name: ci

on:
  push:
    branches: [main]
  pull_request:

jobs:
  go:
    runs-on: ubuntu-latest
    services:
      postgres:
        image: postgres:16-alpine
        env:
          POSTGRES_USER: artex
          POSTGRES_PASSWORD: testpass
          POSTGRES_DB: artextest
        ports:
          - 5432:5432
        options: >-
          --health-cmd "pg_isready -U artex"
          --health-interval 5s
          --health-timeout 5s
          --health-retries 10
    env:
      ARTEX_PG_DSN: postgres://artex:testpass@localhost:5432/artextest?sslmode=disable
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-go@v5
        with:
          go-version-file: go.mod
      - run: go build ./...
      - run: go vet ./...
      # Skipped tests, tracked in issue #9:
      # - TestGraphOverviewExpandsAssociatedCompanyScope,
      #   TestCaptureApprovalLifecycle: fail on unmodified upstream code with a
      #   fresh database.
      # - TestSideUsageRecordedOnceOnConsumerCancellation: concurrency/cancellation
      #   test that passes locally but is timing-sensitive on 2-core CI runners.
      # They now skip themselves in code (t.Skip with a pointer to the issue).
      - name: go test
        # -p 1: package test suites share the single postgres service; running
        # them in parallel makes packages delete each other's rows (observed
        # as rotating failures in the agent package). Serial package execution
        # keeps the database state deterministic.
        run: go test -p 1 ./...
      - name: go test -race
        # Race detector on the packages that pass under -race today. ./server is
        # left out until it has been checked with -race against postgres.
        # Its own database: the plain run above leaves rows behind and the db tests
        # are not idempotent across runs (duplicate llm_profiles names).
        env:
          ARTEX_PG_DSN: postgres://artex:testpass@localhost:5432/artextest_race?sslmode=disable

        run: >-
          go test -race -p 1 ./agent ./cmd/artex ./config ./db ./evidence ./guard
          ./intercept ./llmpool ./llmrec ./mcphttp ./notify ./sidequestion ./traffic

  shell:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      # shellcheck is preinstalled on the ubuntu runners. -S warning: the scripts
      # currently have only info-level notes (intentional A && B || C chains in
      # update.sh, an unquoted glob in backup.sh's prune), so fail on warnings.
      - run: shellcheck -S warning install.sh update.sh start.sh scripts/backup.sh reset-password.sh scripts/extract-changelog-section.sh scripts/test-extract-changelog-section.sh
      - run: bash scripts/test-extract-changelog-section.sh

  web:
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: web
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: "22"
          cache: npm
          cache-dependency-path: web/package-lock.json
      - run: npm ci
      - run: npx tsc --noEmit
      - run: npm run build:static