ci.yml

name: Lint / Format / Type Check

on:
  push:
    branches: [main]
  pull_request:

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

permissions: {}

jobs:
  ci:
    name: ci # required status check context (ruleset status_check_main) — keep equal to the job id
    runs-on: ubuntu-latest
    timeout-minutes: 10
    permissions:
      contents: read # checkout the repository

    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Install aqua
        uses: $/.github/actions/install-aqua

      - name: Install deps
        uses: $/.github/actions/install-deps

      # Install deps builds the SDK once so the CLI bin links resolve; build
      # the remaining packages here before downstream checks.
      - name: Build packages
        run: pnpm -r --filter '!@tailor-platform/sdk' run build

      - name: Run lint
        id: lint
        continue-on-error: true
        run: pnpm -r run lint

      - name: Run Vitest lint
        id: lint_vitest
        continue-on-error: true
        run: pnpm run lint:vitest

      - name: Run tooling lint
        id: lint_tooling
        continue-on-error: true
        run: pnpm run lint:tooling

      - name: Fail if lint failed
        if: steps.lint.outcome == 'failure' || steps.lint_vitest.outcome == 'failure' || steps.lint_tooling.outcome == 'failure'
        run: exit 1

      # Ensure no executable files are committed
      # refs: https://github.com/changesets/action/issues/523
      # Checks git object modes (not the working tree) because pnpm chmods
      # declared bin targets +x at install time. Those targets are exempt:
      # they are committed as 755 so installs keep checkouts clean, and
      # changesets/action never commits them.
      - name: Check for executable files
        run: |
          bin_targets=$(git ls-files '*package.json' | xargs node -e '
            const fs = require("fs");
            const path = require("path");
            for (const pkgPath of process.argv.slice(1)) {
              const { bin } = JSON.parse(fs.readFileSync(pkgPath, "utf8"));
              if (!bin) continue;
              for (const target of typeof bin === "string" ? [bin] : Object.values(bin)) {
                console.log(path.posix.normalize(path.posix.join(path.posix.dirname(pkgPath), target)));
              }
            }
          ')
          executable_files=$(git ls-files --format='%(objectmode) %(path)' | while read -r mode file; do
            [ "$mode" = "100755" ] && ! grep -Fqx "$file" <<< "$bin_targets" && echo "$file"
          done || true)
          if [ -n "$executable_files" ]; then
            echo "Error: Found committed executable files (changesets/action does not support executable files):"
            echo "$executable_files"
            exit 1
          fi

      - name: Check format
        id: format
        continue-on-error: true
        run: pnpm format:check

      - name: Fail if format failed
        if: steps.format.outcome == 'failure'
        run: exit 1

      - name: Check actions.lock
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          pnpm actions:lock:check || {
            echo "::error file=.github/workflows/actions.lock::actions.lock check failed. If it is out of date, run 'pnpm actions:lock:update' and commit the result."
            exit 1
          }

      - name: Generate code
        run: pnpm -r run generate

      # These checks only read the generated tree, so they run concurrently.
      # GitHub caps a job at 10 concurrent background steps; this group is at
      # that cap, so adding another check here needs a second group.
      - parallel:
          - name: Check type by tsrs
            run: pnpm -r run typecheck:rs

          - name: Check type
            run: pnpm -r run typecheck

          - name: Check unused code (knip)
            run: pnpm -r run knip

          - name: Check package exports (publint)
            run: pnpm -r run publint

          # zod must not leak into user-facing entry points (operates on dist/,
          # already built by install-deps).
          - name: Check zod isolation
            run: pnpm -r run check:zod-isolation

          - name: Check import cycles
            run: pnpm -r run check:import-cycles

          # The checks below guard files that are generated from a source of truth.
          # They were only reachable through `pnpm check` locally, so forgetting the
          # matching `:update` command left CI green while the generated copy drifted.
          - name: Check agent rules are up to date
            run: pnpm run check:agent-rules

          - name: Check migration docs match the codemod registry
            run: pnpm run check:codemod-docs

          - name: Check public API JSDoc
            run: pnpm run check:jsdoc

          # Also gates the release PR: once its version bump reaches a codemod's
          # boundary, an API that was supposed to be removed there still carrying a
          # `@deprecated` declaration fails here.
          - name: Check deprecations
            run: pnpm run check:deprecations