ci.yml

name: CI

# Security: Do not replace `pull_request` with `pull_request_target` to expose secrets or
# GITHUB_TOKEN write access to PR code. pull_request_target runs untrusted fork PR code with
# base-branch privileges.

on:
  push:
    branches:
      - main
  pull_request:
    types:
      - opened
      - synchronize
      - reopened

concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}

env:
  TZ: UTC
  CI: true
  OC_ENV: ci
  NODE_ENV: test
  AWS_KEY: user
  AWS_SECRET: password
  AWS_S3_BUCKET: opencollective-e2e
  AWS_S3_REGION: us-east-1
  AWS_S3_API_VERSION: latest
  AWS_S3_ENDPOINT: http://localhost:9000
  AWS_S3_SSL_ENABLED: false
  AWS_S3_FORCE_PATH_STYLE: true

jobs:
  lint:
    runs-on: ubuntu-26.04
    timeout-minutes: 15

    steps:
      - name: Checkout
        uses: actions/checkout@v7

      - name: Setup project
        uses: ./.github/actions/setup-project
        with:
          CACHE_VERSION: ${{ secrets.CACHE_VERSION }}

      - name: Restore ESLint cache
        uses: actions/cache@v6
        with:
          path: .eslintcache
          key: ${{ runner.os }}-${{ secrets.CACHE_VERSION }}-eslint-${{ hashFiles('eslint.config.mjs', 'package-lock.json') }}-${{ github.sha }}
          restore-keys: |
            ${{ runner.os }}-${{ secrets.CACHE_VERSION }}-eslint-${{ hashFiles('eslint.config.mjs', 'package-lock.json') }}-

      - run: npm run lint:check

  prettier:
    runs-on: ubuntu-26.04
    timeout-minutes: 15

    steps:
      - name: Checkout
        uses: actions/checkout@v7

      - name: Setup project
        uses: ./.github/actions/setup-project
        with:
          CACHE_VERSION: ${{ secrets.CACHE_VERSION }}

      - name: Restore Prettier cache
        uses: actions/cache@v6
        with:
          path: .prettiercache
          key: ${{ runner.os }}-${{ secrets.CACHE_VERSION }}-prettier-${{ hashFiles('.prettierrc', 'package-lock.json') }}-${{ github.sha }}
          restore-keys: |
            ${{ runner.os }}-${{ secrets.CACHE_VERSION }}-prettier-${{ hashFiles('.prettierrc', 'package-lock.json') }}-

      - run: npm run prettier:check

  typescript:
    runs-on: ubuntu-26.04
    timeout-minutes: 15

    steps:
      - name: Checkout
        uses: actions/checkout@v7

      - name: Setup project
        uses: ./.github/actions/setup-project
        with:
          CACHE_VERSION: ${{ secrets.CACHE_VERSION }}

      - name: Restore TypeScript incremental cache
        uses: actions/cache@v6
        with:
          path: tsconfig.tsbuildinfo
          # Exact commit only: restoring tsbuildinfo from another SHA corrupts incremental state and can crash tsc (stack overflow on TS 6).
          key: ${{ runner.os }}-${{ secrets.CACHE_VERSION }}-tsc-${{ hashFiles('tsconfig.json', 'package-lock.json') }}-${{ github.sha }}

      - run: npm run type:check

  depcheck:
    runs-on: ubuntu-26.04
    timeout-minutes: 15

    steps:
      - name: Checkout
        uses: actions/checkout@v7

      - name: Setup project
        uses: ./.github/actions/setup-project
        with:
          CACHE_VERSION: ${{ secrets.CACHE_VERSION }}

      - run: npm run depcheck

  ts-unused-exports:
    runs-on: ubuntu-26.04
    timeout-minutes: 15

    steps:
      - name: Checkout
        uses: actions/checkout@v7

      - name: Setup project
        uses: ./.github/actions/setup-project
        with:
          CACHE_VERSION: ${{ secrets.CACHE_VERSION }}

      - name: Check unused exports
        run: npm run ts-unused-exports

  build:
    runs-on: ubuntu-26.04
    timeout-minutes: 15

    steps:
      - name: Checkout
        uses: actions/checkout@v7

      - name: Setup project
        uses: ./.github/actions/setup-project
        with:
          CACHE_VERSION: ${{ secrets.CACHE_VERSION }}

      - name: Build
        run: npm run build

  test:
    runs-on: ubuntu-26.04
    timeout-minutes: 30
    env:
      PG_DATABASE: opencollective_test
    services:
      redis:
        image: valkey/valkey:9.1
        ports:
          - 6379:6379
      postgres:
        image: postgres:16.15
        env:
          POSTGRES_USER: postgres
          POSTGRES_DB: postgres
          POSTGRES_HOST_AUTH_METHOD: trust
        ports:
          - 5432:5432
        options: --health-cmd pg_isready --health-interval 2s --health-timeout 5s --health-retries 5
      rustfs:
        image: rustfs/rustfs:1.0.0-rc.6@sha256:97171b3d72cd47dc81000f92ea84de25608bfc35a94c965501afaeb5d99f6035
        ports:
          - 9000:9000
        options: --name=rustfs --health-cmd "curl -f http://localhost:9000/health/ready"
        env:
          RUSTFS_ACCESS_KEY: user
          RUSTFS_SECRET_KEY: password

    steps:
      - name: Checkout
        uses: actions/checkout@v7

      - name: Setup project
        uses: ./.github/actions/setup-project
        with:
          CACHE_VERSION: ${{ secrets.CACHE_VERSION }}

      # The ubuntu-26.04 image ships PostgreSQL 18 client tools, whose pg_restore emits
      # `SET transaction_timeout` that the PostgreSQL 16 service rejects. Run them from the postgres:16 image.
      - run: npm run db:restore:test
        env:
          USE_DOCKER: true

      - name: Test
        if: github.event_name != 'push' || github.ref != 'refs/heads/main'
        run: npm run test:ci -- --ignore "test/server/graphql/**"

      - name: Test with coverage
        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
        run: npm run test:coverage -- --ignore "test/server/graphql/**"

      - name: Report coverage
        if: ${{ !cancelled() && github.event_name == 'push' && github.ref == 'refs/heads/main' }}
        uses: codecov/codecov-action@303a32d7a59b442fa8d48b6a1cc6825c09c847a5 # v7
        with:
          token: ${{ secrets.CODECOV_TOKEN }}
          flags: Unit

      - name: Upload test results to Codecov
        if: ${{ !cancelled() }}
        uses: codecov/codecov-action@303a32d7a59b442fa8d48b6a1cc6825c09c847a5 # v7
        with:
          token: ${{ secrets.CODECOV_TOKEN }}
          flags: Unit
          files: test-results.xml
          report_type: test_results

  test-graphql:
    runs-on: ubuntu-26.04
    timeout-minutes: 30

    env:
      PG_DATABASE: opencollective_test

    services:
      redis:
        image: valkey/valkey:9.1
        ports:
          - 6379:6379
      postgres:
        image: postgres:16.15
        env:
          POSTGRES_USER: postgres
          POSTGRES_DB: postgres
          POSTGRES_HOST_AUTH_METHOD: trust
        ports:
          - 5432:5432
        options: --health-cmd pg_isready --health-interval 2s --health-timeout 5s --health-retries 5
      opensearch:
        image: opensearchproject/opensearch:3
        ports:
          - 9200:9200
        env:
          discovery.type: single-node
          DISABLE_INSTALL_DEMO_CONFIG: 'true'
          DISABLE_SECURITY_PLUGIN: 'true'
        options: >-
          --health-cmd="curl --silent --fail http://localhost:9200/_cluster/health || exit 1"
          --health-interval=10s
          --health-timeout=15s
          --health-retries=30
      rustfs:
        image: rustfs/rustfs:1.0.0-rc.6@sha256:97171b3d72cd47dc81000f92ea84de25608bfc35a94c965501afaeb5d99f6035
        ports:
          - 9000:9000
        options: --name=rustfs --health-cmd "curl -f http://localhost:9000/health/ready"
        env:
          RUSTFS_ACCESS_KEY: user
          RUSTFS_SECRET_KEY: password
    steps:
      - name: Checkout
        uses: actions/checkout@v7

      - name: Setup project
        uses: ./.github/actions/setup-project
        with:
          CACHE_VERSION: ${{ secrets.CACHE_VERSION }}

      # The ubuntu-26.04 image ships PostgreSQL 18 client tools, whose pg_restore emits
      # `SET transaction_timeout` that the PostgreSQL 16 service rejects. Run them from the postgres:16 image.
      - run: npm run db:restore:test
        env:
          USE_DOCKER: true

      - name: Test
        if: github.event_name != 'push' || github.ref != 'refs/heads/main'
        run: npm run test:ci test/server/graphql

      - name: Test with coverage
        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
        run: npm run test:coverage test/server/graphql

      - name: Report coverage
        if: ${{ !cancelled() && github.event_name == 'push' && github.ref == 'refs/heads/main' }}
        uses: codecov/codecov-action@303a32d7a59b442fa8d48b6a1cc6825c09c847a5 # v7
        with:
          token: ${{ secrets.CODECOV_TOKEN }}
          flags: GraphQL

      - name: Upload test results to Codecov
        if: ${{ !cancelled() }}
        uses: codecov/codecov-action@303a32d7a59b442fa8d48b6a1cc6825c09c847a5 # v7
        with:
          token: ${{ secrets.CODECOV_TOKEN }}
          files: test-results.xml
          report_type: test_results

  schema-update:
    runs-on: ubuntu-26.04
    timeout-minutes: 30

    services:
      redis:
        image: valkey/valkey:9.1
        ports:
          - 6379:6379
      postgres:
        image: postgres:16.15
        env:
          POSTGRES_USER: postgres
          POSTGRES_DB: postgres
          POSTGRES_HOST_AUTH_METHOD: trust
        ports:
          - 5432:5432
        options: --health-cmd pg_isready --health-interval 2s --health-timeout 5s --health-retries 5

    steps:
      - name: Checkout
        uses: actions/checkout@v7

      - name: Setup project
        uses: ./.github/actions/setup-project
        with:
          CACHE_VERSION: ${{ secrets.CACHE_VERSION }}

      - name: Generate & check schemas
        run: ./scripts/check-schemas.sh

  graphql-inspector:
    name: GraphQL Inspector
    runs-on: ubuntu-26.04
    # The action publishes its results as check runs (with annotations) and reads PR labels for the
    # approve-label override. Workflows triggered by Dependabot get a read-only GITHUB_TOKEN by
    # default, so the write scope must be requested explicitly. This job never installs or runs
    # code from the PR (it only diffs the committed schema files), so the token is only ever
    # handled by the SHA-pinned action below.
    permissions:
      contents: read
      checks: write
      pull-requests: read
    steps:
      - name: Checkout
        uses: actions/checkout@v7

      - name: GraphQL Inspector (V1)
        uses: graphql-hive/graphql-inspector@c0ecb19ad21de709b80ed897041a4976c079c718 # v4.0.0
        with:
          name: 'GraphQL Inspector - Schema v1'
          github-token: ${{ secrets.GITHUB_TOKEN }}
          schema: 'main:server/graphql/schemaV1.graphql'
          fail-on-breaking: false

      - name: GraphQL Inspector (V2)
        uses: graphql-hive/graphql-inspector@c0ecb19ad21de709b80ed897041a4976c079c718 # v4.0.0
        with:
          name: 'GraphQL Inspector - Schema v2'
          github-token: ${{ secrets.GITHUB_TOKEN }}
          schema: 'main:server/graphql/schemaV2.graphql'
          fail-on-breaking: false