deckhearth/.github/workflows/preview-smoke.yml

name: Preview smoke

# Waits for Vercel's per-PR Preview deployment to be ready, then runs
# Playwright smoke against its URL.
#
# Vercel's GitHub integration auto-deploys every push and posts a Deployment
# to the GitHub API once ready. We wait on that Deployment so we always hit
# the canonical preview URL Vercel just published.
#
# REQUIRES: @playwright/test installed. Until then, this workflow will fail
# on `npx playwright install`. See .convoys/ for the testing convoy.

on:
  pull_request:
    branches: [main]
    types: [labeled, opened, synchronize, reopened]

concurrency:
  group: preview-smoke-${{ github.event.pull_request.number }}
  cancel-in-progress: true

# Default workflow token is read-only on this repo. The `wait-for-vercel-preview`
# action needs `deployments: read` to query Vercel's GitHub Deployment status,
# plus `statuses: read` because some Vercel deployments use commit statuses
# instead of the Deployments API. `pull-requests: read` lets it correlate the
# deployment back to this PR. Without these, the action 403s on the Checks API
# and the smoke job fails before Playwright even starts.
permissions:
  contents: read
  deployments: read
  pull-requests: read
  statuses: read

jobs:
  gate:
    name: Should run?
    runs-on: ubuntu-latest
    outputs:
      should_run: ${{ steps.check.outputs.should_run }}
    steps:
      - name: Decide
        id: check
        env:
          # Route PR body + fork flag through env vars instead of inline
          # ${{ }} interpolation. Direct ${{ github.event.pull_request.body }}
          # in a shell command pastes arbitrary user-controlled text (parens,
          # backticks, pipes, heredocs) directly into the script — both a
          # syntax-error risk AND a shell-injection vector. Quoting the env
          # vars below makes both safe.
          PR_BODY: ${{ github.event.pull_request.body }}
          PR_IS_FORK: ${{ github.event.pull_request.head.repo.fork }}
        run: |
          if [[ "$PR_IS_FORK" == "true" ]]; then
            echo "should_run=false" >> $GITHUB_OUTPUT
            echo "::notice::Smoke skipped on fork PR (bypass secret unavailable to forks)"
          elif echo "$PR_BODY" | grep -qE 'pipeline:.*skip.*\bsmoke\b'; then
            echo "should_run=false" >> $GITHUB_OUTPUT
            echo "::notice::Smoke skipped via pipeline directive"
          else
            echo "should_run=true" >> $GITHUB_OUTPUT
          fi          

  smoke:
    name: Playwright smoke
    needs: gate
    if: needs.gate.outputs.should_run == 'true'
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@v4

      - name: Wait for Vercel Preview deployment
        id: vercel
        uses: patrickedqvist/wait-for-vercel-preview@v1.3.2
        with:
          token: ${{ secrets.GITHUB_TOKEN }}
          max_timeout: 120
          # NOTE: do NOT add `&x-vercel-set-bypass-cookie=true` here. Vercel
          # responds to that with a 307 + Set-Cookie (`_vercel_jwt`), but
          # axios in Node has no cookie jar — the cookie is dropped before
          # the followup request, which then 401s. For this one-shot
          # healthcheck the bare bypass query is enough; the cookie variant
          # belongs in the future Playwright config where the browser does
          # have a cookie jar.
          path: /?x-vercel-protection-bypass=${{ secrets.VERCEL_AUTOMATION_BYPASS_SECRET }}

      - uses: actions/setup-node@v4
        with:
          node-version: '20'
          cache: npm

      - run: npm ci

      - name: Install Playwright browsers
        run: npx playwright install --with-deps chromium

      - name: Run smoke tests
        run: npx playwright test --project=smoke
        env:
          BASE_URL: ${{ steps.vercel.outputs.url }}
          VERCEL_AUTOMATION_BYPASS_SECRET: ${{ secrets.VERCEL_AUTOMATION_BYPASS_SECRET }}

      - name: Upload Playwright report on failure
        if: failure()
        uses: actions/upload-artifact@v4
        with:
          name: playwright-report
          path: playwright-report/
          retention-days: 7