ci.yml

name: CI

on:
  workflow_call:
  workflow_dispatch:

concurrency:
  group: CI-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: read
  pull-requests: write

jobs:
  validate:
    name: Lint Test Validate
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v6
        with:
          fetch-depth: 0

      - name: Validate commit messages
        if: github.event_name == 'pull_request' || github.event_name == 'push'
        run: |
          # Clean Commit convention pattern
          # Format: <emoji> <type>[(<scope>)]: <description>
          PATTERN='^(📦|🔧|🗑️|🔒|⚙️|☕|🧪|📖|🚀) (new|update|remove|security|setup|chore|test|docs|release)( \([a-z0-9][a-z0-9-]*\))?: .{1,72}$'

          if [ "${{ github.event_name }}" = "pull_request" ]; then
            COMMITS=$(git log --format="%s" "${{ github.event.pull_request.base.sha }}..${{ github.event.pull_request.head.sha }}")
          else
            GITHUB_EVENT_BEFORE="${{ github.event.before }}"
            GITHUB_EVENT_AFTER="${{ github.event.after }}"
            if [ "$GITHUB_EVENT_BEFORE" = "0000000000000000000000000000000000000000" ]; then
              # Initial push has no valid "before" SHA, so capture all reachable commits
              COMMITS=$(git log --format="%s" "$GITHUB_EVENT_AFTER")
            elif ! git cat-file -e "${GITHUB_EVENT_BEFORE}^{commit}" 2>/dev/null; then
              # Force-push: before SHA no longer exists, validate only the latest commit
              echo "⚠ Force-push detected — before SHA not found, validating HEAD commit only"
              COMMITS=$(git log --format="%s" -1 "$GITHUB_EVENT_AFTER")
            else
              COMMITS=$(git log --format="%s" "${GITHUB_EVENT_BEFORE}..${GITHUB_EVENT_AFTER}")
            fi
          fi

          FAILED=0
          while IFS= read -r msg; do
            [ -z "$msg" ] && continue
            # Allow merge commits
            if echo "$msg" | grep -qE "^Merge "; then
              continue
            fi
            # Allow Copilot agent initial plan commits (auto-generated before repo conventions are read)
            if echo "$msg" | grep -qE "^Initial plan$"; then
              echo "⚠ Skipping bot commit: $msg"
              continue
            fi
            if ! echo "$msg" | grep -qP "$PATTERN"; then
              echo "✖ Invalid commit message: $msg"
              FAILED=1
            else
              echo "✔ Valid commit message: $msg"
            fi
          done <<< "$COMMITS"

          if [ "$FAILED" -eq 1 ]; then
            echo ""
            echo "One or more commit messages do not follow the Clean Commit convention."
            echo "Format: <emoji> <type>[(<scope>)]: <description>"
            echo "Reference: https://github.com/wgtechlabs/clean-commit"
            exit 1
          fi

      - name: Detect secrets
        uses: gitleaks/gitleaks-action@v2.3.9
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Setup Bun
        uses: oven-sh/setup-bun@v2
        with:
          bun-version: 1.3.13

      - name: Setup Node.js
        uses: actions/setup-node@v6
        with:
          node-version: "22"

      - name: Cache Bun dependencies
        uses: actions/cache@v4
        with:
          path: ~/.bun/install/cache
          key: ${{ runner.os }}-bun-${{ hashFiles('bun.lock') }}
          restore-keys: |
            ${{ runner.os }}-bun-

      - name: Install dependencies
        run: bun install --frozen-lockfile

      - name: Run Biome lint and format check
        run: bun run lint

      - name: Build packages
        run: bun run build:packages

      - name: Build plugins
        run: bun run build:plugins

      - name: Run tests (with retry for Bun runtime segfaults)
        uses: nick-fields/retry@v4
        with:
          max_attempts: 3
          timeout_minutes: 10
          command: bun test

      - name: Test Docker build (no push)
        run: |
          echo "Testing Docker build..."
          docker build -t test-build .
          echo "Build successful, cleaning up..."
          docker image rm test-build
          echo "Docker build test completed"