ruby.yml

name: CI

concurrency:
  group: ci-${{ github.ref }}
  cancel-in-progress: true

on:
  pull_request:
    branches: [ master ]
  workflow_dispatch:

jobs:
  rubocop:
    name: 'RuboCop'
    runs-on: ubuntu-latest
    steps:
    - name: Checkout code
      uses: actions/checkout@v7

    - name: Set up Ruby
      uses: ruby/setup-ruby@v1
      with:
        bundler-cache: true

    - name: Run RuboCop
      run: bundle exec rubocop

  assets-precompile:
    name: 'Assets Precompile'
    runs-on: ubuntu-latest
    env:
      RAILS_ENV: production
      # The task boots the app but never connects to a database; the URL only
      # needs to resolve to a configured adapter. Initializers run at boot read
      # PLANNER_SECRET (config/initializers/secret_token.rb) and AWS
      # credentials (config/initializers/carrier_wave.rb); nothing connects to
      # S3 during precompile, so fake values are enough.
      DATABASE_URL: postgres://u:p@localhost:5432/planner_placeholder
      PLANNER_SECRET: fake
      AWS_ACCESS_KEY: fake
      AWS_SECRET_ACCESS_KEY: fake
    steps:
    - name: Checkout code
      uses: actions/checkout@v7

    - name: Set up Ruby
      uses: ruby/setup-ruby@v1
      with:
        bundler-cache: true

    - name: Precompile assets
      run: bundle exec rake assets:precompile

  test:
    name: 'Tests (Group ${{ matrix.ci_node_index }})'
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        ci_node_total: [6]
        ci_node_index: [0, 1, 2, 3, 4, 5]

    env:
      # prevent unnecessary log output -- https://bundler.io/man/bundle-config.1.html
      BUNDLE_IGNORE_FUNDING_REQUESTS: true
      BUNDLE_IGNORE_MESSAGES: true
      RAILS_ENV: test
      COVERAGE: true
      PARALLEL_TEST_PROCESSORS: ${{ matrix.ci_node_total }}
    services:
      postgres:
        image: postgres:17
        ports: ["5432:5432"]
        env:
          POSTGRES_PASSWORD: postgres
        options: >-
          --health-cmd pg_isready
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5

    steps:
    - name: Checkout code
      uses: actions/checkout@v7

    - name: Set up Ruby
      uses: ruby/setup-ruby@v1
      with:
        # .ruby-version provides the Ruby version implicitly.
        bundler-cache: true

    - name: Resolve Playwright version from gem
      id: pw-version
      run: echo "version=$(bundle exec ruby -rplaywright -e 'print Playwright::COMPATIBLE_PLAYWRIGHT_VERSION')" >> $GITHUB_OUTPUT

    - name: Cache npx packages
      uses: actions/cache@v6
      id: npx-cache
      with:
        path: ~/.npm
        # npx downloads the playwright npm package (~30MB) fresh every time without
        # this cache. The key includes the Playwright version so a bump invalidates it.
        key: npx-playwright-${{ runner.os }}-${{ steps.pw-version.outputs.version }}

    - name: Cache Playwright browsers
      uses: actions/cache@v6
      id: playwright-cache
      with:
        path: ~/.cache/ms-playwright
        # All groups use the same key — the binary is identical across parallel runners.
        # Without this, each group writes its own cache entry for the same ~150MB blob
        # (6× storage, 6× uploads for no benefit).
        key: playwright-${{ runner.os }}-chromium-headless-shell-${{ steps.pw-version.outputs.version }}

    - name: Install Playwright Chromium Headless Shell
      if: steps.playwright-cache.outputs.cache-hit != 'true'
      run: npx --yes playwright@${{ steps.pw-version.outputs.version }} install chromium-headless-shell

    - name: Verify Playwright binary (cache restore)
      if: steps.playwright-cache.outputs.cache-hit == 'true'
      run: |
        # Quick validation that the cached binary is intact.
        # Falls through to a full install if the expected path is missing.
        ls ~/.cache/ms-playwright/chromium-headless-shell-*/chrome-linux/chrome > /dev/null 2>&1 || \
          npx --yes playwright@${{ steps.pw-version.outputs.version }} install chromium-headless-shell

    # Playwright install-deps is intentionally skipped: ubuntu-24.04 ships all required
    # system libraries. install-deps would only add 9 font packages (CJK + X11, ~21MB)
    # that are not needed for headless-shell rendering in CI. If a Playwright version
    # introduces a new system library dependency, re-add:
    #   run: npx --yes playwright@${{ steps.pw-version.outputs.version }} install-deps chromium-headless-shell
    - name: Setup test databases
      env:
        DATABASE_URL: postgres://postgres:postgres@localhost:5432
      run: |
        bundle exec rake parallel:setup

    - name: Run tests in parallel
      env:
        DATABASE_URL: postgres://postgres:postgres@localhost:5432
        CI_NODE_INDEX: ${{ matrix.ci_node_index }}
        RAILS_ENV: test
        PLAYWRIGHT_HEADLESS: true    
      run: |
        bundle exec parallel_rspec spec/ \
          -n ${{ matrix.ci_node_total }} \
          --only-group $((${{ matrix.ci_node_index }} + 1))

    - name: Preserve coverage results
      run: |
        # Copy resultset immediately after tests complete to prevent deletion
        cp coverage/.resultset.json coverage/resultset-${{ matrix.ci_node_index }}.json

    - name: Upload coverage artifacts
      uses: actions/upload-artifact@v7
      with:
        name: coverage-${{ matrix.ci_node_index }}
        path: coverage/resultset-${{ matrix.ci_node_index }}.json
        retention-days: 1

  security-audit:
    name: 'Security Audit'
    runs-on: ubuntu-latest
    steps:
    - name: Checkout code
      uses: actions/checkout@v7

    - name: Set up Ruby
      uses: ruby/setup-ruby@v1
      with:
        bundler-cache: true

    - name: Run bundler-audit
      run: bundle exec bundler-audit check

  coverage:
    name: 'Report Coverage'
    runs-on: ubuntu-latest
    needs: test
    steps:
    - name: Checkout code
      uses: actions/checkout@v7

    - name: Set up Ruby
      uses: ruby/setup-ruby@v1
      with:
        bundler-cache: true

    - name: Download all coverage artifacts
      uses: actions/download-artifact@v8
      with:
        path: coverage-results

    - name: Merge coverage results
      run: |
        mkdir -p coverage
        bundle exec ruby -e '
          require "json"
          require "simplecov"

          resultsets = {}
          Dir["coverage-results/coverage-*/resultset-*.json"].each do |file|
            data = JSON.parse(File.read(file))
            resultsets.merge!(data)
          end

          File.write("coverage/.resultset.json", JSON.generate(resultsets))
        '

    - name: Report to Coveralls
      continue-on-error: true
      uses: coverallsapp/github-action@v2
      with:
        github-token: ${{ secrets.github_token }}