true'
        run: pnpm run test:examples ${{ matrix.example }}
      - if: env.IS_VP != 'true' && failure()
        uses: actions/upload-artifact@v7
        with:
          name: examples-report-${{ matrix.example }}
          path: playwright-report/
          retention-days: 7

  e2e-report:
    runs-on: ubuntu-latest
    needs: [e2e]
    if: ${{ !cancelled() && needs.e2e.result != 'skipped' }}
    env:
      IS_VP: ${{ startsWith(github.head_ref, 'changeset-release/') || startsWith(github.ref_name, 'changeset-release/') }}
    steps:
      - name: Skip on Version Packages PR
        if: env.IS_VP == 'true'
        run: echo "Skipped — Version Packages PR. No e2e artifacts produced."
      - if: env.IS_VP != 'true'
        uses: actions/checkout@v7
      - if: env.IS_VP != 'true'
        uses: ./.github/actions/setup
      - if: env.IS_VP != 'true'
        uses: actions/download-artifact@v8
        with:
          path: all-blob-reports
          pattern: blob-report-*
          merge-multiple: true
      - if: env.IS_VP != 'true'
        run: pnpm exec playwright merge-reports --reporter html ./all-blob-reports
      - if: env.IS_VP != 'true'
        uses: actions/upload-artifact@v7
        with:
          name: playwright-report
          path: playwright-report/
          retention-days: 7