ci.yml

name: CI

on:
  push:
    branches: [main, dev]
  pull_request:
    branches: [main, dev]

env:
  CARGO_TERM_COLOR: always
  RUST_BACKTRACE: 1

jobs:
  rust:
    name: Rust Check & Test
    runs-on: ubuntu-latest

    services:
      postgres:
        image: postgres:18-alpine
        env:
          POSTGRES_USER: postgres
          POSTGRES_PASSWORD: postgres
          POSTGRES_DB: think_watch_test
        ports:
          - 5432:5432
        options: >-
          --health-cmd pg_isready
          --health-interval 5s
          --health-timeout 5s
          --health-retries 5
      redis:
        image: redis:8-alpine
        ports:
          - 6379:6379
        options: >-
          --health-cmd "redis-cli ping"
          --health-interval 5s
          --health-timeout 5s
          --health-retries 5

    env:
      DATABASE_URL: postgres://postgres:postgres@localhost:5432/think_watch_test
      REDIS_URL: redis://localhost:6379
      JWT_SECRET: ci-test-jwt-secret-not-for-production-use-00
      ENCRYPTION_KEY: 0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef

    steps:
      - uses: actions/checkout@v4

      # The default ubuntu-latest runner ships with ~14GB free, which
      # the workspace compile + 40+ test-binary link step regularly
      # exhausts ("rustc-LLVM ERROR: No space left on device" during
      # test-support linking). Drop preinstalled toolchains we don't
      # use to reclaim ~30GB before cargo touches the disk.
      - name: Reclaim runner disk
        run: |
          sudo rm -rf /usr/share/dotnet /usr/local/lib/android /opt/ghc \
                      /opt/hostedtoolcache/CodeQL /usr/local/.ghcup
          df -h /

      - uses: dtolnay/rust-toolchain@stable
      - uses: Swatinem/rust-cache@v2
      - uses: taiki-e/install-action@v2
        with:
          tool: cargo-nextest

      # No standalone `cargo check` — clippy runs the borrow-checker
      # as a strict superset, so a separate check pass would just
      # rebuild the same artifacts twice.
      - name: Test
        run: cargo nextest run --workspace --lib --bins --tests

      - name: Clippy
        run: cargo clippy --workspace -- -D warnings

      - name: Format check
        run: cargo fmt --all -- --check

  # The ~260 tests in crates/test-support/tests/ are `#[ignore]`d so the
  # unit job (and a plain `cargo test`) skips them: each one boots the
  # whole server against its own Postgres database, Redis logical DB and,
  # when it asks for one, ClickHouse database. A separate job so a red
  # check says which suite broke.
  integration:
    name: Integration Tests
    runs-on: ubuntu-latest
    timeout-minutes: 60

    services:
      postgres:
        image: postgres:18-alpine
        env:
          POSTGRES_USER: postgres
          POSTGRES_PASSWORD: postgres
          POSTGRES_DB: think_watch_test
        ports:
          - 5432:5432
        # Every test creates its own database. With Docker's default
        # 64MB /dev/shm, Postgres fails a few hundred databases in with
        # "could not resize shared memory segment".
        options: >-
          --shm-size=1g
          --health-cmd pg_isready
          --health-interval 5s
          --health-timeout 5s
          --health-retries 10
      redis:
        image: redis:8-alpine
        ports:
          - 6379:6379
        options: >-
          --health-cmd "redis-cli ping"
          --health-interval 5s
          --health-timeout 5s
          --health-retries 10
      clickhouse:
        image: clickhouse/clickhouse-server:26.3-alpine
        env:
          CLICKHOUSE_USER: default
          CLICKHOUSE_PASSWORD: chtest
          # The analytics schema starts with `USE think_watch`.
          CLICKHOUSE_DB: think_watch
          CLICKHOUSE_DEFAULT_ACCESS_MANAGEMENT: 1
        ports:
          - 8123:8123
        options: >-
          --ulimit nofile=262144:262144
          --health-cmd "wget -qO- http://127.0.0.1:8123/ping"
          --health-interval 5s
          --health-timeout 5s
          --health-retries 20

    env:
      TEST_DATABASE_BASE_URL: postgres://postgres:postgres@localhost:5432
      # Base logical DB. nextest runs tests in parallel and the harness
      # moves each running test to DB 1 + its slot, so base + jobs must
      # stay within Redis's 16 DBs.
      TEST_REDIS_URL: redis://localhost:6379/1
      TEST_CLICKHOUSE_URL: http://localhost:8123
      TEST_CLICKHOUSE_USER: default
      TEST_CLICKHOUSE_PASSWORD: chtest

    steps:
      - uses: actions/checkout@v4

      # Same disk pressure as the unit job: the server plus 50-odd test
      # binaries do not fit in the runner's default free space.
      - name: Reclaim runner disk
        run: |
          sudo rm -rf /usr/share/dotnet /usr/local/lib/android /opt/ghc \
                      /opt/hostedtoolcache/CodeQL /usr/local/.ghcup
          df -h /

      - uses: dtolnay/rust-toolchain@stable
      - uses: Swatinem/rust-cache@v2
      - uses: taiki-e/install-action@v2
        with:
          tool: cargo-nextest

      - name: Build tests
        run: cargo nextest run -p think-watch-test-support --run-ignored only --no-run

      - name: Integration tests
        run: cargo nextest run -p think-watch-test-support --run-ignored only --profile ci

  frontend:
    name: Frontend Build
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: web
    steps:
      - uses: actions/checkout@v4
      - uses: pnpm/action-setup@v4
        with:
          # Pinned — matches `packageManager` in web/package.json.
          # Bump together with that field, never alone.
          version: 11.0.0
      - uses: actions/setup-node@v4
        with:
          node-version: 24
          cache: pnpm
          cache-dependency-path: web/pnpm-lock.yaml

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: i18n parity
        run: pnpm check:i18n

      # Added once the tree was clean. It had never been gated, and 127
      # findings — 90 of them errors — had accumulated behind that: a check
      # nobody runs only moves one direction.
      - name: Lint
        run: pnpm lint

      - name: Test
        run: pnpm test

      # `pnpm build` runs `tsc -b && vite build`. `tsc -b` (project
      # references) is stricter than `tsc --noEmit` — it catches
      # unused imports (TS6133) that --noEmit silently accepts — so
      # we rely on the build step for type checking.
      - name: Build
        run: pnpm build

  # ---------------------------------------------------------------------------
  # Docker Server: build each arch natively in parallel, then merge manifest
  # ---------------------------------------------------------------------------
  docker-server-build:
    name: Server Build (${{ matrix.platform }})
    runs-on: ${{ matrix.platform == 'linux/arm64' && 'ubuntu-24.04-arm' || 'ubuntu-latest' }}
    needs: [rust, integration, frontend]
    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
    permissions:
      contents: read
      packages: write
    strategy:
      fail-fast: false
      matrix:
        platform: [linux/amd64, linux/arm64]
    steps:
      - uses: actions/checkout@v4

      - name: Set image prefix
        run: echo "IMAGE_PREFIX=ghcr.io/$(echo '${{ github.repository_owner }}' | tr '[:upper:]' '[:lower:]')" >> $GITHUB_ENV

      - name: Docker meta
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: ${{ env.IMAGE_PREFIX }}/think-watch-server

      - name: Log in to GitHub Container Registry
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Build and push by digest
        id: build
        uses: docker/build-push-action@v6
        with:
          context: .
          file: deploy/docker/Dockerfile.server
          platforms: ${{ matrix.platform }}
          labels: ${{ steps.meta.outputs.labels }}
          outputs: type=image,"name=${{ env.IMAGE_PREFIX }}/think-watch-server",push-by-digest=true,name-canonical=true,push=true
          cache-from: type=gha,scope=server-${{ matrix.platform }}
          cache-to: type=gha,scope=server-${{ matrix.platform }},mode=max

      - name: Export digest
        run: |
          mkdir -p ${{ runner.temp }}/digests
          digest="${{ steps.build.outputs.digest }}"
          touch "${{ runner.temp }}/digests/${digest#sha256:}"

      - name: Upload digest
        uses: actions/upload-artifact@v4
        with:
          name: server-digest-${{ strategy.job-index }}
          path: ${{ runner.temp }}/digests
          if-no-files-found: error
          retention-days: 1

  docker-server-merge:
    name: Server Merge Manifest
    runs-on: ubuntu-latest
    needs: docker-server-build
    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
    permissions:
      contents: read
      packages: write
    steps:
      - name: Set image prefix
        run: echo "IMAGE_PREFIX=ghcr.io/$(echo '${{ github.repository_owner }}' | tr '[:upper:]' '[:lower:]')" >> $GITHUB_ENV

      - name: Download digests
        uses: actions/download-artifact@v4
        with:
          pattern: server-digest-*
          merge-multiple: true
          path: ${{ runner.temp }}/digests

      - name: Log in to GitHub Container Registry
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      # **Tagged by commit SHA only. `:latest` belongs to release.yml.**
      #
      # Both workflows used to push `:latest`, with no concurrency group
      # between them, so a release raced the `main` push that carried it.
      # v1.0.2 lost that race: `think-watch-server:latest` ended up
      # pointing at a main-branch build rather than the tagged release,
      # while `think-watch-web:latest` stayed correct only because this
      # workflow's web job happened to be cancelled mid-run.
      #
      # `:latest` means "the newest stable release", which is a fact only
      # a tag knows. A branch push cannot know it, so it must not claim
      # it. The SHA tag stays — that is how you deploy an unreleased
      # `main` on purpose, and it can never collide with a release tag.
      - name: Create and push multi-arch manifest
        working-directory: ${{ runner.temp }}/digests
        run: |
          IMAGE="${IMAGE_PREFIX}/think-watch-server"
          docker buildx imagetools create \
            -t "${IMAGE}:${{ github.sha }}" \
            $(printf "${IMAGE}@sha256:%s " *)

  # ---------------------------------------------------------------------------
  # Docker Web: static files are arch-independent. Dockerfile.web builds them
  # once on this runner's own platform and copies them into each arch's nginx
  # image, so no build step runs under emulation.
  # ---------------------------------------------------------------------------
  docker-web:
    name: Web Build & Push
    runs-on: ubuntu-latest
    needs: [rust, integration, frontend]
    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
    # A healthy run takes minutes. With no limit, a hung build holds the
    # runner for GitHub's six-hour maximum — which is what happened when
    # Node crashed under QEMU in the old per-arch build and the step never
    # exited.
    timeout-minutes: 20
    permissions:
      contents: read
      packages: write
    steps:
      - uses: actions/checkout@v4

      - name: Set image prefix
        run: echo "IMAGE_PREFIX=ghcr.io/$(echo '${{ github.repository_owner }}' | tr '[:upper:]' '[:lower:]')" >> $GITHUB_ENV

      - name: Log in to GitHub Container Registry
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Set up QEMU
        uses: docker/setup-qemu-action@v3

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Build and push web image
        uses: docker/build-push-action@v6
        with:
          context: .
          file: deploy/docker/Dockerfile.web
          push: true
          platforms: linux/amd64,linux/arm64
          # SHA only — see the note on the server manifest job above.
          # `:latest` is release.yml's to set.
          tags: |
            ${{ env.IMAGE_PREFIX }}/think-watch-web:${{ github.sha }}
          cache-from: type=gha,scope=web
          cache-to: type=gha,scope=web,mode=max