openpencil/.github/workflows/ci.yml

name: CI

on:
  pull_request:
    branches: [master]
    paths-ignore:
      - 'packages/docs/**'
      - 'openspec/**'
      - '*.md'

permissions:
  contents: read
  packages: read

concurrency:
  group: ci-${{ github.ref }}
  cancel-in-progress: true

jobs:
  source-quality:
    name: Code quality
    timeout-minutes: 10
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        with:
          persist-credentials: false

      - uses: ./.github/actions/setup-bun

      - name: Generate package declarations
        run: bun run build:packages

      - name: Verify formatting
        run: bun run format:check

      - name: Lint TypeScript and Vue
        run: bun run lint

      - name: Typecheck application and SDKs
        run: bun run typecheck

      - name: Enforce architecture and type-shape boundaries
        run: bun run check:arch && bun run test:type-shapes

  package-quality:
    name: Package integrity
    timeout-minutes: 10
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        with:
          persist-credentials: false

      - uses: ./.github/actions/setup-bun

      - name: Build publishable packages
        run: bun run build:packages

      - name: Validate package exports
        run: bun run check:packages

      - name: Detect unused dependencies and files
        run: bun run check:deps

      - name: Validate workspace dependency policy
        run: bun run check:monorepo

  repository-quality:
    name: Repository hygiene
    timeout-minutes: 10
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        with:
          persist-credentials: false

      - uses: ./.github/actions/setup-bun

      - name: Validate translations
        run: bun run check:i18n

      - name: Validate documentation links and structure
        run: bun run check:docs

      - name: Audit critical dependency vulnerabilities
        run: bun run check:audit

      - name: Scan for committed secrets
        run: bun run check:secrets

      - name: Test repository tooling
        run: bun run test:tools

      - name: Detect duplicated product code
        run: bun run test:dupes

  storybook:
    name: Component workshop
    timeout-minutes: 10
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        with:
          persist-credentials: false

      - uses: ./.github/actions/setup-bun

      - name: Build component dependencies
        run: bun run build:packages

      - name: Build static Storybook
        run: bun run build-storybook

  native-test-contracts:
    name: Native app contracts
    timeout-minutes: 8
    runs-on: ubuntu-24.04
    container:
      image: ghcr.io/open-pencil/native-contracts-ci@sha256:64e6b1b50a988c1cefe2b69ac9d58076fd743b18391fa2dbd1d153eba2be9521
      credentials:
        username: ${{ github.actor }}
        password: ${{ secrets.GITHUB_TOKEN }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        with:
          persist-credentials: false

      - uses: dtolnay/rust-toolchain@stable

      - uses: Swatinem/rust-cache@v2
        with:
          workspaces: desktop -> target
          key: native-test

      - uses: ./.github/actions/setup-bun

      - name: Build Harness sidecar
        run: bun run build:harness-sidecar -- x86_64-unknown-linux-gnu

      - name: Typecheck native interaction tests
        run: bun run check:native-test

      - name: Compile native-test Tauri feature
        run: cargo check --manifest-path desktop/Cargo.toml --features native-test

  unit-tests:
    timeout-minutes: 10
    runs-on: ubuntu-latest
    strategy:
      fail-fast: true
      matrix:
        group: [app, dom, editor, fig, render, scene, vue]
    name: Engine tests — ${{ matrix.group }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        with:
          persist-credentials: false

      - uses: ./.github/actions/setup-bun
        with:
          lfs: 'true'

      - name: Build shared Core test dependency
        run: bun --filter @open-pencil/core build

      - name: Run ${{ matrix.group }} engine tests
        shell: bash
        run: |
          mapfile -t test_files < <(bun tools/unit-tests/src/list.ts "${{ matrix.group }}")
          if [ "${#test_files[@]}" -eq 0 ]; then
            echo "No tests found for shard ${{ matrix.group }}"
            exit 0
          fi
          bun test "${test_files[@]}"          
        env:
          BUN_HEAVY_TESTS: 'false'