node.js.yml

name: CI

on:
  push:
    branches: ["main", "develop"]
    paths-ignore:
      - "docs/**"
      - "examples/**"
      - "**/*.md"
      - "LICENSE"
      - ".gitignore"
  pull_request:
    branches: ["main", "develop"]
    paths-ignore:
      - "docs/**"
      - "examples/**"
      - "**/*.md"
      - "LICENSE"
      - ".gitignore"
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: ci-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

env:
  MONGODB_URI: mongodb://localhost:27017/test
  REDIS_URL: redis://localhost:6379
  ACCESS_TOKEN_SECRET: testAccessSecret
  REFRESH_TOKEN_SECRET: testRefreshSecret
  INTERNAL_SECRET: testInternalSecret
  INTERNAL_SECRET_SOCKET: testInternalSecret
  INTERNAL_SECRET_WORKER: testInternalWorkerSecret
  TURBO_ENV_MODE: loose

jobs:
  quality:
    name: Quality (Node ${{ matrix.node-version }})
    runs-on: ubuntu-latest
    timeout-minutes: 45

    strategy:
      fail-fast: false
      matrix:
        node-version: [22.x, 24.x]

    services:
      mongodb:
        image: mongo:7
        ports:
          - 27017:27017
        options: >-
          --health-cmd="mongosh --eval 'db.runCommand({ ping: 1 })'"
          --health-interval=10s
          --health-timeout=5s
          --health-retries=5

      redis:
        image: redis:7
        ports:
          - 6379:6379
        options: >-
          --health-cmd="redis-cli ping"
          --health-interval=10s
          --health-timeout=5s
          --health-retries=5

    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1

      - name: Enable Corepack
        run: corepack enable

      - name: Configure mongodb-memory-server cache
        run: |
          echo "MONGOMS_DOWNLOAD_DIR=$RUNNER_TEMP/mongodb-binaries" >> "$GITHUB_ENV"
          echo "MONGOMS_PREFER_GLOBAL_PATH=0" >> "$GITHUB_ENV"

      - name: Restore MongoDB memory server binaries
        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
        with:
          path: ${{ runner.temp }}/mongodb-binaries
          key: ${{ runner.os }}-mongo-binaries-7.0.37-${{ hashFiles('pnpm-lock.yaml') }}
          restore-keys: |
            ${{ runner.os }}-mongo-binaries-7.0.37-
            ${{ runner.os }}-mongo-binaries-

      - name: Use Node.js
        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
        with:
          node-version: ${{ matrix.node-version }}
          cache: pnpm

      - name: Restore Turbo cache
        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
        with:
          path: .turbo
          key: ${{ runner.os }}-turbo-${{ matrix.node-version }}-${{ github.ref_name }}-${{ hashFiles('pnpm-lock.yaml', 'turbo.json') }}

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Pre-download MongoDB memory server binary
        run: pnpm --filter @semantask/auth run test:download-mongo

      - name: Build shared packages
        run: pnpm exec turbo run build --filter=./packages/*

      - name: Unit tests
        run: pnpm run test

      - name: Type check
        run: pnpm run typecheck

      - name: Lint
        run: pnpm run lint

      - name: Build monorepo
        run: pnpm run build

      - name: Verify build artifacts
        run: pnpm run ci:verify-artifacts

  web-runtime:
    name: Web Runtime Smoke Test
    runs-on: ubuntu-latest
    needs: quality
    timeout-minutes: 25

    services:
      mongodb:
        image: mongo:7
        ports:
          - 27017:27017

      redis:
        image: redis:7
        ports:
          - 6379:6379

    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1

      - name: Enable Corepack
        run: corepack enable

      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
        with:
          node-version: 22
          cache: pnpm

      - run: pnpm install --frozen-lockfile
      - name: Build shared types package
        run: pnpm --filter @semantask/types build
      - run: pnpm run build

      - name: Start web app
        run: |
          pnpm --filter @semantask/web start &
          sleep 10

      - name: Check web health
        run: curl -f http://127.0.0.1:3000 || exit 1

  socket-runtime:
    name: Socket Runtime + WS Test
    runs-on: ubuntu-latest
    needs: quality
    timeout-minutes: 30

    services:
      mongodb:
        image: mongo:7
        ports:
          - 27017:27017

      redis:
        image: redis:7
        ports:
          - 6379:6379

    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1

      - name: Enable Corepack
        run: corepack enable

      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
        with:
          node-version: 22
          cache: pnpm

      - run: pnpm install --frozen-lockfile
      - name: Build shared types package
        run: pnpm --filter @semantask/types build

      - name: Build web app
        run: pnpm --filter @semantask/web build

      - name: Start web app
        run: |
          pnpm --filter @semantask/web start &
          sleep 10

      - name: Wait for web health
        run: |
          for i in {1..30}; do
            curl -f http://127.0.0.1:3000 && exit 0
            sleep 2
          done
          exit 1

      - name: Build socket image
        run: docker build -f docker/socket.Dockerfile -t chat-socket:ci .

      - name: Start socket container
        run: |
          docker run -d --name chat-socket-ci -p 3001:3001 \
            --add-host=host.docker.internal:host-gateway \
            -e REDIS_URL=redis://host.docker.internal:6379 \
            -e WEB_SERVER_URL=http://host.docker.internal:3000 \
            -e INTERNAL_SECRET=testInternalSecret \
            -e INTERNAL_SECRET_SOCKET=testInternalSecret \
            -e INTERNAL_SECRET_WORKER=testInternalWorkerSecret \
            -e ACCESS_TOKEN_SECRET=testAccessSecret \
            -e ORIGIN=http://localhost \
            chat-socket:ci

      - name: Wait for health
        run: |
          for i in {1..30}; do
            curl -f http://127.0.0.1:3001/health && exit 0
            sleep 2
          done
          exit 1

      - name: WebSocket authenticated connection test
        working-directory: apps/web
        run: |
          node <<'NODE'
          const { io } = require("socket.io-client");
          const email = `ci-${Date.now()}@example.com`;
          const password = "Password@123";

          async function createAccessCookie() {
            const registerResponse = await fetch("http://127.0.0.1:3000/api/auth/register", {
              method: "POST",
              headers: { "content-type": "application/json" },
              body: JSON.stringify({
                username: "ci-user",
                email,
                password,
              }),
            });

            if (!registerResponse.ok) {
              const errorText = await registerResponse.text();
              throw new Error(`Register failed: ${registerResponse.status} ${errorText}`);
            }

            const setCookies = registerResponse.headers.getSetCookie?.() || [];
            const accessCookie = setCookies.find((cookie) => cookie.startsWith("accessToken="));
            if (!accessCookie) {
              throw new Error("Missing accessToken cookie from register response");
            }

            return accessCookie.split(";")[0];
          }

          createAccessCookie().then((cookieHeader) => {
            const socket = io("http://localhost:3001", {
              path: "/api/socket",
              transports: ["websocket"],
              timeout: 5000,
              extraHeaders: {
                Cookie: cookieHeader,
              },
            });

            socket.on("connect", () => {
              console.log("WS connected");
              process.exit(0);
            });

            socket.on("connect_error", (err) => {
              console.error("WS failed", err.message);
              process.exit(1);
            });
          }).catch((error) => {
            console.error("Auth bootstrap failed", error.message);
            process.exit(1);
          });
          NODE

      - name: Cleanup
        if: always()
        run: docker rm -f chat-socket-ci || true