ci.yml

name: CI

on:
  pull_request:
  push:
    branches: [main]

permissions:
  contents: read

concurrency:
  group: ci-${{ github.ref }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

jobs:
  test:
    name: Typecheck and test (Node ${{ matrix.node }})
    runs-on: ubuntu-latest
    timeout-minutes: 15
    strategy:
      fail-fast: false
      matrix:
        # Both majors package.json's engines field claims to support.
        node: [20, 22]

    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-node@v4
        with:
          node-version: ${{ matrix.node }}
          cache: npm

      # The optional audio deps (mic, speaker) only matter for `npm run call`;
      # npm tolerates their native build failing on a headless runner.
      - run: npm ci

      - run: npm run build

      - run: npm test

  actionlint:
    name: Lint workflows (actionlint)
    runs-on: ubuntu-latest
    timeout-minutes: 5
    env:
      # Pinned version and the sha256 published with that release, so the
      # linter can't change underneath us. shellcheck (preinstalled on the
      # runner) lints the bash in every `run:` step too.
      ACTIONLINT_VERSION: 1.7.12
      ACTIONLINT_SHA256: 8aca8db96f1b94770f1b0d72b6dddcb1ebb8123cb3712530b08cc387b349a3d8

    steps:
      - uses: actions/checkout@v4

      - name: Install actionlint
        run: |
          set -euo pipefail
          tarball="actionlint_${ACTIONLINT_VERSION}_linux_amd64.tar.gz"
          curl -fsSL -o "$tarball" \
            "https://github.com/rhysd/actionlint/releases/download/v${ACTIONLINT_VERSION}/${tarball}"
          echo "${ACTIONLINT_SHA256}  ${tarball}" | sha256sum --check --strict
          tar -xzf "$tarball" actionlint

      - name: Lint workflows
        run: ./actionlint -color

  validate:
    name: Validate resources
    runs-on: ubuntu-latest
    timeout-minutes: 10

    steps:
      - uses: actions/checkout@v4
        with:
          persist-credentials: false

      - uses: actions/setup-node@v4
        with:
          node-version: 22
          cache: npm

      # Install scripts only build the optional audio deps for `npm run call`.
      - run: npm ci --ignore-scripts

      # The same validator `apply` runs before every deploy, here before merge:
      # a config that `apply` would refuse never reaches main, where it would
      # block deploys and promotion until someone noticed. Every org is
      # validated, including resources no PR check targets.
      #
      # `validate` makes no network call, but loading the engine's config
      # needs a key to be set. The placeholder below is never sent anywhere
      # (the base URL is unroutable, so an accidental API call fails here),
      # and no secret is available to this job, so it runs the same on forks.
      # `.ts` resources run without `.env.<org>` here, unlike under `apply`.
      - name: Validate every org
        shell: bash
        env:
          VAPI_PRIVATE_API_KEY: validate-only-never-sent
          VAPI_BASE_URL: http://127.0.0.1:9
        run: |
          set -euo pipefail
          shopt -s nullglob
          orgs=()
          for dir in resources/*/; do
            orgs+=("$(basename "$dir")")
          done
          if (( ${#orgs[@]} == 0 )); then
            echo "No org folders under resources/; nothing to validate."
            exit 0
          fi
          failed=()
          for org in "${orgs[@]}"; do
            echo "::group::Validate ${org}"
            if ! node --import tsx src/validate-cmd.ts "$org"; then
              failed+=("$org")
            fi
            echo "::endgroup::"
          done
          if (( ${#failed[@]} > 0 )); then
            echo "::error::Validation failed for: ${failed[*]}. Each org's findings are in its log group above. To reproduce locally without that org's key: VAPI_PRIVATE_API_KEY=validate-only npm run validate -- <org>"
            exit 1
          fi
          echo "Validated ${#orgs[@]} org(s): ${orgs[*]}"