ci.yml

name: CI

on:
  workflow_dispatch:
  push:
    branches:
      - main
      - develop
  pull_request:
  release:
    types: [published]
  merge_group:
    types: [checks_requested]

env:
  REGISTRY: ghcr.io
  IMAGE_NAME_RUNTIME: ${{ github.repository }}/runtime

jobs:
  test:
    name: "Test backpex"
    runs-on: ubuntu-latest
    strategy:
      matrix:
        include:
          - elixir: "1.16"
            otp: "26.2"

          - elixir: "1.17"
            otp: "27.3"

          - elixir: "1.18"
            otp: "28.0"

          - elixir: "1.19"
            otp: "28.1"

    steps:
      - name: Checkout code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - uses: erlef/setup-beam@9d5b75ddfda22fb979d2270283237aef8aa68d6b # v1.22.0
        with:
          otp-version: ${{ matrix.otp }}
          elixir-version: ${{ matrix.elixir }}

      - name: Setup node
        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
        with:
          node-version: 24
          cache: "yarn"
          cache-dependency-path: yarn.lock

      - name: Restore the deps and _build cache
        uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
        id: restore-cache
        env:
          MIX_LOCK_HASH: ${{ hashFiles(format('{0}{1}', github.workspace, '/mix.lock')) }}
        with:
          path: |
            deps
            _build
          key: ${{ runner.os }}-${{ matrix.elixir }}-${{ matrix.otp }}-build-deps-mixlockhash-${{ env.MIX_LOCK_HASH }}
          restore-keys: ${{ runner.os }}-${{ matrix.elixir }}-${{ matrix.otp }}-build-deps-

      - name: Install dependencies
        if: steps.restore-cache.outputs.cache-hit != 'true'
        run: mix deps.get

      - name: Compile dependencies
        if: steps.restore-cache.outputs.cache-hit != 'true'
        run: mix deps.compile

      - name: Compile with warnings as errors
        run: mix compile --warnings-as-errors --force

      - name: Cache node modules
        uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
        id: yarn-cache
        with:
          path: node_modules
          key: ${{ runner.os }}-node-24-yarn-${{ hashFiles('yarn.lock') }}
          restore-keys: |
            ${{ runner.os }}-node-24-yarn-

      - name: Install node dependencies
        if: steps.yarn-cache.outputs.cache-hit != 'true'
        run: yarn install --pure-lockfile

      - name: Check formatting
        run: mix format --check-formatted

      - name: JavaScript Standard
        run: yarn run lint:standard

      - name: Build docs with warnings as errors
        run: mix docs --warnings-as-errors

      - name: Credo
        run: mix credo

      - name: Sobelow
        run: mix sobelow --config

      - name: Deps Unused
        run: mix deps.unlock --check-unused

      - name: Run tests
        run: mix test

      - name: Run doc tests
        run: mix test test/doc_test.exs

      - name: Deps Audit
        continue-on-error: true
        run: mix deps.audit

      - name: Gettext Check
        run: mix gettext.extract --check-up-to-date

      - name: Check assets up-to-date
        run: mix assets.check

  publish:
    needs: [test, test-demo]
    if: github.event_name == 'release'
    name: "Publish package on hex.pm"
    runs-on: ubuntu-latest

    steps:
      - name: Checkout code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - uses: erlef/setup-beam@9d5b75ddfda22fb979d2270283237aef8aa68d6b # v1.22.0
        id: beam
        with:
          version-file: .tool-versions
          version-type: strict

      - name: Install dependencies
        run: |
          mix local.hex --force --if-missing
          mix local.rebar --force --if-missing
          mix deps.get

      - name: Publish package on hex.pm
        env:
          HEX_API_KEY: ${{ secrets.HEX_API_KEY }}
        run: mix hex.publish --yes

  test-demo:
    name: "Test (Demo)"
    runs-on: ubuntu-latest

    services:
      postgres:
        image: postgres:16.13@sha256:2586e2a95d1c9b31cb2967feb562948f7d364854453d703039b6efa45fe48417
        env:
          POSTGRES_PASSWORD: postgres
        options: >-
          --health-cmd pg_isready
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5
        ports:
          - "5432:5432"

    steps:
      - name: Checkout code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Setup beam
        uses: erlef/setup-beam@9d5b75ddfda22fb979d2270283237aef8aa68d6b # v1.22.0
        id: beam
        with:
          version-file: .tool-versions
          version-type: strict

      - name: Setup node
        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
        with:
          node-version: 24
          cache: "yarn"
          cache-dependency-path: demo/yarn.lock

      - name: Restore the deps and _build cache
        uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
        id: restore-cache
        env:
          OTP_VERSION: ${{ steps.beam.outputs.otp-version }}
          ELIXIR_VERSION: ${{ steps.beam.outputs.elixir-version }}
          MIX_LOCK_HASH: ${{ hashFiles(format('{0}{1}', github.workspace, '/demo/mix.lock')) }}
        with:
          path: |
            demo/deps
            demo/_build
          key: ${{ runner.os }}-${{ env.ELIXIR_VERSION }}-${{ env.OTP_VERSION }}-build-deps-demo-mixlockhash-${{ env.MIX_LOCK_HASH }}
          restore-keys: ${{ runner.os }}-${{ env.ELIXIR_VERSION }}-${{ env.OTP_VERSION }}-build-deps-demo-

      - name: Install dependencies
        if: steps.restore-cache.outputs.cache-hit != 'true'
        working-directory: demo
        run: mix deps.get

      - name: Compile dependencies
        if: steps.restore-cache.outputs.cache-hit != 'true'
        working-directory: demo
        run: mix deps.compile

      - name: Compile with warnings as errors
        working-directory: demo
        run: mix compile --warnings-as-errors --force

      - name: Cache node modules
        uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
        id: yarn-cache
        with:
          path: demo/node_modules
          key: ${{ runner.os }}-node-24-yarn-demo-${{ hashFiles('demo/yarn.lock') }}
          restore-keys: |
            ${{ runner.os }}-node-24-yarn-demo-

      - name: Install node dependencies
        if: steps.yarn-cache.outputs.cache-hit != 'true'
        working-directory: demo
        run: yarn install --pure-lockfile

      - name: Cache Backpex node modules
        uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
        id: yarn-cache-backpex
        with:
          path: node_modules
          key: ${{ runner.os }}-node-24-yarn-backpex-${{ hashFiles('yarn.lock') }}
          restore-keys: |
            ${{ runner.os }}-node-24-yarn-backpex-

      - name: Install Backpex node dependencies
        if: steps.yarn-cache-backpex.outputs.cache-hit != 'true'
        run: yarn install --pure-lockfile

      - name: Setup assets
        working-directory: demo
        run: mix assets.setup

      - name: Build assets
        working-directory: demo
        run: mix assets.build

      - name: lint:mix
        working-directory: demo
        run: yarn lint:mix

      - name: lint:credo
        working-directory: demo
        run: yarn lint:credo

      - name: lint:sobelow
        working-directory: demo
        run: yarn lint:sobelow

      - name: lint:style
        working-directory: demo
        run: yarn lint:style

      - name: lint:standard
        working-directory: demo
        run: yarn lint:standard

      - name: lint:deps-unused
        working-directory: demo
        run: yarn lint:deps-unused

      - name: lint:gettext
        working-directory: demo
        run: yarn lint:gettext

      - name: Deps audit
        working-directory: demo
        continue-on-error: true
        run: mix deps.audit

      - name: Run test
        working-directory: demo
        env:
          DB_HOSTNAME: localhost
          DB_USERNAME: postgres
          DB_PASSWORD: postgres
          DB_DATABASE: test
        run: yarn test

      - name: Cache Playwright browsers
        uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
        id: playwright-cache
        with:
          path: ~/.cache/ms-playwright
          key: ${{ runner.os }}-playwright-${{ hashFiles('demo/yarn.lock') }}
          restore-keys: |
            ${{ runner.os }}-playwright-

      - name: Install playwright
        if: steps.playwright-cache.outputs.cache-hit != 'true'
        working-directory: demo
        run: yarn playwright install chromium --with-deps --only-shell

      - name: Run playwright test
        working-directory: demo
        env:
          DB_HOSTNAME: localhost
          DB_USERNAME: postgres
          DB_PASSWORD: postgres
          DB_DATABASE: test
        run: yarn test:playwright || if [[ $? = 2 ]]; then PW_TRACE=true yarn test:playwright --max-cases 1 --failed; else false; fi

      - name: Upload Playwright traces
        if: failure()
        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
        with:
          name: playwright-traces
          path: tmp/
          retention-days: 7

  build-runtime:
    name: "Build and push image (Demo)"
    runs-on: ubuntu-latest
    needs: [test, test-demo]
    env:
      PUSH_IMAGE: ${{ github.event_name == 'push' && (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/develop') }}

    permissions:
      contents: read
      packages: write

    steps:
      - name: Checkout code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0

      - name: Log in to the container registry
        if: env.PUSH_IMAGE == 'true'
        uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4.0.0
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Extract metadata (tags, labels) for Docker
        id: meta
        uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6.0.0
        with:
          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME_RUNTIME }}

      - name: Build container
        uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294 # v7.0.0
        with:
          push: ${{ env.PUSH_IMAGE }}
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          cache-from: type=registry,ref=${{ env.REGISTRY }}/${{ env.IMAGE_NAME_RUNTIME }}:buildcache
          cache-to: ${{ env.PUSH_IMAGE == 'true' && format('type=registry,ref={0}/{1}:buildcache,mode=max', env.REGISTRY, env.IMAGE_NAME_RUNTIME) || '' }}
          target: runtime
          build-args: |
            MIX_ENV=prod