ci.yml

name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

permissions:
  contents: read
  # nx-set-shas reads previous workflow runs to find the last green main commit
  actions: read

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  build:
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@v7
        with:
          fetch-depth: 0
          persist-credentials: false

      - uses: ./.github/actions/setup

      - uses: nrwl/nx-set-shas@v4

      - name: Check formatting
        run: pnpm format:check

      - name: Validate agent skills and roles
        run: pnpm skills:check

      - name: Type-check
        run: pnpm typecheck

      - name: Test and build affected projects
        run: pnpm exec nx affected -t test build

      - name: Test devtools package
        run: pnpm test:devtools

      - name: Test devtools panel
        run: pnpm test:panel

      - name: Build Chrome extension
        run: pnpm extension:build

      - name: Check committed build output is current
        run: |
          stale=$(git status --porcelain -- extension/ui)
          if [ -n "$stale" ]; then
            echo "$stale"
            echo "::error::Committed build output is stale. Run 'pnpm extension:build' and commit the result."
            exit 1
          fi

      - name: Smoke-test the CLI
        run: node bin.mjs --help

  node-22:
    name: Package tests on Node.js 22
    # `engines.node` allows 22.12 and later, while the build job runs the `.nvmrc` version.
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@v7
        with:
          persist-credentials: false

      - uses: ./.github/actions/setup
        with:
          node-version: 22

      - name: Test devtools package
        run: pnpm test:devtools

  axe:
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@v7
        with:
          persist-credentials: false

      - uses: ./.github/actions/setup

      - name: Install Chromium
        run: pnpm exec playwright install --with-deps chromium

      - name: Check the panel with axe
        run: pnpm test:axe

  # The e2e jobs below are slow, so they run only when the package, the panel, the SSR demo, the
  # tools docs (e2e:mcp reads them) or the scripts and fixtures they use change. The engines-floor
  # job runs only when what the packed package is built from changes. A diff that cannot be
  # computed (a new branch, a force push) runs them all.
  changes:
    name: Changed paths
    runs-on: ubuntu-latest
    timeout-minutes: 5
    outputs:
      e2e: ${{ steps.diff.outputs.e2e }}
      package: ${{ steps.diff.outputs.package }}
    steps:
      - uses: actions/checkout@v7
        with:
          fetch-depth: 0
          persist-credentials: false

      - id: diff
        env:
          BASE: ${{ github.event_name == 'pull_request' && github.event.pull_request.base.sha || github.event.before }}
        run: |
          paths=(packages/devtools app e2e src apps/docs/src/content/agents angular.json package.json
            scripts/e2e-security.mjs scripts/e2e-mcp.mjs pnpm-lock.yaml .github/workflows/ci.yml)
          if git diff --quiet "$BASE" HEAD -- "${paths[@]}"; then
            echo "e2e=false" >> "$GITHUB_OUTPUT"
          else
            echo "e2e=true" >> "$GITHUB_OUTPUT"
          fi
          # What the packed package is built from: the package, the panel it bundles and the toolchain.
          packed=(packages/devtools app package.json pnpm-lock.yaml pnpm-workspace.yaml .nvmrc
            .github/actions/setup .github/workflows/ci.yml)
          if git diff --quiet "$BASE" HEAD -- "${packed[@]}"; then
            echo "package=false" >> "$GITHUB_OUTPUT"
          else
            echo "package=true" >> "$GITHUB_OUTPUT"
          fi

  # The source tests can't run on 22.12 (Node runs .ts files only from 22.18, and the build tools
  # need newer versions), so this job checks the packed package there instead.
  engines-floor:
    name: Packed package on Node.js 22.12
    needs: changes
    if: needs.changes.outputs.package == 'true'
    runs-on: ubuntu-latest
    timeout-minutes: 20
    steps:
      - uses: actions/checkout@v7
        with:
          persist-credentials: false

      - uses: ./.github/actions/setup

      # `prepack` builds the library and the panel first, on the `.nvmrc` version.
      - name: Pack the package
        run: pnpm --filter @pangular-inspector/devtools pack --pack-destination "$RUNNER_TEMP/pack"

      # The engines floor: the lowest version `engines.node` in packages/devtools/package.json allows.
      # Keep the two in step.
      - uses: actions/setup-node@v7
        with:
          node-version: 22.12.0

      - name: Install the tarball into an empty project
        working-directory: ${{ runner.temp }}
        run: |
          mkdir floor
          cd floor
          npm init -y > /dev/null
          npm install --no-audit --no-fund "$RUNNER_TEMP"/pack/*.tgz

      # The Node.js entry points from `exports` in packages/devtools/package.json. The browser
      # entries (overlay, popup and the hooks) need a DOM. `http` is left out too: it imports
      # the optional Angular peers, which load in plain Node.js only with `@angular/compiler`
      # (JIT), and the app's build bundles it.
      - name: Run the CLI and load the entry points
        working-directory: ${{ runner.temp }}/floor
        run: |
          node --version
          npx pangular --version
          for entry in '' /devframe /config /cli /hub /ssr /vite; do
            node -e "import('@pangular-inspector/devtools$entry')"
          done
          node -e "require('@pangular-inspector/devtools/hub')"

  e2e-security:
    name: Security e2e
    needs: changes
    if: needs.changes.outputs.e2e == 'true'
    runs-on: ubuntu-latest
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@v7
        with:
          persist-credentials: false

      - uses: ./.github/actions/setup

      # Playwright's own Chromium, as the axe job installs it.
      - name: Install Chromium
        run: pnpm exec playwright install --with-deps chromium

      - name: Build the package
        run: pnpm devtools:build-pkg

      # Leak corpus, access gates and a production build, on ports 5231 to 5236.
      - name: Check redaction and access
        run: pnpm e2e:security

      - name: Keep the captured channels
        if: failure()
        uses: actions/upload-artifact@v4
        with:
          name: e2e-security
          path: dist/e2e-security
          if-no-files-found: ignore

  e2e-mcp:
    name: MCP e2e
    needs: changes
    if: needs.changes.outputs.e2e == 'true'
    runs-on: ubuntu-latest
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@v7
        with:
          persist-credentials: false

      - uses: ./.github/actions/setup

      - name: Install Chromium
        run: pnpm exec playwright install --with-deps chromium

      # Builds the package and the SSR demo itself, then serves the demo on port 5150 (the variant
      # hubs on 5151 to 5154) and checks every tool, resource and prompt, and agents/tools.md.
      - name: Check the agent surface
        run: pnpm e2e:mcp --report dist/e2e-mcp/report.json

      - name: Keep the report
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: e2e-mcp
          path: dist/e2e-mcp
          if-no-files-found: ignore