ci.yml

name: CI

on:
  push:
    branches: [main]
  pull_request:

concurrency:
  group: ci-${{ github.ref }}
  cancel-in-progress: true

jobs:
  verify:
    name: typecheck, lint, unit, build, e2e
    runs-on: ubuntu-latest
    timeout-minutes: 20

    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-node@v4
        with:
          node-version: 22
          cache: npm

      - name: Install dependencies
        run: npm ci

      - name: Typecheck
        run: npm run typecheck

      - name: Lint
        run: npm run lint

      - name: Unit and component tests
        run: npm test

      - name: Production build
        run: npm run build

      # The end-to-end suite runs against the production build above, in fixture
      # mode and with no token, so it never contacts GitHub.
      - name: Install Playwright browsers
        run: npx playwright install --with-deps chromium

      - name: End-to-end tests
        run: npm run test:e2e:only

      - name: Upload the Playwright report on failure
        if: failure()
        uses: actions/upload-artifact@v4
        with:
          name: playwright-report
          path: playwright-report
          retention-days: 7

  privacy-audit:
    name: privacy audit
    runs-on: ubuntu-latest
    timeout-minutes: 5

    steps:
      - uses: actions/checkout@v4

      # The demo is synthetic; no personal repository may reappear in the tree.
      #
      # The names are assembled from halves on purpose: written out in full they
      # would appear in this file, and the audit would then find itself.
      - name: No personal repository references in tracked files
        run: |
          A='renren-'; A="${A}across-tabs"
          B='Data';    B="${B}Data"
          C='Drill';   C="${C}Lab"
          D='Pet';     D="${D}Note"
          if git grep -nIi -e "$A" -e "$B" -e "$C" -e "$D" -- .; then
            echo "::error::a removed personal repository name is back in the tree"
            exit 1
          fi
          echo "no personal repository references"

      - name: Every github.com/renrenmimi link points at this project
        run: |
          if git grep -nI 'github.com/renrenmimi/' -- . | grep -v 'github.com/renrenmimi/RepoTimeMachine'; then
            echo "::error::a github.com/renrenmimi link points somewhere other than RepoTimeMachine"
            exit 1
          fi
          echo "all renrenmimi links point at RepoTimeMachine"

      # Assembled from halves for the same reason as above: spelled out, the
      # pattern would appear in this file and the audit would find itself.
      - name: The token is never given a public prefix
        run: |
          P='NEXT_'; P="${P}PUBLIC_GITHUB_TOKEN"
          if git grep -nI -e "$P" -- .; then
            echo "::error::the token must never be exposed with a public prefix"
            exit 1
          fi
          echo "no public token variable"