ci.yaml

name: Build & Test

on:
  push:
    branches:
      - main
      - dev
  pull_request:

permissions:
  contents: read

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Setup Bun Runtime
        uses: oven-sh/setup-bun@v2
      - run: bun i
      - run: bun run build

  build-cli:
    name: Build CLI (Go)
    runs-on: ubuntu-latest
    strategy:
      matrix:
        goos: [linux, darwin, windows]
        goarch: [amd64, arm64]
    steps:
      - uses: actions/checkout@v4
      - name: Setup Go toolchain
        uses: actions/setup-go@v5
        with:
          go-version: "1.25"
          cache-dependency-path: packages/envsync-cli/go.sum
      - name: Build CLI binary
        run: go build -ldflags="-s -w -X github.com/EnvSync-Cloud/envsync/packages/envsync-cli/internal/config.backendURL=https://api.envsync.cloud -X github.com/EnvSync-Cloud/envsync/packages/envsync-cli/internal/config.telemetryURL=https://t.envsync.cloud/obs -X github.com/EnvSync-Cloud/envsync/packages/envsync-cli/internal/telemetry.version=ci" -o /dev/null ./cmd/cli/main.go
        working-directory: packages/envsync-cli
        env:
          CGO_ENABLED: "0"
          GOOS: ${{ matrix.goos }}
          GOARCH: ${{ matrix.goarch }}
      - name: Run go vet
        run: go vet ./...
        working-directory: packages/envsync-cli

  test-mock:
    name: Mock Tests
    runs-on: ubuntu-latest
    services:
      postgres:
        image: postgres:17
        env:
          POSTGRES_USER: postgres
          POSTGRES_PASSWORD: postgres
          POSTGRES_DB: envsync_test
        ports:
          - 5432:5432
        options: >-
          --health-cmd "pg_isready -U postgres"
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5
    env:
      DATABASE_HOST: localhost
      DATABASE_PORT: 5432
      DATABASE_USER: postgres
      DATABASE_PASSWORD: postgres
      DATABASE_NAME: envsync_test
      CACHE_ENV: development
    steps:
      - uses: actions/checkout@v4
      - name: Setup Bun Runtime
        uses: oven-sh/setup-bun@v2
      - run: bun i
      - name: Package boundary checks (Phase 5)
        run: bun run check:boundaries
      - name: Run deploy planner tests
        run: bun test src/index.test.ts
        working-directory: packages/deploy-core
      - name: Run deploy package tests
        run: bun run test
        working-directory: packages/deploy
      - name: Run deploy CLI tests
        run: bun run test
        working-directory: packages/deploy-cli
      - name: Run mock tests
        run: bun run test:mock
        working-directory: packages/envsync-api

  test-e2e:
    name: E2E Tests
    runs-on: ubuntu-latest
    env:
      ENVSYNC_EDITION: enterprise
      ENVSYNC_LICENSE_SERVER_URL: "https://license.envsync.cloud"
      ENVSYNC_E2E_LICENSE_KEY: ${{ secrets.ENVSYNC_E2E_LICENSE_KEY }}
    steps:
      - uses: actions/checkout@v4
      - name: Setup Bun Runtime
        uses: oven-sh/setup-bun@v2
      - name: Setup Go toolchain
        uses: actions/setup-go@v5
        with:
          go-version: "1.25"
          cache-dependency-path: packages/envsync-cli/go.sum
      - run: bun i

      - name: Validate hosted license E2E configuration
        run: |
          if [ -z "$ENVSYNC_E2E_LICENSE_KEY" ]; then
            echo "ENVSYNC_E2E_LICENSE_KEY GitHub Actions secret is required for hosted license E2E tests."
            exit 1
          fi

          curl --silent --fail "$ENVSYNC_LICENSE_SERVER_URL/health" > /dev/null

      - name: Run E2E tests
        run: bun run test:e2e

  ui-e2e:
    name: UI E2E Tests
    runs-on: ubuntu-latest
    timeout-minutes: 45
    env:
      ENVSYNC_EDITION: enterprise
      DB_AUTO_MIGRATE: "true"
      VITE_HYPERDX_DISABLED: "true"
      VITE_OTEL_SDK_DISABLED: "true"
      OTEL_SDK_DISABLED: "true"
    steps:
      - uses: actions/checkout@v4

      - name: Setup Bun Runtime
        uses: oven-sh/setup-bun@v2
        with:
          bun-version: "1.3.9"

      - name: Install dependencies
        run: bun install

      - name: Install Playwright browser
        run: bunx playwright install --with-deps chromium
        working-directory: apps/envsync-web

      - name: Build TypeScript SDK
        run: bun run --filter @envsync-cloud/envsync-ts-sdk build

      - name: Prepare E2E environment
        run: |
          cp .env.example .env
          bun run e2e-setup reset

      - name: Build merged UI E2E env
        run: |
          cp .env .env.ui-e2e
          cat packages/envsync-api/.env.e2e.test >> .env.ui-e2e
          printf '\nDATABASE_NAME=envsync_e2e_test\n' >> .env.ui-e2e
          printf 'DB_AUTO_MIGRATE=true\n' >> .env.ui-e2e
          printf 'ENVSYNC_EDITION=enterprise\n' >> .env.ui-e2e

      - name: Start API and frontend apps
        run: |
          nohup bun run --filter envsync-api dev > /tmp/envsync-api.log 2>&1 &
          echo $! > /tmp/envsync-api.pid

          nohup bun run --filter envsync-web dev > /tmp/envsync-web.log 2>&1 &
          echo $! > /tmp/envsync-web.pid

          nohup bun run --filter envsync-landing dev > /tmp/envsync-landing.log 2>&1 &
          echo $! > /tmp/envsync-landing.pid
        env:
          ROOT_ENV_PATH: ${{ github.workspace }}/.env.ui-e2e

      - name: Wait for app services
        run: |
          for url in \
            "http://api.lvh.me:4000/health" \
            "http://app.lvh.me:8001" \
            "http://localhost:8002" \
            "http://localhost:8025"
          do
            for i in $(seq 1 90); do
              if curl --silent --fail --output /dev/null "$url"; then
                echo "ready: $url"
                break
              fi

              if [ "$i" -eq 90 ]; then
                echo "service did not become ready: $url"
                for logfile in /tmp/envsync-api.log /tmp/envsync-web.log /tmp/envsync-landing.log; do
                  if [ -f "$logfile" ]; then
                    echo "===== $logfile ====="
                    tail -n 200 "$logfile" || true
                  fi
                done
                exit 1
              fi

              sleep 2
            done
          done

      - name: Run UI regression suite
        run: bun run --filter envsync-web ui:regression
        env:
          ROOT_ENV_PATH: ${{ github.workspace }}/.env.ui-e2e
          ENVSYNC_UI_WORKERS: "1"
          ENVSYNC_UI_REQUIRE_FRESH_LOGIN: "1"

      - name: Upload Playwright artifacts
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: playwright-ui-artifacts
          path: |
            apps/envsync-web/.tmp/artifacts
            apps/envsync-web/playwright-report
            apps/envsync-web/test-results
          if-no-files-found: ignore

      - name: Upload service logs
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: ui-e2e-service-logs
          path: |
            /tmp/envsync-api.log
            /tmp/envsync-web.log
            /tmp/envsync-landing.log
          if-no-files-found: ignore

      - name: Cleanup
        if: always()
        run: |
          for pidfile in /tmp/envsync-api.pid /tmp/envsync-web.pid /tmp/envsync-landing.pid; do
            if [ -f "$pidfile" ]; then
              kill "$(cat "$pidfile")" 2>/dev/null || true
            fi
          done

          docker compose down -v --remove-orphans || true

  build-api-image:
    name: Build & Push API Image
    runs-on: ubuntu-latest
    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
    needs: [build]
    permissions:
      contents: read
      packages: write
    steps:
      - uses: actions/checkout@v4

      - name: Log in to GHCR
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Extract metadata
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: ghcr.io/envsync-cloud/envsync-api
          tags: |
            type=raw,value=latest
            type=sha,prefix=

      - name: Build and push
        uses: docker/build-push-action@v6
        with:
          context: .
          file: packages/envsync-api/Dockerfile
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}