trails/.forgejo/workflows/ci.yml

name: CI
# Ported from .github/workflows/ci.yml for Forgejo Actions.
# Differences from the GitHub version:
#   - no `merge_group` trigger (Forgejo has no merge queue)
#   - gitleaks action referenced by full GitHub URL (custom action, not on
#     the Forgejo actions mirror)
#   - the visual-diff PR comment posts via the Forgejo API instead of `gh`
# The `ci/forgejo-actions` push branch is temporary (lets this branch re-run
# CI pre-merge); drop it once merged to main.
on:
  push:
    branches: [main, ci/forgejo-actions]
  pull_request:
    branches: [main]

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  security:
    name: Security Scan
    runs-on: ubuntu-latest
    permissions:
      contents: read
      pull-requests: read
    steps:
      - uses: actions/checkout@v7
        with:
          fetch-depth: 0
      - name: Gitleaks
        if: github.actor != 'dependabot[bot]'
        uses: https://github.com/trails-cool/gitleaks-action@4cbc857b9cfa2a3297fe2be1078e196d30d1b424
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          GITLEAKS_LICENSE: ${{ secrets.GITLEAKS_LICENSE }}
          # The action's SARIF artifact upload uses @actions/artifact v2, which
          # throws GHESNotSupportedError against Forgejo. The scan itself works;
          # disable the upload so a clean scan doesn't fail the job.
          GITLEAKS_ENABLE_UPLOAD_ARTIFACT: "false"
      - uses: pnpm/action-setup@v6
      - uses: actions/setup-node@v6
        with:
          node-version: 24
          cache: pnpm
      - run: pnpm install --frozen-lockfile
      - name: Dependency audit
        run: pnpm audit --audit-level=high
        continue-on-error: true

  dockerfile-check:
    name: Dockerfile Package Check
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - run: bash scripts/check-dockerfiles.sh

  openspec:
    name: OpenSpec Validate
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - uses: pnpm/action-setup@v6
      - uses: actions/setup-node@v6
        with:
          node-version: 24
          cache: pnpm
      - run: pnpm install --frozen-lockfile
      - run: pnpm openspec validate --all --strict --no-interactive

  typecheck:
    name: Typecheck
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - uses: pnpm/action-setup@v6
      - uses: actions/setup-node@v6
        with:
          node-version: 24
          cache: pnpm
      - run: pnpm install --frozen-lockfile
      - run: pnpm typecheck

  lint:
    name: Lint
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - uses: pnpm/action-setup@v6
      - uses: actions/setup-node@v6
        with:
          node-version: 24
          cache: pnpm
      - run: pnpm install --frozen-lockfile
      - run: pnpm lint

  test:
    name: Unit Tests
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - uses: pnpm/action-setup@v6
      - uses: actions/setup-node@v6
        with:
          node-version: 24
          cache: pnpm
      - run: pnpm install --frozen-lockfile
      - run: pnpm test

  build:
    name: Build
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - uses: pnpm/action-setup@v6
      - uses: actions/setup-node@v6
        with:
          node-version: 24
          cache: pnpm
      - run: pnpm install --frozen-lockfile
      - run: pnpm build

  visual-tests:
    name: Visual Tests
    runs-on: ubuntu-latest
    permissions:
      contents: read
      pull-requests: write
    steps:
      - uses: actions/checkout@v7
      - uses: pnpm/action-setup@v6
      - uses: actions/setup-node@v6
        with:
          node-version: 24
          cache: pnpm
      - run: pnpm install --frozen-lockfile

      - name: Cache Playwright browsers
        id: playwright-cache
        uses: actions/cache@v6
        with:
          path: ~/.cache/ms-playwright
          key: playwright-${{ hashFiles('pnpm-lock.yaml') }}

      - name: Install Playwright Chromium
        if: steps.playwright-cache.outputs.cache-hit != 'true'
        run: pnpm exec playwright install --with-deps chromium

      - name: Install Playwright deps only
        if: steps.playwright-cache.outputs.cache-hit == 'true'
        run: pnpm exec playwright install-deps chromium

      - name: Run visual regression tests
        id: visual-tests
        run: pnpm --filter @trails-cool/planner test:visual

      - name: Post diff comment on PR
        if: failure() && steps.visual-tests.outcome == 'failure' && github.event_name == 'pull_request'
        env:
          TOKEN: ${{ github.token }}
        run: |
          diffs=$(find apps/planner/.vitest-attachments -name "*-diff-*.png" 2>/dev/null | sort)
          if [ -z "$diffs" ]; then exit 0; fi

          artifact_url="${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}"
          body="## Visual regression failures"$'\n\n'
          body+="The following tests produced screenshot diffs:"$'\n\n'
          for diff in $diffs; do
            name=$(basename "$diff" | sed 's/-diff-chromium-[a-z]*\.png//' | sed 's/-/ /g')
            body+="- \`$name\`"$'\n'
          done
          body+=$'\n'"**[Download the \`visual-snapshots-diff\` artifact]($artifact_url)** to inspect the diffs locally."$'\n\n'
          body+="To update snapshots if the change is intentional:"$'\n'
          body+="\`\`\`"$'\n'
          body+="pnpm --filter @trails-cool/planner test:visual:update"$'\n'
          body+="\`\`\`"

          # Forgejo API (GitHub-compatible issues/comments endpoint).
          curl -sf -X POST \
            -H "Authorization: token $TOKEN" \
            -H "Content-Type: application/json" \
            "${{ github.api_url }}/repos/${{ github.repository }}/issues/${{ github.event.pull_request.number }}/comments" \
            -d "$(jq -n --arg b "$body" '{body:$b}')" || true

      - name: Upload screenshots on failure
        if: failure()
        uses: https://code.forgejo.org/forgejo/upload-artifact@v4
        with:
          name: visual-snapshots-diff
          path: apps/planner/.vitest-attachments/
          include-hidden-files: true
          retention-days: 7

  e2e:
    name: E2E Tests
    needs: build
    runs-on: ubuntu-latest
    env:
      # Services run on the DinD daemon; from the job container their published
      # ports are reachable at host.docker.internal (not localhost).
      DATABASE_URL: postgres://trails:trails@host.docker.internal:5432/trails
      DOCKER_HOST: tcp://host.docker.internal:2375
    steps:
      - uses: actions/checkout@v7
      - uses: pnpm/action-setup@v6
      - uses: actions/setup-node@v6
        with:
          node-version: 24
          cache: pnpm
      - run: pnpm install --frozen-lockfile

      - name: Seed BRouter segment volume
        # Download the segment directly into the compose volume via a DinD
        # container — a job-side download + bind mount would not be visible to
        # the DinD daemon (separate filesystem). Project name pinned to `trails`
        # so the volume matches docker-compose.dev.yml's `brouter_segments`.
        # Verify the download is non-empty (brouter.de can be flaky) so a bad
        # segment fails here rather than as a mysterious routing timeout later.
        run: |
          docker volume create trails_brouter_segments
          docker run --rm -v trails_brouter_segments:/dst alpine sh -c '
            set -e
            for a in 1 2 3; do
              wget -q https://brouter.de/brouter/segments4/E10_N50.rd5 -O /dst/E10_N50.rd5 && break
              echo "segment download attempt $a failed; retrying"; sleep 5
            done
            test -s /dst/E10_N50.rd5
            chmod a+r /dst/*.rd5
            ls -la /dst'

      - name: Start services
        run: docker compose -p trails -f docker-compose.dev.yml up -d --wait --build postgres brouter
        env:
          BROUTER_URL: http://host.docker.internal:17777

      - name: Wait for BRouter routing
        run: |
          for i in $(seq 1 120); do
            curl -s 'http://host.docker.internal:17777/brouter?lonlats=13.4,52.5|13.5,52.5&profile=trekking&format=geojson' 2>/dev/null | grep -q "FeatureCollection" && echo "BRouter ready" && break
            [ "$i" = "120" ] && echo "BRouter not ready after 240s" && exit 1
            sleep 2
          done

      - name: Push database schema
        # Pipe through cat so drizzle-kit prints plain output (no TTY spinner
        # that hides the real error) and we see any failure.
        run: pnpm db:push 2>&1 | cat

      - name: Seed database
        run: pnpm db:seed

      - name: Run integration tests
        run: pnpm --filter @trails-cool/journal exec vitest run --no-file-parallelism --reporter=default app/lib/explore.integration.test.ts app/lib/follow.integration.test.ts app/lib/demo-bot.integration.test.ts app/lib/notifications.integration.test.ts app/jobs/notifications-fanout.integration.test.ts
        env:
          EXPLORE_INTEGRATION: "1"
          FOLLOW_INTEGRATION: "1"
          DEMO_BOT_INTEGRATION: "1"
          NOTIFICATIONS_INTEGRATION: "1"

      - name: Cache Playwright browsers
        id: playwright-cache
        uses: actions/cache@v6
        with:
          path: ~/.cache/ms-playwright
          key: playwright-${{ hashFiles('pnpm-lock.yaml') }}

      - name: Install Playwright
        if: steps.playwright-cache.outputs.cache-hit != 'true'
        run: pnpm exec playwright install --with-deps chromium

      - name: Install Playwright deps only
        if: steps.playwright-cache.outputs.cache-hit == 'true'
        run: pnpm exec playwright install-deps chromium

      - name: Build for production
        run: pnpm build
        env:
          VITE_SENTRY_ENVIRONMENT: ci

      - name: Run E2E tests
        run: pnpm test:e2e
        env:
          BROUTER_URL: http://host.docker.internal:17777
          E2E: "true"
          INTEGRATION_SECRET: ${{ secrets.INTEGRATION_SECRET }}

      - name: Playwright job summary
        if: ${{ !cancelled() }}
        run: |
          if [ -f playwright-results.json ]; then
            node -e "
              const r = require('./playwright-results.json');
              const s = r.stats;
              const dur = (s.duration / 1000).toFixed(1);
              let md = '## Playwright E2E Results\n\n';
              md += '| Status | Count |\n|--------|-------|\n';
              md += '| :white_check_mark: Passed | ' + s.expected + ' |\n';
              if (s.unexpected > 0) md += '| :x: Failed | ' + s.unexpected + ' |\n';
              if (s.flaky > 0) md += '| :warning: Flaky | ' + s.flaky + ' |\n';
              if (s.skipped > 0) md += '| :fast_forward: Skipped | ' + s.skipped + ' |\n';
              md += '| :stopwatch: Duration | ' + dur + 's |\n\n';
              for (const file of r.suites) {
                for (const describe of (file.suites || [])) {
                  md += '### ' + describe.title + '\n\n';
                  for (const spec of (describe.specs || [])) {
                    const icon = spec.ok ? ':white_check_mark:' : ':x:';
                    const t = spec.tests?.[0]?.results?.[0]?.duration;
                    md += '- ' + icon + ' ' + spec.title + (t ? ' (' + t + 'ms)' : '') + '\n';
                  }
                  md += '\n';
                }
              }
              require('fs').appendFileSync(process.env.GITHUB_STEP_SUMMARY, md);
            "
          fi

      - uses: actions/upload-artifact@v7
        if: ${{ !cancelled() }}
        with:
          name: playwright-report
          path: playwright-report/
          retention-days: 30

  journal-image-smoke:
    name: Journal Image Smoke Test
    runs-on: ubuntu-latest
    services:
      postgres:
        image: imresamu/postgis:16-3.4
        env:
          POSTGRES_USER: trails
          POSTGRES_PASSWORD: trails
          POSTGRES_DB: trails
        ports:
          - 5432:5432
        options: >-
          --health-cmd "pg_isready -U trails"
          --health-interval 5s
          --health-timeout 5s
          --health-retries 20
    env:
      # From the job container the postgres service is at host.docker.internal.
      DATABASE_URL: postgres://trails:trails@host.docker.internal:5432/trails
      DOCKER_HOST: tcp://host.docker.internal:2375
    steps:
      - uses: actions/checkout@v7
      - uses: pnpm/action-setup@v6
      - uses: actions/setup-node@v6
        with:
          node-version: 24
          cache: pnpm
      - run: pnpm install --frozen-lockfile

      - name: Push database schema
        # Pipe through cat so drizzle-kit prints plain output (no TTY spinner
        # that hides the real error) and we see any failure.
        run: pnpm db:push 2>&1 | cat

      - name: Build journal runtime image
        run: docker build --target runtime -f apps/journal/Dockerfile -t journal-smoke .

      - name: Boot image and wait for healthy
        run: |
          # Journal runs --network host on the DinD daemon, so it reaches the
          # postgres service (published on DinD) at localhost:5432.
          docker run -d --name journal-smoke --network host \
            -e NODE_ENV=production -e E2E=true \
            -e DATABASE_URL="postgres://trails:trails@localhost:5432/trails" \
            journal-smoke
          code=000
          for i in $(seq 1 30); do
            code=$(curl -s -o /dev/null -w "%{http_code}" --max-time 3 http://host.docker.internal:3000/api/health || echo 000)
            echo "attempt $i: /api/health -> $code"
            [ "$code" = "200" ] && break
            if [ "$(docker inspect -f '{{.State.Running}}' journal-smoke 2>/dev/null)" != "true" ]; then
              echo "::error::journal container exited during boot"
              break
            fi
            sleep 2
          done
          if [ "$code" != "200" ]; then
            echo "::error::journal production image failed to boot healthy (see logs below)"
            docker logs journal-smoke 2>&1 || true
            exit 1
          fi
          echo "journal production image booted healthy"

      - name: Container logs
        if: always()
        run: docker logs journal-smoke 2>&1 | tail -40 || true