ci.yml

name: ci

on:
  push:
    branches: [main]
  pull_request:

# id-token lets the Codecov upload authenticate over GitHub OIDC, so a
# public-repo upload needs no CODECOV_TOKEN secret.
permissions:
  contents: read
  id-token: write

jobs:
  checks:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6

      - name: Install the toolchain from mise.toml
        uses: jdx/mise-action@v4

      # mise-action caches the tools it installs, but not the pnpm store;
      # cache it separately, keyed on the lockfile.
      - name: Locate the pnpm store
        id: pnpm-store
        run: echo "path=$(pnpm store path --silent)" >> "$GITHUB_OUTPUT"

      - name: Cache the pnpm store
        uses: actions/cache@v6
        with:
          path: ${{ steps.pnpm-store.outputs.path }}
          key: pnpm-store-${{ runner.os }}-${{ hashFiles('web/pnpm-lock.yaml', 'relay/pnpm-lock.yaml') }}
          restore-keys: |
            pnpm-store-${{ runner.os }}-

      # One make invocation, not one per step: `web` is a phony prerequisite
      # of both `lint` and `test`, and a single invocation runs it once where
      # two separate steps built the frontend twice.
      - name: Lint and test
        run: make lint test GOTESTFLAGS="-coverprofile=coverage.out -covermode=atomic"

      # fail_ci_if_error stays at its default (false): a Codecov outage must
      # not fail the build, the same bar the shellcheck guard below holds.
      - name: Upload coverage to Codecov
        uses: codecov/codecov-action@v5
        with:
          files: coverage.out
          use_oidc: true

      # ubuntu-latest images ship shellcheck, so this step normally does
      # nothing. The guard is what keeps it honest: the unconditional
      # apt-get it replaces once sat on a bad mirror for 40+ minutes, and a
      # step that exists only for the day the image drops the tool must not
      # be able to hold CI hostage — hence also the timeout.
      - name: Install shellcheck if the image lost it
        timeout-minutes: 3
        run: command -v shellcheck || (sudo apt-get update -qq && sudo apt-get install -y -qq shellcheck)

      - name: Shellcheck the install script
        run: shellcheck scripts/install.sh scripts/install_test.sh

      - name: Install-script tests
        run: bash scripts/install_test.sh