test.yml

name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
  workflow_dispatch:

permissions:
  contents: read

jobs:
  lint:
    name: Lint
    runs-on: ubuntu-22.04
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Setup Ruby
        uses: ruby/setup-ruby@651ff0d62c5c79bed6d53ec518387aae20e72c1a # v1.329.0
        with:
          ruby-version: '.ruby-version'
          # Install all gems (both test and development)
          bundler-cache: true

      - name: Setup Node.js
        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
        with:
          node-version: 22

      - name: Setup pnpm
        uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
        with:
          version: 10.18.3

      - name: Enable pnpm cache
        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
        with:
          node-version: 22
          cache: pnpm
          cache-dependency-path: |
            pnpm-lock.yaml
            docs/pnpm-lock.yaml

      - name: Install npm packages
        run: |
          # Install root and docs pnpm dependencies
          pnpm install --frozen-lockfile
          cd docs && pnpm install --frozen-lockfile && cd ..

      - name: Generate CSpell dictionaries from package lockfiles
        run: |
          scripts/generate_lockfile_words.sh

      - name: CSpell (Spellcheck)
        run: scripts/spellcheck.sh

      - name: Changelog has entry for current version
        run: ruby scripts/check_changelog_version.rb

      - name: Prettier (Formatting)
        run: scripts/prettier.sh --check

      - name: Tapioca (Verify RBI files)
        run: |
          # Add a few excluded gems to tapioca config (different RBI on Mac vs. Linux)
          ruby -r yaml -e '
            CONFIG_FILE = "sorbet/tapioca/config.yml"
            config = YAML.load_file(CONFIG_FILE)
            config["gem"]["exclude"] += ["rack", "amazing_print"]
            config["gem"]["exclude"].sort!.uniq!
            File.write(CONFIG_FILE, config.to_yaml)
          '
          bundle exec tapioca gems --verify
          bundle exec tapioca dsl --verify
          git checkout sorbet/tapioca/config.yml || true

      - name: Check for RBI changes
        run: |
          # Check if there are any uncommitted changes to RBI files
          git status --porcelain sorbet/rbi/
          if [[ -n $(git status --porcelain sorbet/rbi/) ]]; then
            echo "Error: RBI files are out of date. Please run 'tapioca gems' and 'tapioca dsl' and commit the changes."
            git diff sorbet/rbi/
            exit 1
          fi

      - name: RuboCop (Linting/Formatting)
        run: bin/rubocop

      - name: Sorbet (Typecheck)
        run: scripts/typecheck.sh

      - name: jscpd (Duplicate Code Detection)
        run: pnpm exec jscpd .

  audit:
    name: Security Audit
    # The Release workflow waits for this workflow, so a release can't ship a dependency with a known advisory
    runs-on: ubuntu-22.04
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Setup Ruby
        uses: ruby/setup-ruby@651ff0d62c5c79bed6d53ec518387aae20e72c1a # v1.329.0
        with:
          ruby-version: '.ruby-version'
          bundler-cache: true

      - name: Setup Node.js
        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
        with:
          node-version: 22

      - name: Setup pnpm
        uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
        with:
          version: 10.18.3

      - name: Check locked Ruby and docs dependencies for known advisories
        run: scripts/security_audit.sh

  docs:
    name: 'Next.js Site Tests'
    runs-on: ubuntu-22.04
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Setup Ruby
        uses: ruby/setup-ruby@651ff0d62c5c79bed6d53ec518387aae20e72c1a # v1.329.0
        with:
          ruby-version: '.ruby-version'
          bundler-cache: true

      - name: Setup Node.js (docs)
        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
        with:
          node-version: 22

      - name: Setup pnpm
        uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
        with:
          version: 10.18.3

      - name: Enable pnpm cache (docs)
        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
        with:
          node-version: 22
          cache: pnpm
          cache-dependency-path: docs/pnpm-lock.yaml

      - name: Install docs dependencies
        run: cd docs && pnpm install --frozen-lockfile

      - name: Export TypeScript types from LogStruct
        run: |
          scripts/generate_structs.rb

      - name: TypeScript type checking
        run: |
          cd docs && pnpm exec tsc --noEmit

      - name: Run TypeScript tests
        run: |
          cd docs && pnpm test

  docs_build:
    name: 'Next.js Site Build'
    # The production build the deploy runs, with this run's coverage report: tests and type checks pass on
    # pages that fail to prerender
    needs: [pilot]
    runs-on: ubuntu-22.04
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Setup Ruby
        uses: ruby/setup-ruby@651ff0d62c5c79bed6d53ec518387aae20e72c1a # v1.329.0
        with:
          ruby-version: '.ruby-version'
          bundler-cache: true

      - name: Setup pnpm
        uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
        with:
          version: 10.18.3

      - name: Setup Node with the pnpm cache
        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
        with:
          node-version: 22
          cache: pnpm
          cache-dependency-path: docs/pnpm-lock.yaml

      - name: Install docs dependencies
        run: cd docs && pnpm install --frozen-lockfile

      - name: Download this run's coverage report
        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          name: coverage-ruby-rails-latest
          path: docs/public/coverage/

      - name: Generate YARD documentation
        run: bundle exec yard doc --output-dir=docs/public/yard

      - name: Export TypeScript types from LogStruct
        run: scripts/generate_structs.rb

      - name: Build the site
        run: cd docs && pnpm run build

      - name: Install Chromium for the site's browser tests
        run: cd docs && pnpm exec playwright install --with-deps chromium

      - name: Run the site's browser tests
        run: cd docs && pnpm run e2e

  pilot:
    name: 'Pilot Test: Latest Ruby / Rails'
    runs-on: ubuntu-22.04
    env:
      RAILS_VERSION: 'latest'
      RUBY_VERSION: '4.0.1'
      CI: 'true'
      BUNDLE_WITHOUT: 'development'
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      # Remove Gemfile.lock since we're changing Ruby and Rails versions
      - name: Remove Gemfile.lock for variable Ruby/Rails versions
        run: rm -f Gemfile.lock

      - name: Setup Ruby 4.0.1
        uses: ruby/setup-ruby@651ff0d62c5c79bed6d53ec518387aae20e72c1a # v1.329.0
        with:
          ruby-version: '4.0.1'
          bundler-cache: true

      # Coverage: /coverage
      - name: Run tests
        run: bundle exec scripts/test.rb

      # Coverage: /coverage_rails
      - name: Run Rails integration tests
        run: scripts/rails_tests.sh

      - name: Upload raw coverage directories
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        if: success()
        with:
          name: raw-coverage-ruby-rails-latest
          path: |
            coverage
            coverage_rails
          retention-days: 5
          include-hidden-files: true

      # Merges /coverage and /coverage_rails into /docs/public/coverage/
      - name: Merge coverage reports
        run: scripts/merge_coverage.sh

      - name: Enforce coverage threshold (>= 80%)
        run: ruby scripts/check_coverage_threshold.rb

      # Save merged coverage data as an artifact for deploy workflow
      - name: Upload coverage reports
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        if: success()
        with:
          name: coverage-ruby-rails-latest
          path: |
            docs/public/coverage/
          retention-days: 5

  matrix:
    name: 'Tests: ${{ matrix.name }}'
    needs: [lint, pilot]
    runs-on: ubuntu-22.04
    strategy:
      fail-fast: false
      matrix:
        include:
          - name: 'Ruby 3.3 / Rails 7.1'
            ruby: '3.3'
            rails: '7.1.6'

          - name: 'Ruby 3.4 / Rails 7.2'
            ruby: '3.4'
            rails: '7.2.3'

          - name: 'Ruby 3.4 / Rails 8.0'
            ruby: '3.4'
            rails: '8.0.4'

          - name: 'Ruby 4.0 / Rails 8.1'
            ruby: '4.0.1'
            rails: '8.1.2'

          # NOTE: Latest Ruby/Rails is tested in the 'pilot' job above with coverage.

    env:
      RAILS_VERSION: ${{ matrix.rails }}
      RUBY_VERSION: ${{ matrix.ruby }}
      CI: 'true'
      BUNDLE_WITHOUT: 'development'

    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      # Remove Gemfile.lock since we're changing Ruby and Rails versions
      - name: Remove Gemfile.lock for variable Ruby/Rails versions
        run: rm -f Gemfile.lock

      - name: Setup Ruby ${{ matrix.ruby }}
        uses: ruby/setup-ruby@651ff0d62c5c79bed6d53ec518387aae20e72c1a # v1.329.0
        with:
          ruby-version: ${{ matrix.ruby }}
          bundler-cache: true

      - name: Run Ruby tests
        run: scripts/test.rb

      - name: Run Rails integration tests
        run: scripts/rails_tests.sh

  railties_only:
    name: 'Tests: railties without the rest of Rails'
    needs: [lint]
    runs-on: ubuntu-22.04
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Setup Ruby
        uses: ruby/setup-ruby@651ff0d62c5c79bed6d53ec518387aae20e72c1a # v1.329.0
        with:
          ruby-version: '.ruby-version'

      - name: Boot an app that only bundles railties and actionpack
        run: scripts/railties_smoke_test.sh

  deploy_docs:
    name: Deploy the site
    needs: [lint, docs, docs_build, matrix, railties_only]
    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
    permissions:
      contents: read
      actions: read
      pages: write
      id-token: write
    uses: ./.github/workflows/deploy-docs.yml