ci.yml

name: CI

on:
  pull_request:
  push:
    branches: [main]
  workflow_dispatch:

permissions:
  contents: read

jobs:
  quality:
    name: Lint, types, tests & committed dist
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7

      - uses: actions/setup-node@v7
        with:
          node-version: 20
          cache: npm

      - name: Install dependencies
        run: npm ci

      - name: Format check
        run: npm run format:check

      - name: Lint
        run: npm run lint

      - name: Typecheck
        run: npm run typecheck:all

      - name: Bundle actions
        run: npm run bundle:all

      - name: Test (95% coverage gate, 100% actual)
        run: npm run test:all

      - name: Verify committed dist is current
        run: npm run dist:verify

      # Strict on purpose: this repo IS a shared GitHub Actions library, so a
      # broken workflow/action manifest must fail CI rather than ship.
      - name: Lint workflows
        run: |
          bash <(curl -s https://raw.githubusercontent.com/rhysd/actionlint/v1.7.12/scripts/download-actionlint.bash) 1.7.12
          ./actionlint -color

      - name: Upload coverage
        if: always()
        uses: actions/upload-artifact@v7
        with:
          name: coverage
          path: gforce-gha-src/coverage
          if-no-files-found: ignore

  # Execute every TypeScript action from its committed dist on a real runner:
  # proves action.yml wiring, bundle integrity, and output names — the things
  # unit tests can't see.
  smoke:
    name: Run each action for real, assert outputs
    runs-on: ubuntu-latest
    permissions:
      contents: read
      pull-requests: read
    steps:
      - uses: actions/checkout@v7

      - name: Smoke sf-apex-test-select (offline, committed fixtures)
        id: find-tests
        uses: ./.github/actions/sf-apex-test-select
        with:
          package-xml: gforce-gha-src/__tests__/support/fixtures/package.xml
          source-dir: gforce-gha-src/__tests__/support/fixtures/force-app

      - name: Assert sf-apex-test-select outputs
        env:
          HAS_APEX: ${{ steps.find-tests.outputs.has-apex }}
          TEST_COUNT: ${{ steps.find-tests.outputs.test-count }}
          TESTS: ${{ steps.find-tests.outputs.tests }}
        run: |
          test "$HAS_APEX" = "true"
          test "$TEST_COUNT" = "2"
          test "$TESTS" = "InvoiceServiceTest InvoicesSelectorTest"

      # source==target is rejected by input validation, so these two smoke over
      # the PR's own refs and therefore only run on pull_request events.
      - name: Smoke github-branch-sync (dry-run over the PR refs)
        if: github.event_name == 'pull_request'
        id: sync
        uses: ./.github/actions/github-branch-sync
        with:
          source-branch: ${{ github.head_ref }}
          target-branch: ${{ github.base_ref }}
          dry-run: true
          github-token: ${{ github.token }}

      - name: Assert github-branch-sync outputs
        if: github.event_name == 'pull_request'
        env:
          SYNC_DRY_RUN: ${{ steps.sync.outputs.dry-run }}
          SYNC_ACTION: ${{ steps.sync.outputs.action }}
          SYNC_SYNCED: ${{ steps.sync.outputs.synced }}
        run: |
          test "$SYNC_DRY_RUN" = "true"
          test -n "$SYNC_ACTION"
          test "$SYNC_SYNCED" = "false"

      - name: Smoke github-release-pr-create (dry-run over the PR refs)
        if: github.event_name == 'pull_request'
        id: release-pr
        uses: ./.github/actions/github-release-pr-create
        with:
          source-branch: ${{ github.head_ref }}
          target-branch: ${{ github.base_ref }}
          release-version: v0.0.0-smoke
          dry-run: true
          github-token: ${{ github.token }}

      - name: Assert github-release-pr-create outputs
        if: github.event_name == 'pull_request'
        env:
          PR_DRY_RUN: ${{ steps.release-pr.outputs.dry-run }}
          PR_CREATED: ${{ steps.release-pr.outputs.created }}
          PR_UPDATED: ${{ steps.release-pr.outputs.updated }}
        run: |
          test "$PR_DRY_RUN" = "true"
          test "$PR_CREATED" = "false"
          test "$PR_UPDATED" = "false"

      # The Salesforce ops chain. These composites need no org: the callback
      # renders its payload in dry-run, and the two package actions reject a
      # malformed version id before they ever reach the CLI.
      - name: Smoke sf-ops-callback (dry-run, no org)
        id: callback
        uses: ./.github/actions/sf-ops-callback
        with:
          correlation-id: ci-smoke-00000001
          operation: promote
          status: succeeded
          outputs-json: '{"versionId":"04tSMOKE0000000000"}'
          dry-run: true

      - name: Assert sf-ops-callback contract
        env:
          DELIVERED: ${{ steps.callback.outputs.delivered }}
          HTTP_STATUS: ${{ steps.callback.outputs.http-status }}
          PAYLOAD: ${{ steps.callback.outputs.payload }}
        run: |
          test "$DELIVERED" = "false"
          test -z "$HTTP_STATUS"
          # The Apex endpoint keys on these three; losing one silently breaks the round trip.
          echo "$PAYLOAD" | grep -q '"correlationId": "ci-smoke-00000001"'
          echo "$PAYLOAD" | grep -q '"status": "succeeded"'
          echo "$PAYLOAD" | grep -q '"versionId": "04tSMOKE0000000000"'

      - name: Smoke sf-package-promote (must reject a non-04t id)
        id: promote-bad-id
        continue-on-error: true
        uses: ./.github/actions/sf-package-promote
        with:
          version-id: not-a-package-version

      - name: Smoke sf-package-install (must reject a non-04t id)
        id: install-bad-id
        continue-on-error: true
        uses: ./.github/actions/sf-package-install
        with:
          version-id: not-a-package-version

      - name: Assert the package actions fail closed on bad input
        env:
          PROMOTE_OUTCOME: ${{ steps.promote-bad-id.outcome }}
          INSTALL_OUTCOME: ${{ steps.install-bad-id.outcome }}
        run: |
          test "$PROMOTE_OUTCOME" = "failure"
          test "$INSTALL_OUTCOME" = "failure"