EpicNext-Cms/.gitea/workflows/ci.yaml

name: CI

on:
  push:
    branches: [main, master, "codex/**"]
    tags: ["v*"]
  pull_request:
    branches: [main, master]
  workflow_dispatch:

env:
  PLAYWRIGHT_BROWSERS_PATH: /opt/ms-playwright

jobs:
  check:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v5
        with:
          repository: ${{ gitea.repository }}
          token: ${{ gitea.token }}

      - name: Toolchain check
        run: node scripts/check-node-toolchain.mjs

      - name: README version sync
        run: node scripts/sync-readme-versions.mjs --check

      - name: Deploy port-selection tests
        run: bash scripts/ci-deploy-ports.test.sh

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Dependency security audit
        run: pnpm deps:audit

      - name: Lint
        run: pnpm biome:lint

      - name: CMS translation contracts
        run: pnpm i18n:check

      - name: Typecheck
        run: pnpm typecheck

  tests-unit:
    needs: check
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v5
        with:
          repository: ${{ gitea.repository }}
          token: ${{ gitea.token }}

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Unit & coverage tests
        env:
          SKIP_ENV_VALIDATION: 1
          NODE_ENV: test
          DATABASE_URL: "mysql://test:test@localhost:3306/test?charset=utf8mb4"
          REDIS_URL: "redis://127.0.0.1:6379?connect_timeout=2"
          AUTH_SECRET: "ci-test-secret-key-that-is-long-enough"
          BCRYPT_ROUNDS: 4
        run: |
          if [ -x /usr/bin/time ]; then
            /usr/bin/time -f 'Tests: %e seconds; peak process RSS: %M KiB' pnpm test:coverage --maxWorkers=4
          else
            time pnpm test:coverage --maxWorkers=4
          fi

  tests-integration:
    needs: check
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v5
        with:
          repository: ${{ gitea.repository }}
          token: ${{ gitea.token }}

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: MariaDB and Redis integration tests
        run: pnpm test:integration

  tests-ui:
    needs: check
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v5
        with:
          repository: ${{ gitea.repository }}
          token: ${{ gitea.token }}

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Install UI test browser
        run: pnpm exec playwright install chromium

      - name: Accessibility and UI regression checks
        run: pnpm test:ui

      - name: Upload UI results
        if: always()
        uses: https://gitea.com/actions/gitea-upload-artifact@62ac910c5d3dfa85c7cb2df15afe2e342b2407c2
        with:
          name: ui-results
          path: |
            e2e/ui/__screenshots__/linux/
            playwright-report/ui/
            test-results/ui/
          retention-days: 14

  # Cross-browser imaging: the deploy gate only runs chromium, so this verifies
  # a real render (decode + APNG animation + visual baseline) across every
  # bundled engine against the public site. Blocking on purpose: this is the
  # signal that avatar imaging works on every system, so a failure here must
  # stop the pipeline. IMAGING_EDGE marks the target as edge-fronted, enabling
  # the public-routing smoke and skipping the CMS-only /imaging assertions.
  tests-imaging-browsers:
    needs: check
    if: gitea.event_name == 'push' && (gitea.ref_name == 'main' || gitea.ref_name == 'master')
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v5
        with:
          repository: ${{ gitea.repository }}
          token: ${{ gitea.token }}

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Install cross-browser engines
        run: pnpm exec playwright install --with-deps chromium firefox webkit

      - name: Cross-browser imaging checks
        env:
          PLAYWRIGHT_BASE_URL: https://epicnabbo.nl
          IMAGING_EDGE: "1"
        run: pnpm test:imaging

  # Advisory live-quality checks: broken uploads/theme assets, legacy malformed
  # avatar figures and warm-page latency. These depend on live content and data
  # rather than the code under test, so they are informational only —
  # `continue-on-error` keeps the pipeline green while still surfacing the
  # signal in the job log and uploaded report. The deterministic caching contract
  # is enforced by the blocking deploy gate instead.
  tests-quality:
    needs: check
    if: gitea.event_name == 'push' && (gitea.ref_name == 'main' || gitea.ref_name == 'master')
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v5
        with:
          repository: ${{ gitea.repository }}
          token: ${{ gitea.token }}

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Install quality test browser
        run: pnpm exec playwright install chromium

      - name: Advisory quality checks
        continue-on-error: true
        env:
          PLAYWRIGHT_BASE_URL: https://epicnabbo.nl
        run: pnpm test:e2e:quality

      - name: Upload quality results
        if: always()
        uses: https://gitea.com/actions/gitea-upload-artifact@62ac910c5d3dfa85c7cb2df15afe2e342b2407c2
        with:
          name: quality-results
          path: |
            playwright-report/quality/
            test-results/quality/
          if-no-files-found: warn
          retention-days: 14

  preflight:
    needs: [tests-unit, tests-integration, tests-ui]
    if: gitea.event_name == 'pull_request' || (gitea.event_name == 'push' && startsWith(gitea.ref, 'refs/heads/codex/'))
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v5
        with:
          repository: ${{ gitea.repository }}
          token: ${{ gitea.token }}

      - name: Toolchain check
        run: node scripts/check-node-toolchain.mjs

      - name: Build and verify isolated candidate
        shell: bash
        run: bash scripts/ci-preflight.sh

      - name: Upload preflight news browser results
        if: always()
        uses: https://gitea.com/actions/gitea-upload-artifact@62ac910c5d3dfa85c7cb2df15afe2e342b2407c2
        with:
          name: preflight-news-browser-results
          path: |
            test-results/news-real/
            playwright-report/news-real/
          if-no-files-found: warn
          retention-days: 14

  deploy:
    needs: [tests-unit, tests-integration, tests-ui]
    if: gitea.event_name == 'push' && (gitea.ref_name == 'main' || gitea.ref_name == 'master')
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v5
        with:
          repository: ${{ gitea.repository }}
          token: ${{ gitea.token }}

      - name: Build, deploy and smoke test
        shell: bash
        env:
          DEPLOY_BRANCH: ${{ gitea.ref_name }}
        run: bash scripts/ci-deploy.sh

      - name: Upload isolated news browser results
        if: always()
        uses: https://gitea.com/actions/gitea-upload-artifact@62ac910c5d3dfa85c7cb2df15afe2e342b2407c2
        with:
          name: news-browser-results
          path: |
            test-results/news-real/
            playwright-report/news-real/
          if-no-files-found: warn
          retention-days: 14

      - name: Upload JavaScript size report
        if: always()
        uses: https://gitea.com/actions/gitea-upload-artifact@62ac910c5d3dfa85c7cb2df15afe2e342b2407c2
        with:
          name: javascript-size-report
          path: build-reports/
          if-no-files-found: warn
          retention-days: 14