infra-compose-playwright-e2e.yml

name: playwright-e2e

# Browser-based end-to-end smoke. Boots the same compose stack as
# `full-stack-smoke`, then runs the apps/ui Playwright Chromium suite
# against it.
#
# NOT a required check in branch protection — intentionally advisory.
# The Playwright surface flakes occasionally (browser timing, animation,
# transient network) and forcing every PR to wait on a re-run is more
# friction than the signal is worth. The fast curl smoke
# (`full-stack-smoke`) gates merges; this workflow catches the
# regressions curl can't see, and a failure here means "go look".
#
# Path-filtered so docs-only PRs don't waste runner time.

on:
  push:
    branches: [main]
    paths:
      - "infra/compose/**"
      - "apps/api/**"
      - "apps/ui/**"
      - ".github/workflows/infra-compose-playwright-e2e.yml"
  pull_request:
    paths:
      - "infra/compose/**"
      - "apps/api/**"
      - "apps/ui/**"
      - ".github/workflows/infra-compose-playwright-e2e.yml"
  workflow_dispatch:

concurrency:
  group: infra-compose-playwright-e2e-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: read

jobs:
  playwright:
    name: UI Playwright E2E (browser-based smoke)
    runs-on: ubuntu-24.04
    # 15 min upper bound: Playwright's own inner timeout is 12 min; the
    # buffer covers compose build + image pulls + browser install. A
    # genuine hang surfaces within minutes of the inner timeout rather
    # than the runner's default 6 h.
    timeout-minutes: 15

    steps:
      - name: Checkout monorepo
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Seed compose/.env
        working-directory: infra/compose/compose
        run: |
          cp .env.example .env
          {
            echo ""
            echo "# Playwright E2E only — never use these in real deployments."
            echo "SUPERUSER_EMAIL=demo@example.com"
            echo "SUPERUSER_PASSWORD=password123"
          } >> .env

      - name: Make scripts executable
        run: |
          chmod +x infra/compose/compose/dev.sh
          chmod +x infra/compose/scripts/*.sh

      - name: Boot the smoke stack
        working-directory: infra/compose/compose
        env:
          STACK: smoke
        run: ./dev.sh up -d --build

      - name: Wait for API health
        run: |
          for i in {1..60}; do
            if curl -fsS http://localhost:7330/health > /dev/null 2>&1; then
              echo "API healthy after ${i}s"
              break
            fi
            sleep 1
          done
          curl -fsS http://localhost:7330/health

      - name: Wait for UI
        run: |
          for i in {1..60}; do
            if curl -fsS http://localhost:7331/ > /dev/null 2>&1; then
              echo "UI ready after ${i}s"
              break
            fi
            sleep 1
          done
          curl -fsSI http://localhost:7331/ | head -1

      - name: Set up Bun
        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
        with:
          bun-version: 1.3.14
      - name: Cache bun install
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: ~/.bun/install/cache
          key: bun-${{ runner.os }}-${{ hashFiles('apps/ui/bun.lock', 'apps/api/bun.lock') }}
          restore-keys: |
            bun-${{ runner.os }}-

      - name: Install apps/ui deps
        working-directory: apps/ui
        run: |
          # The ui-dev container runs as root and writes into the bind-mounted
          # apps/ui node_modules from the container, so the host runner can't
          # recreate it. Drop root-owned bits before installing as the runner user.
          sudo rm -rf node_modules
          bun install --frozen-lockfile

      - name: Run UI Playwright E2E
        working-directory: apps/ui
        timeout-minutes: 12
        env:
          PLAYWRIGHT_REUSE_SERVER: "true"
        run: |
          bun run e2e:install:chromium
          bun run e2e:ci:chromium

      - name: Compose ps on failure
        if: failure()
        working-directory: infra/compose/compose
        run: |
          docker compose -f docker-compose.yml -f docker-compose.development-labels.yml --profile smoke ps

      - name: Container logs on failure
        if: failure()
        run: |
          for c in $(docker ps -aq); do
            echo "===== $(docker inspect --format '{{.Name}}' "$c") ====="
            docker logs "$c" 2>&1 || true
          done

      - name: Upload Playwright artifacts on failure
        if: failure()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: playwright-results
          path: |
            apps/ui/test-results
            apps/ui/playwright-report
          if-no-files-found: ignore
          retention-days: 7

      - name: Tear down
        if: always()
        working-directory: infra/compose/compose
        env:
          STACK: smoke
        run: |
          ./dev.sh down -v || true