ci.yml

# ─────────────────────────────────────────────────────────────────────────────
# FILE: initialstate/.github/.github/workflows/ci.yml
#
# Reusable CI workflow for SvelteKit + CDK repos.
# Callers: `.github/workflows/ci.yml` in any initialstate repo.
# ─────────────────────────────────────────────────────────────────────────────
name: CI (reusable)

on:
  workflow_call:
    inputs:
      node-version:
        description: 'Node.js version to use'
        type: string
        default: '20'
      aws-account-id:
        description: 'AWS account ID (for CDK diff OIDC role)'
        type: string
        required: true
      aws-region:
        description: 'AWS region'
        type: string
        default: 'us-east-1'
      app-name:
        description: 'Application name (e.g. bruce-svelte) used to construct role name'
        type: string
        required: true
      diff-environment:
        description: 'CDK environment to diff on PRs'
        type: string
        default: 'dev'
      run-cdk-diff:
        description: 'Run CDK diff on PRs and post as comment'
        type: boolean
        default: true
      strict-checks:
        description: 'If false, type-check and build failures do not fail the workflow. Intended for repos with in-progress code migrations where CI should report but not block.'
        type: boolean
        default: true

jobs:
  # ── Type check ────────────────────────────────────────────────────────────
  type-check:
    name: Type Check
    runs-on: ubuntu-latest
    continue-on-error: ${{ !inputs.strict-checks }}
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-node@v4
        with:
          node-version: ${{ inputs.node-version }}
          cache: 'npm'

      - name: Debug — diagnose npm ci
        run: |
          echo "::group::tooling"
          which npm node
          npm --version
          node --version
          echo "::endgroup::"
          echo "::group::pwd + ref"
          pwd
          echo "GITHUB_WORKSPACE=$GITHUB_WORKSPACE"
          git rev-parse HEAD
          echo "::endgroup::"
          echo "::group::root listing"
          ls -la
          echo "::endgroup::"
          echo "::group::lockfile check"
          if [ -f package-lock.json ]; then
            echo "FOUND package-lock.json ($(wc -c < package-lock.json) bytes)"
            echo "stat:"
            stat package-lock.json
            echo "first 10 lines:"
            head -10 package-lock.json
            echo "lockfileVersion grep:"
            grep -n '"lockfileVersion"' package-lock.json | head -3
          else
            echo "MISSING package-lock.json"
          fi
          echo "::endgroup::"
          echo "::group::npm config (top)"
          npm config ls -l 2>&1 | head -60
          echo "::endgroup::"
          echo "::group::npm-related env"
          env | grep -iE '^(npm_|node_)' || echo "(no npm/node env vars)"
          echo "::endgroup::"
          echo "::group::npm ci --dry-run -d (capture verbose error)"
          npm ci --dry-run -d 2>&1 | tail -120 || true
          echo "::endgroup::"

      - name: Install dependencies
        run: npm ci

      - name: Svelte type check
        run: npm run check

  # ── Build ─────────────────────────────────────────────────────────────────
  build:
    name: Build
    runs-on: ubuntu-latest
    continue-on-error: ${{ !inputs.strict-checks }}
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-node@v4
        with:
          node-version: ${{ inputs.node-version }}
          cache: 'npm'

      - name: Debug — runner state before npm ci
        run: |
          echo "::group::pwd + ref"
          pwd
          git rev-parse HEAD
          echo "::endgroup::"
          echo "::group::root listing"
          ls -la
          echo "::endgroup::"
          echo "::group::lockfile check"
          if [ -f package-lock.json ]; then
            echo "FOUND package-lock.json ($(wc -c < package-lock.json) bytes)"
            head -5 package-lock.json
          else
            echo "MISSING package-lock.json"
          fi
          echo "::endgroup::"

      - name: Install dependencies
        run: npm ci

      - name: Build
        run: npm run build

  # ── Lint (optional — activate once eslint is configured) ─────────────────
  lint:
    name: Lint
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-node@v4
        with:
          node-version: ${{ inputs.node-version }}
          cache: 'npm'

      - name: Debug — runner state before npm ci
        run: |
          echo "::group::pwd + ref"
          pwd
          git rev-parse HEAD
          echo "::endgroup::"
          echo "::group::root listing"
          ls -la
          echo "::endgroup::"
          echo "::group::lockfile check"
          if [ -f package-lock.json ]; then
            echo "FOUND package-lock.json ($(wc -c < package-lock.json) bytes)"
            head -5 package-lock.json
          else
            echo "MISSING package-lock.json"
          fi
          echo "::endgroup::"

      - name: Install dependencies
        run: npm ci

      - name: Lint
        # Replace with `npm run lint` once an eslint config is added to the repo
        run: |
          if [ -f ".eslintrc*" ] || [ -f "eslint.config*" ]; then
            npm run lint
          else
            echo "No eslint config found — skipping lint (add eslint to unlock this check)"
          fi

  # ── Test (optional — activate once vitest is configured) ─────────────────
  test:
    name: Test
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-node@v4
        with:
          node-version: ${{ inputs.node-version }}
          cache: 'npm'

      - name: Debug — runner state before npm ci
        run: |
          echo "::group::pwd + ref"
          pwd
          git rev-parse HEAD
          echo "::endgroup::"
          echo "::group::root listing"
          ls -la
          echo "::endgroup::"
          echo "::group::lockfile check"
          if [ -f package-lock.json ]; then
            echo "FOUND package-lock.json ($(wc -c < package-lock.json) bytes)"
            head -5 package-lock.json
          else
            echo "MISSING package-lock.json"
          fi
          echo "::endgroup::"

      - name: Install dependencies
        run: npm ci

      - name: Run tests
        # --if-present is a no-op exit-0 when the script doesn't exist.
        # Add `npm run test` (vitest etc.) to unlock this check.
        run: npm run test --if-present

  # ── CDK Diff (PR only) ────────────────────────────────────────────────────
  cdk-diff:
    name: CDK Diff (${{ inputs.diff-environment }})
    runs-on: ubuntu-latest
    continue-on-error: ${{ !inputs.strict-checks }}
    if: ${{ github.event_name == 'pull_request' && inputs.run-cdk-diff }}
    permissions:
      id-token: write    # Required for OIDC
      contents: read
      pull-requests: write  # Required to post PR comment
    environment: ${{ inputs.diff-environment }}
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-node@v4
        with:
          node-version: ${{ inputs.node-version }}
          cache: 'npm'

      - name: Configure AWS credentials (OIDC)
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: arn:aws:iam::${{ inputs.aws-account-id }}:role/${{ inputs.app-name }}-${{ inputs.diff-environment }}-deployer
          aws-region: ${{ inputs.aws-region }}

      - name: Debug — runner state before npm ci
        run: |
          echo "::group::pwd + ref"
          pwd
          git rev-parse HEAD
          echo "::endgroup::"
          echo "::group::root listing"
          ls -la
          echo "::endgroup::"
          echo "::group::infra listing"
          ls -la infra || echo "(no infra dir)"
          echo "::endgroup::"
          echo "::group::lockfile check"
          for f in package-lock.json infra/package-lock.json; do
            if [ -f "$f" ]; then
              echo "FOUND $f ($(wc -c < "$f") bytes)"
            else
              echo "MISSING $f"
            fi
          done
          echo "::endgroup::"

      - name: Install app dependencies
        run: npm ci

      - name: Install infra dependencies
        working-directory: infra
        run: npm ci

      - name: CDK Diff
        id: diff
        working-directory: infra
        # Capture output even if diff exits non-zero (it does when there are changes)
        run: |
          set +e
          DIFF_OUTPUT=$(ENVIRONMENT=${{ inputs.diff-environment }} npm run app:diff 2>&1)
          EXIT_CODE=$?
          echo "diff_output<<EOF" >> "$GITHUB_OUTPUT"
          echo "$DIFF_OUTPUT" >> "$GITHUB_OUTPUT"
          echo "EOF" >> "$GITHUB_OUTPUT"
          echo "has_changes=$( [ $EXIT_CODE -ne 0 ] && echo 'true' || echo 'false' )" >> "$GITHUB_OUTPUT"

      - name: Post CDK diff comment
        uses: actions/github-script@v7
        # Pass data via env so script content is static — avoids JS parser
        # errors when diff output contains `${...}` (CloudFormation tokens).
        env:
          DIFF_OUTPUT: ${{ steps.diff.outputs.diff_output }}
          HAS_CHANGES: ${{ steps.diff.outputs.has_changes }}
          DIFF_ENV: ${{ inputs.diff-environment }}
        with:
          script: |
            const diff = process.env.DIFF_OUTPUT || '';
            const hasChanges = process.env.HAS_CHANGES === 'true';
            const env = process.env.DIFF_ENV;
            const icon = hasChanges ? '⚠️' : '✅';
            const body = [
              `## ${icon} CDK Diff — \`${env}\``,
              '',
              '```',
              diff.slice(0, 60000), // GitHub comment limit guard
              '```',
              '',
              hasChanges
                ? '_Infrastructure changes detected. Review before merging._'
                : '_No infrastructure changes._',
            ].join('\n');

            // Update existing comment if present, otherwise create
            const { data: comments } = await github.rest.issues.listComments({
              owner: context.repo.owner,
              repo: context.repo.repo,
              issue_number: context.issue.number,
            });
            const existingComment = comments.find(c =>
              c.user?.type === 'Bot' && c.body?.startsWith('## ') && c.body.includes('CDK Diff')
            );

            if (existingComment) {
              await github.rest.issues.updateComment({
                owner: context.repo.owner,
                repo: context.repo.repo,
                comment_id: existingComment.id,
                body,
              });
            } else {
              await github.rest.issues.createComment({
                owner: context.repo.owner,
                repo: context.repo.repo,
                issue_number: context.issue.number,
                body,
              });
            }