ci.yml

name: CI

on:
  push:
    branches: [master, main]
  pull_request:
    branches: [master, main]

jobs:
  frontend:
    name: Frontend lint + build
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@v6
        with:
          persist-credentials: false
      - uses: actions/setup-node@v6
        with:
          node-version: '20'
          cache: 'npm'
      - run: npm ci --legacy-peer-deps --ignore-scripts
      - name: Run non-mutating frontend lint
        run: node .github/scripts/check-frontend-lint.cjs
      - name: Verify frontend lint left the checkout unchanged
        run: |
          git diff --exit-code HEAD --
          frontend_git_status="$(git status --porcelain=v1 --untracked-files=all)"
          test -z "$frontend_git_status"
      - name: Run frontend Jest tests
        env:
          CI: 'true'
        run: npm test -- --watchAll=false --runInBand
      - name: Run SPA callback safety tests
        run: npm run test:spa-navigation
      - name: Validate protected release workflow
        run: |
          ruby -e 'require "yaml"; YAML.safe_load(File.read(".github/workflows/deploy.yml"), permitted_classes: [], permitted_symbols: [], aliases: true)'
          ruby -e 'require "yaml"; YAML.safe_load(File.read(".github/workflows/verify-staging-authority.yml"), permitted_classes: [], permitted_symbols: [], aliases: true)'
          ruby -e 'require "yaml"; YAML.safe_load(File.read(".github/workflows/verify-staging-profile-authority.yml"), permitted_classes: [], permitted_symbols: [], aliases: true)'
          ruby -e 'require "yaml"; YAML.safe_load(File.read(".github/workflows/deploy-staging-profiles.yml"), permitted_classes: [], permitted_symbols: [], aliases: true)'
          ruby -e 'require "yaml"; YAML.safe_load(File.read(".github/workflows/ci.yml"), permitted_classes: [], permitted_symbols: [], aliases: true)'
          node --test tests/ci-workflow.test.js tests/release-workflow.test.js tests/firebase-release-verification.test.js tests/firebase-hosting-foundation.test.js tests/firebase-auth-staging-contract.test.js tests/firebase-profile-functions-staging-contract.test.js tests/staging-authority-workflow.test.js tests/staging-profile-authority.test.js tests/test-artifact-safety.test.js tests/root-dependency-security.test.js
      - name: Build
        env:
          CI: 'true'
          # Lint runs as its own step above; the webpack eslint pass would
          # otherwise fail CI=true builds on style warnings.
          DISABLE_ESLINT_PLUGIN: 'true'
          REACT_APP_FIREBASE_ENVIRONMENT: 'staging'
          REACT_APP_FIREBASE_API_KEY: 'synthetic-ci-api-key-not-a-credential'
          REACT_APP_FIREBASE_AUTH_DOMAIN: 'mprc-staging-ci.firebaseapp.com'
          REACT_APP_FIREBASE_PROJECT_ID: 'mprc-staging-ci'
          REACT_APP_FIREBASE_STORAGE_BUCKET: 'mprc-staging-ci.firebasestorage.app'
          REACT_APP_FIREBASE_MESSAGING_SENDER_ID: '100000000001'
          REACT_APP_FIREBASE_APP_ID: '1:100000000001:web:abcdef0123456789'
          REACT_APP_RECAPTCHA_SITE_KEY: ${{ secrets.REACT_APP_RECAPTCHA_SITE_KEY }}
          REACT_APP_SENTRY_DSN: ${{ secrets.REACT_APP_SENTRY_DSN }}
        run: npm run build
      - name: Verify synthetic staging Firebase artifact
        env:
          REACT_APP_FIREBASE_ENVIRONMENT: 'staging'
          REACT_APP_FIREBASE_API_KEY: 'synthetic-ci-api-key-not-a-credential'
          REACT_APP_FIREBASE_AUTH_DOMAIN: 'mprc-staging-ci.firebaseapp.com'
          REACT_APP_FIREBASE_PROJECT_ID: 'mprc-staging-ci'
          REACT_APP_FIREBASE_STORAGE_BUCKET: 'mprc-staging-ci.firebasestorage.app'
          REACT_APP_FIREBASE_MESSAGING_SENDER_ID: '100000000001'
          REACT_APP_FIREBASE_APP_ID: '1:100000000001:web:abcdef0123456789'
        run: node scripts/firebase-hosting-contract.js verify build

  test-artifact-scrubber:
    name: Test artifact scrubber
    runs-on: ubuntu-latest
    timeout-minutes: 5
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@v6
        with:
          persist-credentials: false
      - uses: actions/setup-node@v6
        with:
          node-version: '20'
      - name: Run emitted test artifact safety tests
        run: node --test tests/test-artifact-safety.test.js

  functions:
    name: Cloud Functions lint + test
    runs-on: ubuntu-latest
    permissions:
      contents: read
    defaults:
      run:
        working-directory: functions
    steps:
      - uses: actions/checkout@v6
        with:
          persist-credentials: false
      - uses: actions/setup-node@v6
        with:
          node-version: '20'
          cache: 'npm'
          cache-dependency-path: functions/package-lock.json
      - run: npm ci
      - run: npm run lint
      # Use test:run (plain jest) to avoid spinning up emulators in CI.
      # Unit tests for webhook sig verification + admin action authz mock
      # firebase-admin so no emulator is needed.
      - run: npm run test:run

  functions-node22:
    name: Node 22 backend compatibility
    runs-on: ubuntu-latest
    timeout-minutes: 10
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@v6
        with:
          persist-credentials: false
      - uses: actions/setup-node@v6
        with:
          node-version: '22'
          cache: 'npm'
      - uses: actions/setup-java@v5
        with:
          distribution: 'temurin'
          java-version: '21'
      - name: Install committed root dependencies
        run: npm ci --legacy-peer-deps --ignore-scripts
      - name: Install committed Functions dependencies
        run: npm --prefix functions ci --ignore-scripts
      - name: Run Node 22 backend tests with profile persistence
        env:
          REQUIRE_MEMBER_PROFILE_EMULATOR: '1'
        run: >-
          npx --no-install firebase emulators:exec
          --project demo-functions-test
          --only firestore,auth
          "npm --prefix functions run test:run -- --runInBand"

  commerce-command-journal:
    name: Commerce command journal emulator
    runs-on: ubuntu-latest
    timeout-minutes: 10
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@v6
        with:
          persist-credentials: false
      - uses: actions/setup-node@v6
        with:
          node-version: '20'
          cache: 'npm'
      - uses: actions/setup-java@v5
        with:
          distribution: 'temurin'
          java-version: '21'
      - name: Install committed root dependencies
        run: npm ci --legacy-peer-deps --ignore-scripts
      - name: Install committed Functions dependencies
        run: npm --prefix functions ci --ignore-scripts
      - name: Run commerce command journal concurrency tests
        env:
          REQUIRE_COMMERCE_COMMAND_JOURNAL_EMULATOR: '1'
        run: >-
          npx --no-install firebase emulators:exec
          --project demo-pay002b2-test
          --only firestore
          "npm --prefix functions run test:run --
          --runInBand commerceCommandJournal.emulator.test.js"

  firestore-rules:
    name: Firestore security-rules tests
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@v6
        with:
          persist-credentials: false
      - uses: actions/setup-node@v6
        with:
          node-version: '20'
          cache: 'npm'
      - uses: actions/setup-java@v5
        with:
          distribution: 'temurin'
          java-version: '21'
      - run: npm ci --legacy-peer-deps --ignore-scripts
      - name: Run Firestore rules tests against the emulator
        run: npm run test:rules