ci.yml

name: CI

on:
  push:
    branches: [main, feat/**]
  pull_request:
    branches: [main]
  workflow_dispatch: # Allow manual trigger

# Cancel in-progress runs for the same workflow + branch/PR
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  lint:
    name: Lint & Format Check
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v5

      - name: Setup Bun
        uses: oven-sh/setup-bun@v2
        with:
          bun-version: latest

      - name: Install dependencies
        run: bun install --frozen-lockfile

      - name: Run Prettier check
        run: bunx prettier --check "**/*.{ts,tsx,js,jsx,json,md}"
        continue-on-error: true

      - name: Run Biome lint
        run: bun run lint
        continue-on-error: true

  check-narration:
    name: Narration Leakage Check
    runs-on: ubuntu-latest
    continue-on-error: true # Optional but available
    steps:
      - name: Checkout code
        uses: actions/checkout@v5

      - name: Setup Bun
        uses: oven-sh/setup-bun@v2
        with:
          bun-version: latest

      - name: Run Narration Guardrail
        run: |
          cd packages/api-server
          bash scripts/check-narration-leakage.sh

  typecheck:
    name: TypeScript Type Check
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v5

      - name: Setup Bun
        uses: oven-sh/setup-bun@v2
        with:
          bun-version: latest

      - name: Install dependencies
        run: bun install --frozen-lockfile

      - name: TypeScript type check
        run: bun run typecheck

  lint-patterns:
    name: Lint Effect Patterns
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v5

      - name: Setup Bun
        uses: oven-sh/setup-bun@v2
        with:
          bun-version: latest

      - name: Install dependencies
        run: bun install --frozen-lockfile

      - name: Lint Effect patterns
        run: bun run packages/ep-cli/dist/index.js lint content/new/src/*.ts
        continue-on-error: true

  test-toolkit:
    name: Unit Tests - Toolkit
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v5

      - name: Setup Bun
        uses: oven-sh/setup-bun@v2
        with:
          bun-version: latest

      - name: Install dependencies
        run: bun install --frozen-lockfile

      - name: Run toolkit tests with coverage
        run: cd packages/toolkit && bun run test:coverage
        env:
          CI: true

      - name: Upload coverage to Codecov
        uses: codecov/codecov-action@v5
        if: github.event_name == 'push'
        with:
          files: ./packages/toolkit/coverage/coverage-final.json
          flags: toolkit
          name: toolkit-coverage
          fail_ci_if_error: false

      - name: Upload coverage artifacts
        uses: actions/upload-artifact@v7
        with:
          name: toolkit-coverage
          path: packages/toolkit/coverage/
          retention-days: 7

  build-toolkit:
    name: Build - Toolkit
    runs-on: ubuntu-latest
    needs: [lint, typecheck, test-toolkit]
    steps:
      - name: Checkout code
        uses: actions/checkout@v5

      - name: Setup Bun
        uses: oven-sh/setup-bun@v2
        with:
          bun-version: latest

      - name: Install dependencies
        run: bun install --frozen-lockfile

      - name: Build toolkit
        run: cd packages/toolkit && bun run build

      - name: Emit JSON schemas
        run: cd packages/toolkit && bun run build:schemas

      - name: Verify schema output
        run: |
          if [ ! -f "packages/toolkit/dist/schemas/generate-request.json" ]; then
            echo "Error: JSON schemas not generated"
            exit 1
          fi

      - name: Upload build artifacts
        uses: actions/upload-artifact@v7
        with:
          name: toolkit-dist
          path: packages/toolkit/dist/
          retention-days: 7

  build-mcp-server:
    name: Build - MCP Server
    runs-on: ubuntu-latest
    needs: [lint, typecheck, build-toolkit]
    steps:
      - name: Checkout code
        uses: actions/checkout@v5

      - name: Setup Bun
        uses: oven-sh/setup-bun@v2
        with:
          bun-version: latest

      - name: Install dependencies
        run: bun install --frozen-lockfile

      - name: Download toolkit build artifact
        uses: actions/download-artifact@v8
        with:
          name: toolkit-dist
          path: packages/toolkit/dist/

      - name: Build MCP server
        run: cd packages/api-server && bun run build
        env:
          SKIP_ENV_VALIDATION: true

      - name: Upload build artifacts
        uses: actions/upload-artifact@v7
        with:
          name: mcp-server-dist
          path: packages/api-server/.next/
          retention-days: 7

  test-ep-cli:
    name: Release Gate - ep-cli
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v5

      - name: Setup Bun
        uses: oven-sh/setup-bun@v2
        with:
          bun-version: latest

      - name: Install dependencies
        run: bun install --frozen-lockfile

      - name: Build ep-cli dependencies
        run: |
          bun run --filter @effect-patterns/ep-shared-services build
          bun run --filter @effect-patterns/toolkit build

      - name: Typecheck ep-cli
        run: bun run --filter @effect-patterns/ep-cli typecheck

      - name: Test ep-cli
        run: bun run --filter @effect-patterns/ep-cli test -- --reporter=dot

      - name: Build ep-cli
        run: bun run --filter @effect-patterns/ep-cli build

      - name: Smoke test ep-cli executable
        run: |
          test -s packages/ep-cli/dist/index.js

  test-ep-admin:
    name: Release Gate - ep-admin
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v5

      - name: Setup Bun
        uses: oven-sh/setup-bun@v2
        with:
          bun-version: latest

      - name: Install dependencies
        run: bun install --frozen-lockfile

      - name: Build ep-admin dependencies
        run: |
          bun run --filter @effect-patterns/ep-shared-services build
          bun run --filter @effect-patterns/toolkit build
          bun run --filter @effect-patterns/pipeline-state build

      - name: Typecheck ep-admin
        run: bun run --filter @effect-patterns/ep-admin typecheck

      - name: Test ep-admin
        run: bun run --filter @effect-patterns/ep-admin test -- --reporter=dot

      - name: Run ep-admin coverage
        run: cd packages/ep-admin && bun run test:coverage

      - name: Verify ep-admin coverage thresholds
        run: |
          node <<'EOF'
          const fs = require("node:fs");
          const summaryPath = "packages/ep-admin/coverage/coverage-summary.json";
          if (!fs.existsSync(summaryPath)) {
            console.error(`Missing coverage summary: ${summaryPath}`);
            process.exit(1);
          }

          const summary = JSON.parse(fs.readFileSync(summaryPath, "utf8"));
          const total = summary.total ?? {};
          const checks = [
            ["lines", 85],
            ["statements", 85],
            ["functions", 85],
            ["branches", 70],
          ];

          let failed = false;
          for (const [metric, min] of checks) {
            const pct = total?.[metric]?.pct;
            if (typeof pct !== "number") {
              console.error(`Coverage metric '${metric}' is missing`);
              failed = true;
              continue;
            }
            if (pct < min) {
              console.error(`Coverage ${metric} ${pct}% is below required ${min}%`);
              failed = true;
            } else {
              console.log(`Coverage ${metric} ${pct}% meets required ${min}%`);
            }
          }

          if (failed) {
            process.exit(1);
          }
          EOF

      - name: Smoke test ep-admin command surface
        run: |
          set -euo pipefail

          run_ep_admin() {
            bun packages/ep-admin/src/index.ts "$@"
          }

          run_ep_admin --help > /tmp/ep-admin-help.txt
          grep -q "Top-level commands:" /tmp/ep-admin-help.txt
          NO_COLOR=1 run_ep_admin --help > /tmp/ep-admin-help-nocolor.txt

          run_ep_admin auth --help > /dev/null
          run_ep_admin publish --help > /dev/null
          run_ep_admin pattern --help > /dev/null
          run_ep_admin data --help > /dev/null
          run_ep_admin db --help > /dev/null
          run_ep_admin dev --help > /dev/null
          run_ep_admin ops --help > /dev/null
          run_ep_admin config --help > /dev/null
          run_ep_admin system --help > /dev/null
          run_ep_admin release --help > /dev/null

          tmpdir="$(mktemp -d)"
          export EP_ADMIN_AUTH_CONFIG_FILE="$tmpdir/config/auth.json"
          export EP_ADMIN_AUTH_SESSION_FILE="$tmpdir/state/session.json"

          run_ep_admin auth init \
            --passphrase "ci-passphrase-123" \
            --confirm-passphrase "ci-passphrase-123" \
            --service-token "ci-token-123" \
            --json > /tmp/ep-admin-auth-init.json

          EP_ADMIN_SERVICE_TOKEN="ci-token-123" \
            run_ep_admin ops rotate-api-key --json > /tmp/ep-admin-ops.json

          node <<'EOF'
          const fs = require("node:fs");
          const payload = JSON.parse(fs.readFileSync("/tmp/ep-admin-ops.json", "utf8"));
          if (!payload.ok || payload.action !== "rotate-api-key") {
            console.error("Unexpected ops rotate-api-key payload", payload);
            process.exit(1);
          }
          EOF

          set +e
          EP_ADMIN_SERVICE_TOKEN="ci-token-123" \
            run_ep_admin ops mcp list-rulez > /tmp/ep-admin-typo.out 2>&1
          typo_status=$?
          set -e
          if [ "$typo_status" -eq 0 ]; then
            echo "Expected typo command to fail, but it succeeded"
            exit 1
          fi
          grep -q "Did you mean: ep-admin ops mcp list-rules" /tmp/ep-admin-typo.out
          grep -q "Run: ep-admin ops mcp --help" /tmp/ep-admin-typo.out

          rm -rf "$tmpdir"

      - name: Upload ep-admin coverage artifacts
        uses: actions/upload-artifact@v7
        with:
          name: ep-admin-coverage
          path: packages/ep-admin/coverage/
          retention-days: 7

  test-integration:
    name: Integration Tests - MCP Server
    runs-on: ubuntu-latest
    needs: [build-toolkit, build-mcp-server]
    continue-on-error: true # Optional but available - catches env drift
    steps:
      - name: Checkout code
        uses: actions/checkout@v5

      - name: Setup Bun
        uses: oven-sh/setup-bun@v2
        with:
          bun-version: latest

      - name: Install dependencies
        run: bun install --frozen-lockfile

      - name: Download toolkit build artifact
        uses: actions/download-artifact@v8
        with:
          name: toolkit-dist
          path: packages/toolkit/dist/

      - name: Run integration tests
        run: cd packages/api-server && bun run test:integration
        env:
          PATTERN_API_KEY: test-api-key-for-ci
          TEST_BASE_URL: http://localhost:3000

      - name: Build MCP stdio for protocol tests
        run: cd packages/mcp-transport && bun run mcp:build

      - name: Start API server for MCP protocol tests
        run: |
          cd packages/api-server
          PORT=3000 bun run dev > ../../mcp-server.log 2>&1 &
          echo $! > ../../mcp-server.pid
          sleep 2
          if ! kill -0 "$(cat ../../mcp-server.pid)" 2>/dev/null; then
            echo "MCP API server exited before readiness check"
            cat ../../mcp-server.log || true
            exit 1
          fi
        env:
          PATTERN_API_KEY: test-api-key-for-ci
          OTLP_ENDPOINT: http://localhost:4318/v1/traces
          NODE_ENV: test

      - name: Wait for API server to be ready
        run: |
          timeout 90 bash -c 'until curl -fsS http://localhost:3000/api/health > /dev/null; do sleep 2; done'

      - name: Run MCP protocol tests (tool surface + structured output)
        run: cd packages/mcp-transport && bun run test:mcp:ci
        env:
          PATTERN_API_KEY: test-api-key-for-ci
          MCP_ENV: local

      - name: Dump MCP server logs on failure
        if: failure()
        run: |
          if [ -f mcp-server.log ]; then
            cat mcp-server.log
          fi

      - name: Stop server
        if: always()
        run: |
          if [ -f mcp-server.pid ]; then
            kill $(cat mcp-server.pid) || true
          fi
          rm -f mcp-server.pid mcp-server.log

  coverage-report:
    name: Coverage Report
    runs-on: ubuntu-latest
    needs: [test-toolkit, test-ep-admin]
    if: github.event_name == 'pull_request'
    steps:
      - name: Download toolkit coverage artifacts
        uses: actions/download-artifact@v8
        with:
          name: toolkit-coverage

      - name: Display toolkit coverage summary
        run: |
          if [ -f coverage-summary.json ]; then
            cat coverage-summary.json
          fi

      - name: Download ep-admin coverage artifacts
        uses: actions/download-artifact@v8
        with:
          name: ep-admin-coverage
          path: ep-admin-coverage

      - name: Display ep-admin coverage summary
        run: |
          if [ -f ep-admin-coverage/coverage-summary.json ]; then
            cat ep-admin-coverage/coverage-summary.json
          else
            echo "Missing ep-admin coverage summary"
            exit 1
          fi

  # All checks must pass
  ci-success:
    name: CI Success
    runs-on: ubuntu-latest
    needs:
      [
        lint,
        check-narration,
        typecheck,
        test-toolkit,
        test-ep-cli,
        test-ep-admin,
        build-toolkit,
        build-mcp-server,
        test-integration,
      ]
    if: always()
    steps:
      - name: Check all jobs status
        run: |
          if [[ "${{ contains(needs.*.result, 'failure') }}" == "true" ]]; then
            echo "One or more CI jobs failed"
            exit 1
          fi
          if [[ "${{ contains(needs.*.result, 'cancelled') }}" == "true" ]]; then
            echo "One or more CI jobs were cancelled"
            exit 1
          fi
          echo "All CI jobs passed successfully!"