ci.yml

name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
  workflow_dispatch:

jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - uses: oven-sh/setup-bun@v2
      - run: bun install --frozen-lockfile

      # `postinstall` already ran the hermetic generate during `bun install`, so there is
      # nothing to re-run here. The committed codegen is asserted after `bun run build`
      # below, which is the step that formats generator output into its canonical form.
      - run: bun run check
      - name: No stray backticks inside css`` templates
        run: bun run scripts/check-css-backticks.ts
      - name: Brand-rule grep
        run: bun run scripts/brand-grep.ts
      - run: bun run typecheck
      - run: bun run build
      - run: bun run test
      - name: Bundle-size budget (gzip full + per-component, raw widgets.js)
        run: bun run size:check

      # Every manifest slug must have a committed 1200x800 light + dark preview
      # composite, no orphans. Reads assets/previews only (no build/server), so
      # it lives here and in lefthook pre-push, never in build/catalog:sync.
      - name: Preview coverage (every slug has 1200x800 light + dark webp)
        run: bun run check:previews

      # The TRACKED generator outputs must reproduce from the committed spec. Asserted after
      # `bun run build`, because build is what normalises generator output into the committed
      # (tab-indented) form; asserting straight after `generate` would fail on indentation alone.
      # `packages/ui/src/types` is deliberately NOT listed: it is gitignored, so a git diff on it
      # is always empty and asserting it only produced false confidence.
      - name: Codegen drift (bindings and catalog reproduce from the committed spec)
        run: |
          git diff --exit-code -- specs/openapi.json packages/ui/src/generated packages/ui/components-catalog.json \
            || { echo "::error::Generated bindings or catalog are stale. Run 'bun run build' locally and commit."; exit 1; }

      # packages/ui-{react,vue}/src is GENERATED from packages/ui. A diff here
      # means generated output was hand-edited; the next build would revert it.
      - name: Wrapper drift (React and Vue wrappers must regenerate identically)
        run: |
          git diff --exit-code -- packages/ui-react/src packages/ui-vue/src \
            || { echo "::error::packages/ui-{react,vue}/src is generated from packages/ui. Change manifest.ts or scripts/wrapper-meta.ts and rerun 'bun run build'."; exit 1; }
      - name: Provision Playwright browsers from MCR image (bypass cdn.playwright.dev)
        # cdn.playwright.dev browser-binary downloads stall from GitHub runners.
        # Pull the exact matching browsers from the official Playwright image on
        # Microsoft Container Registry, then copy them into the default browser
        # cache. install-deps is apt-only (no CDN download). Keep the image tag
        # in lockstep with @playwright/test in package.json (currently 1.61.1).
        run: |
          bunx playwright install-deps chromium
          docker create --name pwbrowsers mcr.microsoft.com/playwright:v1.61.1-noble
          mkdir -p "$HOME/.cache/ms-playwright"
          docker cp pwbrowsers:/ms-playwright/. "$HOME/.cache/ms-playwright/"
          docker rm pwbrowsers
          ls -1 "$HOME/.cache/ms-playwright"
      - run: bun run test:e2e
        env:
          PLAYWRIGHT_PROJECTS: chromium

      - name: UI audit (no [object Object], no empty-state drift)
        run: |
          bun run preview &
          PREVIEW_PID=$!
          for i in $(seq 1 30); do
            curl -sf http://localhost:3001 > /dev/null && break
            sleep 1
          done
          bun run audit
          AUDIT_EXIT=$?
          kill $PREVIEW_PID 2>/dev/null || true
          exit $AUDIT_EXIT