ci.yml

name: CI

on:
  push:
    branches: [main]
  pull_request:

concurrency:
  group: ci-${{ github.event.pull_request.number || github.sha }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

jobs:
  typecheck:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: ./.github/actions/setup-workbench
      - run: bun run typecheck

  lint:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: ./.github/actions/setup-workbench
      - run: bun run lint
      - run: bun run fmt:check

  # Integration and browser suites under e2e/. CI=true turns DB- and
  # Chrome-gated skips into hard failures. Browser suites shard by
  # round-robin over the sorted file list, so a new test file joins a shard
  # automatically — no per-file list to keep in sync. Fewer files per shard
  # also means fewer hub boots per `bun test` process, which is the
  # documented flake boundary (see e2e/browser/first-run.test.ts).
  e2e-browser:
    runs-on: ubuntu-latest
    timeout-minutes: 20
    strategy:
      fail-fast: false
      matrix:
        shard: [0, 1, 2]
    services:
      postgres:
        image: pgvector/pgvector:pg16
        env:
          POSTGRES_USER: postgres
          POSTGRES_PASSWORD: postgres
          POSTGRES_DB: workbench
        ports:
          - 5432:5432
        options: >-
          --health-cmd "pg_isready -U postgres"
          --health-interval 5s
          --health-timeout 5s
          --health-retries 10
    env:
      CI: "true"
      DATABASE_URL: postgres://postgres:postgres@localhost:5432/workbench
      # Throwaway keys for the ephemeral CI hub; same placeholders as .env.example.
      CREDENTIAL_ENCRYPTION_KEY: "0000000000000000000000000000000000000000000000000000000000000000"
      PRINCIPAL_KEY_ENCRYPTION_KEY: "1111111111111111111111111111111111111111111111111111111111111111"
      SIDECAR_CREDENTIAL_ENCRYPTION_KEY: "2222222222222222222222222222222222222222222222222222222222222222"
    steps:
      - uses: actions/checkout@v4
      - uses: ./.github/actions/setup-workbench
      - id: chrome
        uses: browser-actions/setup-chrome@v1
      - run: echo "CHROME_PATH=${{ steps.chrome.outputs.chrome-path }}" >> "$GITHUB_ENV"
      - run: |
          mkdir -p "$RUNNER_TEMP/hub-data"
          echo "HUB_DATA_DIR=$RUNNER_TEMP/hub-data" >> "$GITHUB_ENV"
      # Browser/mcp suites set DATABASE_URL and go through dbGate, which
      # redirects the resolved url onto the derived _e2e sibling (see e2e/lib/
      # database-url.ts). Provision + migrate that sibling here (idempotent,
      # CREATE IF NOT EXISTS + migrateHub) so the browser shards do not fail on
      # 'database workbench_e2e does not exist'.
      - run: bun scripts/db-setup.ts
      - run: |
          LC_ALL=C
          i=0
          files=""
          for f in e2e/browser/*.test.ts e2e/mcp/*.test.ts; do
            if [ "$((i % 3))" = "${{ matrix.shard }}" ]; then files="$files $f"; fi
            i=$((i + 1))
          done
          echo "shard ${{ matrix.shard }} files:$files"
          # shellcheck disable=SC2086
          bun test $files

  # Hub-level suites: no Chrome, no browser boots.
  e2e-hub:
    runs-on: ubuntu-latest
    timeout-minutes: 20
    services:
      postgres:
        image: pgvector/pgvector:pg16
        env:
          POSTGRES_USER: postgres
          POSTGRES_PASSWORD: postgres
          POSTGRES_DB: workbench
        ports:
          - 5432:5432
        options: >-
          --health-cmd "pg_isready -U postgres"
          --health-interval 5s
          --health-timeout 5s
          --health-retries 10
    env:
      CI: "true"
      DATABASE_URL: postgres://postgres:postgres@localhost:5432/workbench
      # Throwaway keys for the ephemeral CI hub; same placeholders as .env.example.
      CREDENTIAL_ENCRYPTION_KEY: "0000000000000000000000000000000000000000000000000000000000000000"
      PRINCIPAL_KEY_ENCRYPTION_KEY: "1111111111111111111111111111111111111111111111111111111111111111"
      SIDECAR_CREDENTIAL_ENCRYPTION_KEY: "2222222222222222222222222222222222222222222222222222222222222222"
    steps:
      - uses: actions/checkout@v4
      - uses: ./.github/actions/setup-workbench
      - run: |
          mkdir -p "$RUNNER_TEMP/hub-data"
          echo "HUB_DATA_DIR=$RUNNER_TEMP/hub-data" >> "$GITHUB_ENV"
      # The worker bundle is gitignored build output (see packages/worker):
      # browser shards get it as a side effect of the web build, so the hub
      # job builds it directly. The web-build freshness unit suite lives in
      # e2e/lib (no Chrome, no DB), which no shard glob and no package test
      # root would otherwise run.
      - run: bun run build
        working-directory: packages/worker
      - run: bun test e2e/lib/web-build.test.ts
      # Provision + migrate both the base database AND the derived _e2e sibling.
      # scripts/db-setup.ts (DATABASE_URL is already set for this job) creates
      # and runs migrateHub against DATABASE_URL's db and its _e2e sibling, so
      # direct-DB suites (mailbox persist/send) are not order-dependent on some
      # hub-booting suite migrating first.
      - run: bun scripts/db-setup.ts
      - run: bun test e2e/hub e2e/install e2e/workflows