js.yml

# JavaScript/TypeScript CI — builds NAPI-RS bindings and runs tests
# Triggered on PRs and pushes to main when JS-related files change.

name: JS

on:
  push:
    branches: [main]
    paths:
      - "crates/bashkit-js/**"
      - "crates/bashkit/src/**"
      - "examples/*.mjs"
      - "examples/package.json"
      - "Cargo.toml"
      - "Cargo.lock"
      - ".github/workflows/js.yml"
  pull_request:
    branches: [main]
    paths:
      - "crates/bashkit-js/**"
      - "crates/bashkit/src/**"
      - "examples/*.mjs"
      - "examples/package.json"
      - "Cargo.toml"
      - "Cargo.lock"
      - ".github/workflows/js.yml"
  workflow_dispatch:

permissions:
  contents: read

env:
  CARGO_TERM_COLOR: always

jobs:
  typecheck:
    name: TypeScript type-check
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@e081816240890017053eacbb1bdf337761dc5582 # 1.95.0

      - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2

      - name: Setup pnpm
        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6
        with:
          version: 10.33.0

      - name: Setup Node.js
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
        with:
          node-version: "22"
          cache: pnpm
          cache-dependency-path: crates/bashkit-js/pnpm-lock.yaml

      - name: Install dependencies
        run: pnpm install --frozen-lockfile
        working-directory: crates/bashkit-js

      - name: Build native binding (generates type declarations)
        run: pnpm run build
        working-directory: crates/bashkit-js

      - name: Type-check (including tests)
        run: pnpm exec tsc --noEmit -p tsconfig.check.json
        working-directory: crates/bashkit-js

  build-and-test:
    name: ${{ matrix.runtime }} ${{ matrix.version }}
    runs-on: ubuntu-latest

    strategy:
      fail-fast: false
      matrix:
        include:
          # Node.js versions
          - runtime: node
            version: "20"
            run: "node"
          - runtime: node
            version: "22"
            run: "node"
          - runtime: node
            version: "24"
            run: "node"
          - runtime: node
            version: "latest"
            run: "node"
          # Bun
          - runtime: bun
            version: "latest"
            run: "bun"
          - runtime: bun
            version: "canary"
            run: "bun"
          # Deno
          - runtime: deno
            version: "2.x"
            run: "deno run -A"
          - runtime: deno
            version: "canary"
            run: "deno run -A"

    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@e081816240890017053eacbb1bdf337761dc5582 # 1.95.0

      - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2

      - name: Setup pnpm
        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6
        with:
          version: 10.33.0

      - name: Setup Node.js
        if: matrix.runtime == 'node'
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
        with:
          node-version: ${{ matrix.version }}
          cache: pnpm
          cache-dependency-path: |
            crates/bashkit-js/pnpm-lock.yaml
            examples/pnpm-lock.yaml

      - name: Setup Node.js (for napi build)
        if: matrix.runtime != 'node'
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
        with:
          node-version: "22"
          cache: pnpm
          cache-dependency-path: |
            crates/bashkit-js/pnpm-lock.yaml
            examples/pnpm-lock.yaml

      - name: Setup Bun
        if: matrix.runtime == 'bun'
        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
        with:
          bun-version: ${{ matrix.version }}

      - name: Setup Deno
        if: matrix.runtime == 'deno'
        uses: denoland/setup-deno@22d081ff2d3a40755e97629de92e3bcbfa7cf2ed # v2
        with:
          deno-version: ${{ matrix.version }}

      - name: Install dependencies
        run: pnpm install --frozen-lockfile
        working-directory: crates/bashkit-js

      - name: Build native binding
        run: pnpm run build
        working-directory: crates/bashkit-js

      - name: Run ava tests (Node only)
        if: matrix.runtime == 'node'
        run: pnpm test
        working-directory: crates/bashkit-js

      - name: Run native filesystem interop fixture test (Node only)
        if: matrix.runtime == 'node'
        run: pnpm run test:interop
        working-directory: crates/bashkit-js

      - name: Run runtime-compat tests (Node)
        if: matrix.runtime == 'node'
        run: node --test __test__/runtime-compat/*.test.mjs
        working-directory: crates/bashkit-js

      - name: Run runtime-compat tests (Bun)
        if: matrix.runtime == 'bun'
        run: bun test __test__/runtime-compat/
        working-directory: crates/bashkit-js

      - name: Run runtime-compat tests (Deno)
        if: matrix.runtime == 'deno'
        run: |
          for f in __test__/runtime-compat/*.test.mjs; do
            echo "--- $f ---"
            deno run -A "$f"
          done
        working-directory: crates/bashkit-js

      - name: Install example dependencies and link local build
        working-directory: examples
        run: |
          pnpm install --frozen-lockfile
          rm -rf node_modules/@everruns/bashkit
          mkdir -p node_modules/@everruns
          ln -s ${{ github.workspace }}/crates/bashkit-js node_modules/@everruns/bashkit

      - name: Run examples (self-contained)
        working-directory: examples
        run: |
          ${{ matrix.run }} bash_basics.mjs
          ${{ matrix.run }} data_pipeline.mjs
          ${{ matrix.run }} llm_tool.mjs
          ${{ matrix.run }} k8s_orchestrator.mjs
          ${{ matrix.run }} langchain_integration.mjs
          ${{ matrix.run }} custom_builtins.mjs

      - name: Detect Doppler availability
        id: doppler
        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
        run: echo "available=${{ secrets.DOPPLER_TOKEN != '' }}" >> "$GITHUB_OUTPUT"

      - name: Install Doppler CLI
        if: steps.doppler.outputs.available == 'true'
        uses: dopplerhq/cli-action@4819d808ab99e5cde19a0637a16536a4038fad73 # v4
        env:
          DOPPLER_TOKEN: ${{ secrets.DOPPLER_TOKEN }}

      # `--only-secrets OPENAI_API_KEY` keeps the runtime env scoped to
      # just the key these scripts need, instead of injecting every
      # secret in the Doppler config. DOPPLER_TOKEN stays scoped to this
      # trusted secret-fetch step, not npm install/build/test/example code.
      - name: Run AI examples
        if: steps.doppler.outputs.available == 'true'
        working-directory: examples
        env:
          DOPPLER_TOKEN: ${{ secrets.DOPPLER_TOKEN }}
        run: |
          doppler run --only-secrets OPENAI_API_KEY -- ${{ matrix.run }} openai_tool.mjs
          doppler run --only-secrets OPENAI_API_KEY -- ${{ matrix.run }} vercel_ai_tool.mjs
          doppler run --only-secrets OPENAI_API_KEY -- ${{ matrix.run }} langchain_agent.mjs

  # Gate job for branch protection
  js-check:
    name: JS Check
    if: always()
    needs: [typecheck, build-and-test]
    runs-on: ubuntu-latest
    steps:
      - name: Verify all jobs passed
        run: |
          if [[ "${{ needs.typecheck.result }}" != "success" ]]; then
            echo "TypeScript type-check failed"
            exit 1
          fi
          if [[ "${{ needs.build-and-test.result }}" != "success" ]]; then
            echo "JS build/test failed"
            exit 1
          fi