ci.yml

name: ci

on:
  push:
  pull_request:
    branches: [main]

jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - uses: actions/setup-node@v7
        with:
          node-version: '22'
          cache: npm
      # package-lock v3 records esbuild's platform packages as optional; npm ci
      # installs only the Linux binary on this runner while keeping the complete
      # dependency graph reproducible across local, CI, and release builds.
      - run: npm ci --no-audit --no-fund
      - name: Test (vitest + coverage gate)
        run: npm test
      - name: Build single-file SPA
        run: npm run build
      - uses: actions/upload-artifact@v7
        with:
          name: sql-browser-dist
          path: dist/sql.html
          retention-days: 14

  # Bundle-size report (#275): measure the self-contained artifact on every PR and
  # upload it as an artifact — raw/gzip/Brotli, per-module + per-package attribution,
  # and deltas vs. the PR base when a base report can be produced. Reporting only:
  # it builds the same bytes as the release, never a budget that fails the build.
  size:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
        with:
          # Full history so the PR base commit is present for the base report below.
          fetch-depth: 0
      - uses: actions/setup-node@v7
        with:
          node-version: '22'
          cache: npm
      - run: npm ci --no-audit --no-fund
      # Base report: check the PR base commit out into a worktree and run *its*
      # size-report. Fully tolerant — the base predates this tooling on the first
      # PR, so a failure here just means "no deltas", never a failed job.
      - name: Base report (PR only, best-effort)
        if: github.event_name == 'pull_request'
        continue-on-error: true
        run: |
          set +e
          base='${{ github.event.pull_request.base.sha }}'
          git worktree add /tmp/base-tree "$base" || exit 0
          ( cd /tmp/base-tree \
            && npm ci --no-audit --no-fund \
            && npm run size-report -- --out /tmp/base-report ) || exit 0
          cp /tmp/base-report/bundle-size-report.json base-report.json 2>/dev/null || true
      - name: Size report
        run: |
          set -euo pipefail
          if [ -f base-report.json ]; then
            npm run size-report -- --base base-report.json
          else
            echo "No base report available — emitting current report without deltas."
            npm run size-report
          fi
      - uses: actions/upload-artifact@v7
        with:
          name: bundle-size-report
          path: |
            bundle-report/bundle-size-report.json
            bundle-report/bundle-size-report.md
            bundle-report/esbuild-meta.json
          retention-days: 14

  # Release-bundle smoke test: assemble the curl|sh artifact, extract it, and boot
  # the zero-dep Python runner exactly as an end user would — proving the bundle
  # layout, the SPA-path discovery, and config.json generation all work before a
  # tag ever cuts a real release.
  bundle:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - uses: actions/setup-node@v7
        with:
          node-version: '22'
          cache: npm
      - run: npm ci --no-audit --no-fund
      - name: Build release bundle
        run: build/bundle.sh
      - name: Extract + boot the runner (as a user would)
        run: |
          set -euo pipefail
          tmp=$(mktemp -d)
          tar -C "$tmp" -xzf dist/altinity-sql-browser.tar.gz --strip-components=1
          for f in sql.html local.py sql-browser.xml run.sh VERSION; do
            test -f "$tmp/$f" || { echo "missing $f in bundle" >&2; exit 1; }
          done
          python3 -c "import ast,sys; ast.parse(open(sys.argv[1]).read())" "$tmp/local.py"
          # No LOCAL_CH_CONFIG: the runner discovers the bundled sql-browser.xml
          # next to local.py, proving the merge/discovery path end to end.
          # SQL_BROWSER_PROBE=0: don't depend on reaching external demo hosts from CI.
          SQL_BROWSER_PROBE=0 PORT=8901 "$tmp/run.sh" &
          pid=$!
          for i in $(seq 1 20); do curl -fsS "http://localhost:8901/sql" >/dev/null 2>&1 && break; sleep 0.5; done
          curl -fsS "http://localhost:8901/sql" >/dev/null
          curl -fsS "http://localhost:8901/config.json" \
            | python3 -c "import sys,json; assert json.load(sys.stdin)['hosts'], 'no hosts parsed'"
          kill "$pid"
      - name: Lint the installer (shellcheck)
        run: |
          sudo apt-get update -qq && sudo apt-get install -y -qq shellcheck
          shellcheck install.sh build/bundle.sh

  # Real-browser regression tests (Playwright). Runs on Linux runners where the
  # Gecko/Chromium binaries launch normally — separate from the unit suite so a
  # missing browser binary can't mask a unit failure, and vice versa. The
  # harness imports /src directly over a python http.server (started by the
  # Playwright config's webServer), so no build step is needed.
  e2e:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - uses: actions/setup-node@v7
        with:
          node-version: '22'
          cache: npm
      - run: npm ci --no-audit --no-fund
      - name: Install Playwright browsers
        run: npx playwright install --with-deps chromium firefox webkit
      - name: E2E (Playwright — Chromium + Firefox + WebKit)
        run: npm run test:e2e
      - uses: actions/upload-artifact@v7
        if: ${{ failure() }}
        with:
          name: playwright-results
          path: test-results/
          retention-days: 14