deckhearth/.github/workflows/ci.yml

name: CI

# Vercel variant: Vercel builds Preview deployments on every push and gates the
# PR via the Vercel GitHub integration check. Running `npm run build` here too
# would duplicate Vercel's work for ~3-5 minutes per PR with no added signal.
#
# What this CI covers (and Vercel does not):
#   - Lint (cheap belt-and-suspenders)
#   - Schema-map drift check (docs/SCHEMA_MAP.md updated when scripts/add-*.js changes)
#
# NOTE: tcg-vault has no test runner installed yet. Re-enable the `test:` job
# below once vitest (or equivalent) is adopted AND a `test:run` script exists
# in package.json. See .convoys/ for the testing convoy.
#
# NOTE: tcg-vault is JavaScript (not TypeScript). No `npx tsc --noEmit` step.
# Re-enable a type-check job if migrating to TypeScript.

on:
  pull_request:
    branches: [main]
  push:
    branches: [main]

concurrency:
  group: ci-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

env:
  NODE_VERSION: '20'

jobs:
  lint:
    name: Lint
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: npm
      - run: npm ci
      # TODO(fix-lint-baseline): drop the `|| true` wrapper once .convoys/fix-lint-baseline
      # lands. The codebase has ~100 pre-existing ESLint errors (conditional React
      # hooks, unescaped entities, etc.). For now lint runs and posts output as a
      # warning annotation so the PR check stays green while the debt is visible.
      - name: Lint (non-blocking until fix-lint-baseline)
        run: |
          set +e
          npm run lint --if-present
          status=$?
          if [ "$status" -ne 0 ]; then
            echo "::warning title=Lint errors (non-blocking)::ESLint reported errors above. Tracked in .convoys/ship-readiness.md as P1 #11.5 (fix-lint-baseline). Remove the wrapper in .github/workflows/ci.yml after baseline is fixed."
          fi
          exit 0          

  schema-map-fresh:
    name: Schema map up to date
    runs-on: ubuntu-latest
    # Only run when migration scripts or the schema map itself changed.
    # If neither changed, nothing to verify.
    if: |
      contains(github.event.pull_request.changed_files, 'scripts/add-') ||
      contains(github.event.pull_request.changed_files, 'scripts/fix-') ||
      contains(github.event.pull_request.changed_files, 'scripts/setup-neon-db.js') ||
      contains(github.event.pull_request.changed_files, 'docs/SCHEMA_MAP.md')      
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 2
      - name: Verify schema map updated alongside migration scripts
        run: |
          MIGRATION_CHANGED=false
          MAP_CHANGED=false
          if git diff --name-only HEAD~1 | grep -qE '^scripts/(add-|fix-|setup-neon-db\.js)'; then
            MIGRATION_CHANGED=true
          fi
          if git diff --name-only HEAD~1 | grep -q '^docs/SCHEMA_MAP\.md$'; then
            MAP_CHANGED=true
          fi
          if [ "$MIGRATION_CHANGED" = "true" ] && [ "$MAP_CHANGED" = "false" ]; then
            echo "::error::A migration script changed but docs/SCHEMA_MAP.md was not updated."
            echo "Update docs/SCHEMA_MAP.md to reflect the schema change, then re-push."
            exit 1
          fi
          echo "OK: schema map and migration scripts are in sync."          

  forbidden-endpoints:
    name: No dev endpoints in pages/api
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Fail if dev endpoints re-appear under pages/api/
        run: |
          BAD_PATHS=(
            "pages/api/simple.js"
            "pages/api/test-auth.js"
            "pages/api/test-db.js"
            "pages/api/setup-database.js"
          )
          FOUND=()
          for path in "${BAD_PATHS[@]}"; do
            if [ -f "$path" ]; then
              FOUND+=("$path")
            fi
          done
          # Also flag any new pages/api/test-*.js the explicit list missed.
          while IFS= read -r path; do
            FOUND+=("$path")
          done < <(find pages/api -maxdepth 4 -type f -name 'test-*.js' 2>/dev/null || true)
          if [ ${#FOUND[@]} -gt 0 ]; then
            echo "::error::Forbidden dev endpoints present in pages/api/. Delete them or move to scripts/."
            for path in "${FOUND[@]}"; do
              echo "::error file=${path}::Forbidden dev endpoint."
            done
            exit 1
          fi
          echo "OK: no forbidden dev endpoints under pages/api/."          

# test:
#   Disabled until a test runner is adopted. Re-enable as:
#
#   test:
#     name: Unit + integration tests
#     runs-on: ubuntu-latest
#     steps:
#       - uses: actions/checkout@v4
#       - uses: actions/setup-node@v4
#         with:
#           node-version: ${{ env.NODE_VERSION }}
#           cache: npm
#       - run: npm ci
#       - run: npm run test:run
#         env:
#           JWT_SECRET: ci-secret-only-for-tests
#           POSTGRES_URL: postgres://ci:ci@localhost:5432/ci