ci.yml

name: CI

on:
  push:
    branches: [main]
  pull_request:

jobs:
  test:
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        node: [20, 22]
    steps:
      - uses: actions/checkout@v7
      - uses: pnpm/action-setup@v6
      - uses: actions/setup-node@v7
        with:
          node-version: ${{ matrix.node }}
          cache: pnpm
      - run: pnpm install --frozen-lockfile --ignore-scripts
      # The install the Uptide Action makes (scripts/action-setup.sh) carries the Agent SDK and
      # this runner's Claude Code binary: `--agent sdk`, its default executor, can run.
      - run: node scripts/action-sdk.mjs
      - run: pnpm lint
      # No private planning document and no private identifier in the repository. Which
      # scan runs on which event, and why Dependabot's own pull requests skip the identifier
      # part: scripts/private-material.mjs.
      - name: No private material
        env:
          UPTIDE_PRIVATE_DENYLIST: ${{ secrets.UPTIDE_PRIVATE_DENYLIST }}
          EVENT: ${{ github.event_name }}
          HEAD_REPO: ${{ github.event.pull_request.head.repo.full_name }}
          REPO: ${{ github.repository }}
          PR_AUTHOR: ${{ github.event.pull_request.user.login }}
        run: node scripts/private-material.mjs
      - run: pnpm build
      - run: pnpm typecheck
      - run: pnpm test
      - name: Verify real package-manager upgrades and the local bot PR loop
        if: matrix.node == 22
        env:
          UPTIDE_NETWORK: '1'
        run: pnpm --filter @uptide/core exec vitest run src/action/action.test.ts src/fix/managers/compatible-ranges.test.ts

  docs:
    # Every relative link in the Markdown resolves, and both pack tables match the registry,
    # verification.json and ground truth (`pnpm docs:packs` rewrites them).
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - uses: pnpm/action-setup@v6
      - uses: actions/setup-node@v7
        with:
          node-version: 22
          cache: pnpm
      - run: pnpm install --frozen-lockfile --ignore-scripts
      - run: pnpm docs:links
      - name: Check generated pack compatibility matrix and README
        run: pnpm docs:packs --check

  smoke:
    # The packed CLI, installed in a clean Node container, against npm, pnpm and yarn fixtures.
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        node: [20, 22]
    steps:
      - uses: actions/checkout@v7
      - uses: pnpm/action-setup@v6
      - uses: actions/setup-node@v7
        with:
          node-version: 22
          cache: pnpm
      - run: pnpm install --frozen-lockfile --ignore-scripts
      - run: pnpm smoke ${{ matrix.node }}
      # The check release runs before publishing, on a tarball packed from the tree `pnpm smoke`
      # built: a PR that changes the hints cannot leave it expecting others. An absolute path:
      # npm reads a relative `dir/file.tgz` as a GitHub `owner/repo`.
      - name: The tarball's suggestions reach it (npx uptide in a project, uptide on PATH)
        run: |
          mkdir -p "$RUNNER_TEMP/pack"
          pnpm --filter uptide pack --pack-destination "$RUNNER_TEMP/pack"
          node packages/cli/smoke/check-invocation.mjs "$(ls "$RUNNER_TEMP"/pack/uptide-*.tgz)"

  onboarding:
    # `uptide/onboarding` and `uptide/report` as a consumer installs them, from the packed
    # tarball: imported under plain Node ESM, and bundled by esbuild for the browser with no fs
    # or other builtin.
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        node: [20, 22]
    steps:
      - uses: actions/checkout@v7
      - uses: pnpm/action-setup@v6
      - uses: actions/setup-node@v7
        with:
          node-version: ${{ matrix.node }}
          cache: pnpm
      - run: pnpm install --frozen-lockfile --ignore-scripts
      - run: pnpm smoke:onboarding