name: CI

on:
  push:
    branches: [main]
  pull_request:

# A second push to the same branch makes the first run's result irrelevant.
concurrency:
  group: ci-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: read

jobs:
  go:
    name: Go
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-go@v5
        with:
          go-version: "1.26"
          cache: true

      - name: Formatting
        run: |
          unformatted=$(gofmt -l .)
          if [ -n "$unformatted" ]; then
            echo "These files are not gofmt'd:"
            echo "$unformatted"
            exit 1
          fi

      - name: Vet
        run: go vet ./...

      # -race is the whole point of running tests in CI for a server with a
      # WebSocket fan-out: a data race is exactly the bug that passes locally.
      - name: Test
        run: go test -race -count=1 ./...

      - name: Build
        run: CGO_ENABLED=0 go build ./...

  spec:
    name: OpenAPI is valid
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: "22"

      # Structural validity only. That the spec matches the *router* is checked by
      # a Go test, which is the half that actually goes stale.
      - run: npx --yes @redocly/cli@latest lint docs/openapi.yaml

  e2e:
    name: End-to-end
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-go@v5
        with:
          go-version: "1.26"
          cache: true

      - uses: actions/setup-node@v4
        with:
          node-version: "22"
          cache: npm
          cache-dependency-path: web/package-lock.json

      - name: Install
        working-directory: web
        run: npm ci --no-audit --no-fund

      # Chromium for the suite, WebKit for one test.
      #
      # A smoke test exists to catch a build that does not work at all, and running
      # the whole thing in three engines finds the same breakage three times for
      # three times the cost. Focus is the exception, and it took a real report to
      # learn it: Safari ignores `autofocus` on anything inserted after the page has
      # loaded, so every inline form in the app opened with no cursor in it. WebKit
      # here is the same engine Safari is, and `webkit-forms` in the Playwright
      # config greps a single test out of the suite to run in it.
      - name: Install browsers
        working-directory: web
        run: npx playwright install --with-deps chromium webkit

      # The suite builds the frontend, embeds it and starts the real binary — see
      # playwright.config.js. There is nothing to build here first.
      - name: Test
        working-directory: web
        run: npm run test:e2e

      - if: failure()
        uses: actions/upload-artifact@v4
        with:
          name: playwright-report
          path: |
            web/test-results/
            web/playwright-report/
          retention-days: 7

  docker:
    name: Docker image builds
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: docker/setup-buildx-action@v3

      # Build only — publishing happens on a tag, in release.yml. This job exists
      # so a Dockerfile that no longer builds fails on the pull request rather
      # than at release time.
      - uses: docker/build-push-action@v6
        with:
          context: .
          push: false
          cache-from: type=gha
          cache-to: type=gha,mode=max