name: CI

permissions:
  contents: read

on:
  push:
    # dev as well as main so every dev HEAD carries the full CI signal that
    # the dev->main promotion gate (check-dev-green.sh) reads. PR checks alone are
    # not enough: an admin-merge can land a red PR onto dev.
    branches: ["main", "dev"]
  pull_request:
  workflow_dispatch:

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  lint:
    name: Lint
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
      - name: Install dependencies
        run: uv sync --locked --extra dev
      - name: Run lint
        run: make lint

  format:
    name: Format check
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
      - name: Install dependencies
        run: uv sync --locked --extra dev
      - name: Run format check
        run: make format-check

  unit-tests:
    name: Unit tests
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
      - name: Install dependencies
        run: uv sync --locked --extra dev
      - name: Run unit tests
        run: make test

  e2e:
    name: Playwright E2E
    runs-on: ubuntu-latest
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@v7
      - uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
      - uses: actions/setup-node@v4
        with:
          node-version: 22
      - uses: oven-sh/setup-bun@v2
      - name: Install Python deps (langgraph dev runtime)
        run: uv sync --locked
      - name: Install Playwright + Chromium
        working-directory: tests/e2e
        run: |
          npm ci
          npx playwright install --with-deps chromium
      # Playwright's webServer boots `langgraph dev`; globalSetup builds the real
      # ui/ SPA. The fake LLM/GitHub/Slack boundaries need no secrets.
      - name: Run E2E
        working-directory: tests/e2e
        # Playwright's globalSetup runs the real `bun run build`, whose vite bundle
        # exceeds Node's default ~2 GB heap (same OOM fixed in build-artifacts.yml).
        # The runner has ~16 GB, so lift the heap cap.
        env:
          NODE_OPTIONS: "--max-old-space-size=8192"
        run: npx playwright test
      - name: Upload Playwright report
        if: ${{ !cancelled() }}
        uses: actions/upload-artifact@v4
        with:
          name: playwright-report
          path: |
            tests/e2e/playwright-report
            tests/e2e/test-results
          retention-days: 7