ci.yml

name: CI

on:
  push:
    branches: [main]
  pull_request:

# Cancel in-flight runs for the same workflow + ref. Including
# `github.workflow` in the key keeps this from colliding with any other
# workflow that happens to share a ref-based group prefix.
concurrency:
  group: ci-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

# Least-privilege: this workflow only reads the repo to lint/build/verify; it
# never writes back. Anything that needs write scopes lives in a separate
# workflow with its own scoped permissions.
permissions:
  contents: read

jobs:
  ci:
    name: Lint, build, verify
    runs-on: ubuntu-24.04
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1

      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6  # v2.2.0
        with:
          bun-version: 1.4.0

      # Bun is the package manager and script runner, but Next.js (and tsc)
      # run on Node. The runner image is pinned (ubuntu-24.04) but Node
      # version inside it can still drift; pin via .nvmrc so a future
      # GitHub bump can't break the build silently.
      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020  # v7.0.0
        with:
          node-version-file: .nvmrc

      # Cache Bun's resolved package store keyed on the lockfile hash. Cuts
      # ~10s off `bun install` on a clean runner; the restore-key falls back
      # to any prior cache from this OS so partial hits still help.
      - name: Cache Bun install cache
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9  # v6.1.0
        with:
          path: ~/.bun/install/cache
          key: ${{ runner.os }}-bun-${{ hashFiles('bun.lock') }}
          restore-keys: |
            ${{ runner.os }}-bun-

      # Cache Next.js's incremental build output. Keyed on lockfile + commit
      # SHA so the exact-key match is always per-commit fresh; restore-keys
      # fall back to any previous build on the same lockfile, then any build
      # on this OS — so most CI runs hit a cache and skip rebuilding
      # unchanged webpack modules.
      - name: Cache Next.js build cache
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9  # v6.1.0
        with:
          path: ${{ github.workspace }}/.next/cache
          key: ${{ runner.os }}-nextjs-${{ hashFiles('bun.lock') }}-${{ github.sha }}
          restore-keys: |
            ${{ runner.os }}-nextjs-${{ hashFiles('bun.lock') }}-
            ${{ runner.os }}-nextjs-

      - name: Install
        run: bun install --frozen-lockfile

      - name: Lint + format check
        run: bun run check:ci

      # Build BEFORE typecheck: the build runs velite (populating .velite/
      # which the `#site/content` path alias resolves to) and produces
      # next-env.d.ts. tsc fails without these, so order matters here.
      - name: Build
        run: bun run build

      - name: Type check
        run: bun run typecheck

      - name: Start server
        run: |
          bun run start > /tmp/server.log 2>&1 &
          echo $! > /tmp/server.pid
          for i in $(seq 1 30); do
            if curl -sf http://localhost:3000 > /dev/null; then
              echo "server ready"
              exit 0
            fi
            sleep 1
          done
          echo "server failed to start in 30s"
          cat /tmp/server.log
          exit 1

      - name: Verify endpoints
        run: bun run verify

      # Playwright browsers are ~250 MB. Cache them keyed on the
      # @playwright/test version pinned in package.json — invalidates on
      # bumps, hits otherwise. System deps (apt packages) aren't covered by
      # the cache, so install those separately even on cache hit (~10s vs
      # ~3min for the full install).
      - name: Get Playwright version
        id: playwright-version
        run: |
          VERSION=$(grep -oE '"@playwright/test": "[^"]+"' package.json | grep -oE '[0-9]+\.[0-9]+\.[0-9]+')
          echo "version=$VERSION" >> $GITHUB_OUTPUT

      - name: Cache Playwright browsers
        id: playwright-cache
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9  # v6.1.0
        with:
          path: ~/.cache/ms-playwright
          key: ${{ runner.os }}-playwright-${{ steps.playwright-version.outputs.version }}

      - name: Install Playwright browsers (cache miss)
        if: steps.playwright-cache.outputs.cache-hit != 'true'
        run: bunx playwright install --with-deps chromium webkit

      - name: Install Playwright system deps (cache hit)
        if: steps.playwright-cache.outputs.cache-hit == 'true'
        run: bunx playwright install-deps chromium webkit

      - name: Browser smoke tests
        run: bun run test:e2e

      - name: Upload Playwright report
        if: failure()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
        with:
          name: playwright-report
          path: playwright-report/
          retention-days: 7

      - name: Stop server
        if: always()
        run: |
          if [ -f /tmp/server.pid ]; then
            kill $(cat /tmp/server.pid) 2>/dev/null || true
          fi

      - name: Server logs (on failure)
        if: failure()
        run: cat /tmp/server.log || true

  # Reports dependency advisories WITHOUT gating merges. A new advisory can
  # surface at any time from an upstream publish, with no change on our
  # side, so a hard gate here blocks unrelated PRs on work we often cannot
  # do (see CLAUDE.md "Audit advisories" for the upstream-blocked ones).
  # `continue-on-error` on the step keeps the job green while still marking
  # the step red and posting the full advisory list to the job summary, so
  # the status stays visible on every run. Nothing is `--ignore`d: with no
  # gate to keep green, suppressing advisories only hides information.
  audit:
    name: Dependency audit (non-blocking)
    runs-on: ubuntu-24.04
    timeout-minutes: 5
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1

      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6  # v2.2.0
        with:
          bun-version: 1.4.0

      - name: Cache Bun install cache
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9  # v6.1.0
        with:
          path: ~/.bun/install/cache
          key: ${{ runner.os }}-bun-${{ hashFiles('bun.lock') }}
          restore-keys: |
            ${{ runner.os }}-bun-

      - name: Install
        run: bun install --frozen-lockfile

      - name: Dependency audit
        continue-on-error: true
        run: |
          bun audit | tee /tmp/audit.log
          status=${PIPESTATUS[0]}

          {
            echo "## Dependency audit"
            echo
            if [ "$status" -eq 0 ]; then
              echo "No advisories reported."
            else
              echo "Advisories reported. Informational only — this does not block merge."
              echo
              echo '```'
              cat /tmp/audit.log
              echo '```'
            fi
          } >> "$GITHUB_STEP_SUMMARY"

          exit "$status"

  # Runs only on PRs (no baseline diff to compute on a push to main).
  # Compares the PR's dependency manifest against main and flags
  # high-severity advisories or license incompatibilities. Hard-gated: the
  # `bun audit` job is informational, so this is the one advisory check
  # that blocks merge, and it is scoped to what the PR itself introduces
  # (severity `high` and above) rather than the whole pre-existing tree.
  dependency-review:
    if: github.event_name == 'pull_request'
    runs-on: ubuntu-24.04
    permissions:
      contents: read
      pull-requests: write
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
      - name: Dependency Review
        uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294  # v5.0.0
        with:
          fail-on-severity: high
          comment-summary-in-pr: on-failure

  # Defense-in-depth on top of GitHub's push protection. Push protection
  # covers high-entropy / known-provider patterns at push time; TruffleHog
  # re-scans diffs on PRs + push to main, catching secrets that slipped
  # past push protection (low-entropy formats, detector patterns added
  # after the secret was committed, or push-protection bypass via the
  # "I'll fix it later" allow path).
  secret-scan:
    runs-on: ubuntu-24.04
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
        with:
          # TruffleHog diffs base..head and needs the full history present.
          fetch-depth: 0
      - name: TruffleHog scan
        uses: trufflesecurity/trufflehog@20652fbbdefffcdaa493a5bf57ab2ac6b1db715b  # v3.97.1
        with:
          # On PRs: scan the diff between base and head. On push to main:
          # scan the previous commit to HEAD. The action infers both from
          # the event context.
          # --results=verified,unknown drops trufflehog's "unverified" tier
          # (pattern-matched but couldn't reach the verifier endpoint) to
          # keep noise down without losing coverage of secrets whose
          # verifiers don't recognize them yet.
          extra_args: --results=verified,unknown