# Continuous integration on GitHub Actions (GitHub is the only home).
# Post-merge gate on `main` (promote from stage already passed ci-pr on the PR).
# PRs run in ci-pr.yml (with build + migration-lock); merges to `stage` run in
# ci-stage.yml (stage Neon snapshot, never a build).
name: CI

on:
  push:
    branches: [main]

concurrency:
  group: ci-${{ github.ref }}
  cancel-in-progress: true

jobs:
  checks:
    runs-on: ubuntu-latest
    timeout-minutes: 20
    services:
      postgres:
        # Matches production Neon major (17) and docker-compose.yml.
        image: postgres:17-alpine
        env:
          POSTGRES_USER: teqo
          POSTGRES_PASSWORD: teqo
          POSTGRES_DB: teqo_test
        ports:
          - 5432:5432
        options: >-
          --health-cmd "pg_isready -U teqo"
          --health-interval 5s
          --health-timeout 5s
          --health-retries 12
    env:
      # Tests load .env.test themselves (database teqo_test on localhost:5432).
      # These are only for the migrate step, which reads the process env.
      DATABASE_URL: postgresql://teqo:teqo@localhost:5432/teqo_test
      PAYLOAD_SECRET: test-only-secret-not-used-in-production
      NEXT_PUBLIC_SITE_URL: http://localhost:3000
    steps:
      - uses: actions/checkout@v4

      - uses: pnpm/action-setup@v4

      - uses: actions/setup-node@v4
        with:
          node-version: 24
          cache: pnpm

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Lint (zero warnings)
        run: pnpm lint

      - name: Format check (prettier)
        run: pnpm format:check

      - name: Typecheck
        run: pnpm typecheck

      - name: Dead code (knip)
        run: pnpm exec knip

      - name: Circular dependencies (madge)
        run: pnpm check:cycles

      - name: Unit tests
        run: pnpm test:unit

      - name: Migrate test database
        run: pnpm migrate

      - name: Integration tests
        run: pnpm test:int