ci.yml

name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  lint-and-test:
    runs-on: ubuntu-latest
    # Build and e2e both boot the app, so they need a real database and the
    # secrets NextAuth refuses to start without. Values are throwaway CI-only.
    env:
      DATABASE_URL: postgresql://chatbot_admin:chatbot_dev@localhost:5433/chatbot?schema=public
      NEXTAUTH_SECRET: ci-test-secret-not-for-production
      NEXTAUTH_URL: http://localhost:3005
      AWS_REGION: ap-south-2
      # EncryptionService refuses to construct without a 64-char hex key, so
      # libs/claw-studio's claw-runtime tests fail at setup without it. Throwaway.
      # MUST stay quoted: an unquoted all-digit value is parsed by YAML as an
      # integer, which collapses to "0" and then fails the 64-char hex check in
      # libs/shared/src/env.ts — breaking every suite that imports it.
      ENCRYPTION_KEY: "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
    # libs/claw-studio persistence tests run against a live Postgres (see
    # TEST_DATABASE_URL in src/agent/persistence.test.ts, which pins port 5433).
    # Without this the suite fails with connection errors rather than assertion
    # failures, which reads like a code bug and is not.
    services:
      postgres:
        image: pgvector/pgvector:pg16
        env:
          POSTGRES_DB: chatbot
          POSTGRES_USER: chatbot_admin
          POSTGRES_PASSWORD: chatbot_dev
        ports:
          - 5433:5432
        options: >-
          --health-cmd "pg_isready -U chatbot_admin -d chatbot"
          --health-interval 5s
          --health-timeout 5s
          --health-retries 10
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup Bun
        uses: oven-sh/setup-bun@v2
        with:
          bun-version: latest

      - name: Install dependencies
        run: bun install --frozen-lockfile

      - name: Prepare test database
        # migrate deploy, not db push: the HNSW pgvector indexes live in raw SQL
        # inside migrations, and db push silently skips them.
        run: bunx prisma migrate deploy --schema=./prisma/schema.prisma

      - name: Unit tests
        run: bun run test

      # Restores the original `bun run build` (nx run-many -t build --all). This used
      # to need --excludeTaskDependencies scoped to web-ui, because agent-studio's
      # build failed on an Nx path-rewriting bug and web-ui depends on it. Both
      # agent-studio and claw-studio are fixed now (see
      # libs/whatsapp/src/processor/agent-executor.ts and
      # libs/claw-studio/src/mcp/mcp-tools.ts), so the whole monorepo builds.
      - name: Build
        run: bun run build

      - name: Install Playwright browsers
        run: bunx playwright install --with-deps chromium

      # e2e is intentionally NOT run here yet.
      #
      # Playwright's webServer runs `bun run dev:all`, which starts four servers in
      # parallel (web-ui, workers, sdk, mission-control) and allows 120s for them to
      # come up. That reproducibly times out. It also never ran before: CI had been
      # failing at the unit-test step since the job was created, so this was never
      # exercised. Wiring it up is its own piece of work — most likely a dedicated
      # CI serve command (web-ui only) or a pre-started server, not dev:all.
      #
      # The target also defaults to dependsOn: ^build, which is now satisfiable.
      #
      # - name: E2E tests
      #   run: bunx nx e2e web-ui-e2e -- --grep-invert @sso

      - name: Upload Playwright report
        if: failure()
        uses: actions/upload-artifact@v4
        with:
          name: playwright-report
          path: apps/web-ui-e2e/playwright-report/
          retention-days: 7

      # TODO: Add lint and typecheck scripts when ESLint / tsc targets are configured in Nx
      # - name: Lint
      #   run: bun run lint
      # - name: Type check
      #   run: bun run typecheck