zpan/.github/workflows/ci.yml

name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

concurrency:
  group: ci-${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

# Least-privilege default; jobs that need more (e.g. packages: write) opt in per-job.
permissions:
  contents: read

# All primary gates start together. The stable aggregate check waits for every
# required proof before main can merge.
jobs:
  downloader:
    name: Downloader / Go
    runs-on: ubuntu-latest
    if: github.repository == 'saltbo/zpan'
    defaults:
      run:
        working-directory: cmd
    steps:
      - uses: actions/checkout@v6
      - uses: actions/setup-go@v6
        with:
          go-version-file: cmd/go.mod
          cache-dependency-path: cmd/go.sum
      - name: Check formatting
        run: |
          files="$(gofmt -l .)"
          if [ -n "$files" ]; then
            echo "$files"
            exit 1
          fi
      - name: Test with coverage threshold
        run: bash scripts/test-coverage.sh
      - name: Install live downloader engines
        run: sudo apt-get update && sudo apt-get install -y aria2 qbittorrent-nox
        working-directory: .
      - name: Verify live downloads
        run: LIVE_DOWNLOAD_VERIFY=1 go test ./pkg/downloaders -run 'TestLive(DownloadThreeSourceTypes|QBittorrentDownloadTorrentURL)' -count=1 -v

  quality:
    name: Quality / TypeScript
    runs-on: ubuntu-latest
    if: github.repository == 'saltbo/zpan'
    steps:
      - uses: actions/checkout@v6
      - uses: pnpm/action-setup@v4
      - uses: actions/setup-node@v6
        with:
          node-version: 24
          cache: pnpm
      - uses: actions/setup-go@v6
        with:
          go-version-file: cmd/go.mod
          cache-dependency-path: cmd/go.sum
      - run: pnpm install --frozen-lockfile
      - name: Audit dependencies
        run: pnpm audit --audit-level high
      - run: pnpm lint
      - run: pnpm lint:arch
      - run: pnpm lint:http
      - run: pnpm lint:spec
      - run: pnpm typecheck
      - run: pnpm openapi:client:check

  tests-node:
    name: Tests / ${{ matrix.label }}
    runs-on: ubuntu-latest
    if: github.repository == 'saltbo/zpan'
    strategy:
      fail-fast: false
      matrix:
        include:
          - label: Unit
            project: unit
            report: unit
          - label: Integration
            project: integration
            report: integration
    steps:
      - uses: actions/checkout@v6
      - uses: pnpm/action-setup@v4
      - uses: actions/setup-node@v6
        with:
          node-version: 24
          cache: pnpm
      - run: pnpm install --frozen-lockfile
      - name: Run tests with coverage
        # Passing tests produce hundreds of KB of intentional request/error logs.
        # Keep captured output for failures without paying to stream every success.
        run: pnpm exec vitest run --project ${{ matrix.project }} --silent=passed-only --coverage --coverage.reportsDirectory=coverage/${{ matrix.report }} --reporter=default --reporter=blob --outputFile.blob=.vitest-reports/${{ matrix.report }}.blob
      - uses: actions/upload-artifact@v4
        if: always()
        with:
          name: vitest-coverage-${{ matrix.report }}
          path: .vitest-reports/${{ matrix.report }}.blob
          include-hidden-files: true
          if-no-files-found: error
          retention-days: 1

  tests-cf:
    name: Tests / Cloudflare
    runs-on: ubuntu-latest
    if: github.repository == 'saltbo/zpan'
    steps:
      - uses: actions/checkout@v6
      - uses: pnpm/action-setup@v4
      - uses: actions/setup-node@v6
        with:
          node-version: 24
          cache: pnpm
      - run: pnpm install --frozen-lockfile
      - run: mkdir -p dist
      - run: pnpm test:cf --silent=passed-only

  coverage:
    name: Tests / Coverage
    runs-on: ubuntu-latest
    if: github.repository == 'saltbo/zpan'
    needs: [tests-node]
    steps:
      - uses: actions/checkout@v6
      - uses: pnpm/action-setup@v4
      - uses: actions/setup-node@v6
        with:
          node-version: 24
          cache: pnpm
      - run: pnpm install --frozen-lockfile
      - uses: actions/download-artifact@v5
        with:
          pattern: vitest-coverage-*
          path: .vitest-reports
          merge-multiple: true
      - name: Verify both coverage reports are present
        run: |
          test -f .vitest-reports/unit.blob
          test -f .vitest-reports/integration.blob
          test "$(find .vitest-reports -type f -name '*.blob' | wc -l)" -eq 2
      - name: Merge coverage and enforce thresholds
        env:
          COVERAGE_ENFORCE: '1'
        run: pnpm exec vitest --merge-reports=.vitest-reports --coverage --reporter=agent --coverage.reportsDirectory=coverage/merged
      - uses: codecov/codecov-action@v5
        if: always()
        with:
          files: coverage/merged/coverage-final.json
          flags: unit,integration
          disable_search: true
          fail_ci_if_error: false
          handle_no_reports_found: true

  package-smoke:
    name: Package smoke / ${{ matrix.label }}
    runs-on: ubuntu-latest
    if: github.repository == 'saltbo/zpan'
    strategy:
      fail-fast: false
      matrix:
        include:
          - label: Server image
            target: ''
            tag: zpan-zpan:latest
            cache: docker-server
          - label: CLI image
            target: cli
            tag: zpan-cli-smoke:latest
            cache: docker-cli
    steps:
      - uses: actions/checkout@v6
      - uses: docker/setup-buildx-action@v4
      - name: Build image
        uses: docker/build-push-action@v7
        with:
          context: .
          target: ${{ matrix.target }}
          load: true
          tags: ${{ matrix.tag }}
          cache-from: type=gha,scope=${{ matrix.cache }}
          cache-to: type=gha,mode=max,scope=${{ matrix.cache }}
      # Downloader engines and protocol behavior have their own live local job.
      # This smoke gate only needs to prove the current production server image boots.
      - name: Start server image
        if: matrix.target == ''
        run: docker compose -f docker-compose.yml up -d --no-build --wait --wait-timeout 60 zpan
      - name: Assert server health from host
        if: matrix.target == ''
        run: curl --fail --retry 5 --retry-delay 3 --retry-connrefused http://localhost:8222/api/health
      - name: Verify CLI entrypoint
        if: matrix.target == 'cli'
        run: docker run --rm zpan-cli-smoke:latest --help
      - name: Dump logs on failure
        if: ${{ failure() && matrix.target == '' }}
        run: docker compose -f docker-compose.yml logs --no-color
      - name: Tear down
        if: ${{ always() && matrix.target == '' }}
        run: docker compose -f docker-compose.yml down -v

  deployment:
    name: Deployment / Cloudflare contract
    runs-on: ubuntu-latest
    if: github.repository == 'saltbo/zpan'
    steps:
      - uses: actions/checkout@v6
      - uses: pnpm/action-setup@v4
      - uses: actions/setup-node@v6
        with:
          node-version: 24
          cache: pnpm
      - run: pnpm install --frozen-lockfile
      - name: Build
        env:
          ZPAN_APP_VERSION: ci-dry-run
        run: pnpm build
      # --dry-run compiles the Worker and validates wrangler.toml + the
      # vite-plugin deploy config (assets dir, queues, bindings) without
      # contacting Cloudflare, so it needs no secrets and runs on fork PRs.
      # Guards the deploy regressions a unit test can't: a dropped build step
      # (#417) or an unprovisioned binding added to wrangler.toml.
      - name: Validate Cloudflare deploy config
        run: pnpm exec wrangler deploy --dry-run

  e2e:
    name: E2E / ${{ matrix.label }}
    runs-on: ubuntu-latest
    timeout-minutes: 15
    strategy:
      fail-fast: false
      matrix:
        include:
          - label: Node (1/3)
            runtime: node
            shard: 1
            artifact: node-1
          - label: Node (2/3)
            runtime: node
            shard: 2
            artifact: node-2
          - label: Node (3/3)
            runtime: node
            shard: 3
            artifact: node-3
          - label: Cloudflare critical journeys
            runtime: cloudflare
            artifact: cf
    steps:
      - uses: actions/checkout@v6
      - uses: pnpm/action-setup@v4
      - uses: actions/setup-node@v6
        with:
          node-version: 24
          cache: pnpm
      - run: pnpm install --frozen-lockfile
      - name: Run Node E2E shard
        if: matrix.runtime == 'node'
        run: pnpm e2e --project=desktop --shard=${{ matrix.shard }}/3
      - name: Run Cloudflare critical journeys
        if: matrix.runtime == 'cloudflare'
        run: E2E_RUNTIME=cf pnpm e2e --project=desktop --grep @critical
      - uses: actions/upload-artifact@v4
        if: failure()
        with:
          name: playwright-report-${{ matrix.artifact }}
          path: |
            playwright-report/
            test-results/
          retention-days: 7

  # Keep one stable required identity while the expensive proof runs in parallel.
  check:
    name: Typecheck & Test
    runs-on: ubuntu-latest
    if: ${{ always() && github.repository == 'saltbo/zpan' }}
    needs:
      - downloader
      - quality
      - tests-node
      - tests-cf
      - coverage
      - package-smoke
      - deployment
      - e2e
    steps:
      - name: Verify every required job passed
        env:
          JOB_RESULTS: ${{ toJSON(needs) }}
        run: test "$(jq -r '[.[].result] | all(. == "success")' <<<"$JOB_RESULTS")" = true

  publish:
    name: Publish / Docker dev images
    runs-on: ubuntu-latest
    needs: [check]
    # Publish the bleeding-edge `:dev` images only for green pushes to main on the
    # canonical repo. Pull requests stop at the stable required gate above.
    if: github.repository == 'saltbo/zpan' && github.event_name == 'push' && github.ref == 'refs/heads/main'
    permissions:
      contents: read
      packages: write
    steps:
      - uses: actions/checkout@v6

      - uses: docker/login-action@v4
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - uses: docker/setup-buildx-action@v4

      - name: Build & push server image
        uses: docker/build-push-action@v7
        with:
          context: .
          push: true
          # Dev images are amd64-only to skip slow arm64 QEMU emulation
          # (native better-sqlite3/sharp). Releases stay multi-arch.
          platforms: linux/amd64
          build-args: |
            APP_VERSION=dev
            APP_COMMIT=${{ github.sha }}
          tags: ghcr.io/${{ github.repository }}:dev
          cache-from: type=gha,scope=docker-server
          cache-to: type=gha,mode=max,scope=docker-server

      - name: Build & push CLI image
        uses: docker/build-push-action@v7
        with:
          context: .
          target: cli
          push: true
          platforms: linux/amd64
          build-args: |
            APP_VERSION=dev
            APP_COMMIT=${{ github.sha }}
          tags: ghcr.io/${{ github.repository }}:dev-cli
          cache-from: type=gha,scope=docker-cli
          cache-to: type=gha,mode=max,scope=docker-cli