household-bot/.github/workflows/ci.yml

name: CI

on:
  push:
    branches:
      - main
  pull_request:
    branches:
      - main

permissions:
  contents: read

concurrency:
  group: ci-${{ github.ref }}
  cancel-in-progress: true

jobs:
  quality:
    name: Quality / ${{ matrix.task }}
    runs-on: ubuntu-latest
    timeout-minutes: 20
    strategy:
      fail-fast: false
      matrix:
        task:
          - format
          - lint
          - typecheck
          - test
          - build
          - db-check
          - db-migrations
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup Bun
        uses: oven-sh/setup-bun@v2
        with:
          bun-version-file: .bun-version

      - name: Restore Bun cache
        uses: actions/cache@v4
        with:
          path: |
            ~/.bun/install/cache
            node_modules
          key: ${{ runner.os }}-bun-${{ hashFiles('bun.lock') }}
          restore-keys: |
            ${{ runner.os }}-bun-

      - name: Install dependencies
        run: bun install --frozen-lockfile

      - name: Run quality gate
        run: |
          case "${{ matrix.task }}" in
            format)      bun run format:check ;;
            lint)        bun run lint ;;
            typecheck)   bun run typecheck ;;
            test)        bun run test ;;
            build)       bun run build ;;
            db-check)    bun run db:check ;;
            db-migrations) bun run db:migrations:check ;;
            *) echo "Unknown task: ${{ matrix.task }}"; exit 1 ;;
          esac

  terraform:
    name: Terraform / validate
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup Terraform
        uses: hashicorp/setup-terraform@v3
        with:
          terraform_version: 1.8.5

      - name: Terraform format check
        run: terraform -chdir=infra/terraform fmt -check -recursive

      - name: Terraform validate
        run: |
          terraform -chdir=infra/terraform init -backend=false
          terraform -chdir=infra/terraform validate

  images-pr:
    name: Docker / build (PR)
    if: github.event_name == 'pull_request'
    runs-on: ubuntu-latest
    timeout-minutes: 20
    strategy:
      fail-fast: false
      matrix:
        service:
          - bot
          - miniapp
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Build only
        uses: docker/build-push-action@v6
        with:
          context: .
          file: apps/${{ matrix.service }}/Dockerfile
          push: false
          tags: household-${{ matrix.service }}:ci
          platforms: linux/amd64
          provenance: false
          cache-from: type=gha
          cache-to: type=gha,mode=max

  # Gate job: CD triggers on this workflow's conclusion.
  # By depending on all jobs, a failure in any job marks CI as failed,
  # which causes CD's `workflow_run` trigger to see conclusion != 'success'
  # and skip deployment.
  ci:
    name: CI complete
    runs-on: ubuntu-latest
    needs: [quality, terraform, images-pr]
    if: always()
    steps:
      - name: Check all jobs passed
        run: |
          results='${{ toJSON(needs) }}'
          echo "Job results: $results"

          failed=false
          for result in $(echo "$results" | jq -r '.[].result'); do
            # 'skipped' is expected — images-pr skips on push
            if [[ "$result" != "success" && "$result" != "skipped" ]]; then
              echo "Job failed with result: $result"
              failed=true
            fi
          done

          if [[ "$failed" == "true" ]]; then
            echo "One or more CI jobs failed — blocking deployment."
            exit 1
          fi

          echo "All CI jobs passed."