validate.yml

name: validate
on:
  push:
    branches: ['main']
  pull_request:
  workflow_dispatch:

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true
env:
  NX_CLOUD_ACCESS_TOKEN: ${{ secrets.NX_CLOUD_ACCESS_TOKEN }}
  EPICSHOP_APP_COMMIT_SHA: ${{ github.sha }}

jobs:
  lint:
    name: ⬣ Oxlint
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
      - name: ⬇️ Checkout repo
        uses: actions/checkout@v5

      - name: ⎔ Setup node
        uses: actions/setup-node@v6
        with:
          node-version: 24
          cache: 'npm'

      - name: 📥 Download deps
        run: npm install --prefer-offline --no-audit --no-fund

      - name: 🔬 Lint
        run: npm run lint

  build:
    name: 🏗 Build
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
      - name: ⬇️ Checkout repo
        uses: actions/checkout@v5

      - name: ⎔ Setup node
        uses: actions/setup-node@v6
        with:
          node-version: 24
          cache: 'npm'

      - name: 📥 Download deps
        run: npm install --prefer-offline --no-audit --no-fund

      - name: 🏗 Build
        run: npm run build
        env:
          SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
          SENTRY_ORG: ${{ secrets.SENTRY_ORG }}
          SENTRY_PROJECT: ${{ secrets.SENTRY_PROJECT }}
          SENTRY_DSN: ${{ secrets.SENTRY_DSN }}
          NODE_ENV: production

      # run install again so the local .bin files get where they should go.
      - name: 📥 Download deps
        run: npm install --prefer-offline --no-audit --no-fund

      - name: 📦 Upload All Build Artifacts
        uses: actions/upload-artifact@v4
        with:
          name: all-build-artifacts
          path: |
            packages/workshop-app/build
            packages/workshop-app/dist
            packages/workshop-presence/dist
            packages/workshop-utils/dist
            packages/workshop-mcp/dist
            packages/workshop-cli/dist

  test:
    name: 🧪 Tests
    needs: [build]
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
      - name: ⬇️ Checkout repo
        uses: actions/checkout@v5

      - name: ⎔ Setup node
        uses: actions/setup-node@v6
        with:
          node-version: 24
          cache: 'npm'

      - name: 📥 Download All Build Artifacts
        uses: actions/download-artifact@v4
        with:
          name: all-build-artifacts
          path: packages

      - name: 📥 Download deps
        run: npm install --prefer-offline --no-audit --no-fund

      - name: 🧪 Run tests
        run: npm test -- --no-watch

  typecheck:
    name: ʦ TypeScript
    needs: [build]
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
      - name: ⬇️ Checkout repo
        uses: actions/checkout@v5

      - name: ⎔ Setup node
        uses: actions/setup-node@v6
        with:
          node-version: 24
          cache: 'npm'

      - name: 📥 Download All Build Artifacts
        uses: actions/download-artifact@v4
        with:
          name: all-build-artifacts
          path: packages

      - name: 📥 Download deps
        run: npm install --prefer-offline --no-audit --no-fund

      - name: 🔎 Type check
        run: npm run typecheck

  playwright:
    name: 🎭 Playwright
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - name: ⬇️ Checkout repo
        uses: actions/checkout@v5

      - name: ⎔ Setup node
        uses: actions/setup-node@v6
        with:
          node-version: 24
          cache: 'npm'

      # can't use build artifacts because the .bin stuff isn't working 🤷‍♂️
      - name: 📥 Download deps
        run: npm install --prefer-offline --no-audit --no-fund

      - name: 🏗 Build
        run: npm run build
        env:
          SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
          SENTRY_ORG: ${{ secrets.SENTRY_ORG }}
          SENTRY_PROJECT: ${{ secrets.SENTRY_PROJECT }}
          SENTRY_DSN: ${{ secrets.SENTRY_DSN }}
          NODE_ENV: production

      # run install again so the local .bin files get where they should go.
      - name: 📥 Download deps
        run: npm install --prefer-offline --no-audit --no-fund

      - name: 📦 Cache Playwright Browsers
        uses: actions/cache@v4
        id: playwright-cache
        with:
          path: ~/.cache/ms-playwright
          key:
            ${{ runner.os }}-playwright-${{ hashFiles('**/package-lock.json') }}
          restore-keys: |
            ${{ runner.os }}-playwright-

      - name: 📥 Install Playwright Browsers
        if: steps.playwright-cache.outputs.cache-hit != 'true'
        run: npx playwright install --with-deps

      - name: 🎭 Playwright tests
        run: npx playwright test

      - name: 📊 Upload report
        uses: actions/upload-artifact@v4
        if: always()
        with:
          name: playwright-report
          path: playwright-report/
          retention-days: 30

  example:
    name: 🤹‍♂️ Example
    needs: [build]
    strategy:
      matrix:
        os: [ubuntu-latest, windows-latest, macos-latest]
    runs-on: ${{ matrix.os }}
    timeout-minutes: 5
    steps:
      - name: ⬇️ Checkout repo
        uses: actions/checkout@v5

      - name: ⎔ Setup node
        uses: actions/setup-node@v6
        with:
          node-version: 24
          cache: 'npm'

      - name: 📥 Download All Build Artifacts
        uses: actions/download-artifact@v4
        with:
          name: all-build-artifacts
          path: packages

      - name: 📥 Download deps
        run: npm install --prefer-offline --no-audit --no-fund

      - name: ▶️ Run setup script
        run: node ./scripts/setup.mjs
        working-directory: ./example
        continue-on-error: true

  release:
    name: 🚀 Release
    needs: [lint, test, typecheck, build, playwright]
    runs-on: ubuntu-latest
    timeout-minutes: 5
    permissions:
      contents: write # to be able to publish a GitHub release
      id-token: write # to enable use of OIDC for npm provenance
      issues: write # to be able to comment on released issues
      pull-requests: write # to be able to comment on released pull requests
    env:
      NPM_CONFIG_PROVENANCE: 'true'
      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
    if:
      ${{ github.repository == 'epicweb-dev/epicshop' &&
      contains('refs/heads/main', github.ref) && github.event_name == 'push' }}
    steps:
      - name: ⬇️ Checkout repo
        uses: actions/checkout@v5
        with:
          fetch-depth: 0

      - name: ⎔ Setup node
        uses: actions/setup-node@v6
        with:
          node-version: 24
          registry-url: 'https://registry.npmjs.org'
          cache: 'npm'

      - name: 📥 Download All Build Artifacts
        uses: actions/download-artifact@v4
        with:
          name: all-build-artifacts
          path: packages

      - name: 📥 Download deps
        run: npm install --prefer-offline --no-audit --no-fund

      - name: 🚀 Release
        run: npx tsx other/release.ts --dry-run=false