ci.yml

name: CI

on:
  workflow_dispatch:
  push:
    branches:
      - main
      - develop
  pull_request:
  release:
    types: [published]
  merge_group:
    types: [checks_requested]

# Cancel superseded runs of a pull request. Other events get a unique group, so they are never cancelled or queued.
concurrency:
  group: ${{ github.workflow }}-${{ github.event_name == 'pull_request' && github.event.pull_request.number || github.run_id }}
  cancel-in-progress: true

permissions:
  contents: read

env:
  REGISTRY: ghcr.io
  IMAGE_NAME_RUNTIME: ${{ github.repository }}/runtime

jobs:
  test:
    name: "Test backpex"
    runs-on: ubuntu-latest
    timeout-minutes: 15
    strategy:
      matrix:
        include:
          - elixir: "1.16"
            otp: "26.2"

          - elixir: "1.17"
            otp: "27.3"

          - elixir: "1.18"
            otp: "28.5"

          - elixir: "1.19"
            otp: "28.5"

          - elixir: "1.20"
            otp: "29.1"

    # The integration tests run once, on the latest Elixir, in the test-integration job.
    env:
      INTEGRATION_TESTS: false

    steps:
      - name: Checkout code
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Set runner image
        # Part of the cache keys, so caches don't carry over to a new Ubuntu version behind ubuntu-latest
        run: echo "RUNNER_IMAGE=$ImageOS" >> "$GITHUB_ENV"

      - uses: erlef/setup-beam@54075bcc5e249e4758d363f27d099f55d843f124 # v1.24.1
        with:
          otp-version: ${{ matrix.otp }}
          elixir-version: ${{ matrix.elixir }}

      - name: Setup bun
        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
        with:
          bun-version-file: .tool-versions

      - name: Restore the deps and _build cache
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        id: restore-cache
        env:
          MIX_LOCK_HASH: ${{ hashFiles(format('{0}{1}', github.workspace, '/mix.lock')) }}
        with:
          path: |
            deps
            _build
          key: ${{ runner.os }}-${{ env.RUNNER_IMAGE }}-${{ matrix.elixir }}-${{ matrix.otp }}-build-deps-mixlockhash-${{ env.MIX_LOCK_HASH }}
          restore-keys: ${{ runner.os }}-${{ env.RUNNER_IMAGE }}-${{ matrix.elixir }}-${{ matrix.otp }}-build-deps-

      - name: Install dependencies
        if: steps.restore-cache.outputs.cache-hit != 'true'
        run: mix deps.get

      - name: Compile dependencies
        if: steps.restore-cache.outputs.cache-hit != 'true'
        run: mix deps.compile

      - name: Compile with warnings as errors
        run: mix compile --warnings-as-errors --force

      - name: Cache bun install cache
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: ~/.bun/install/cache
          key: ${{ runner.os }}-bun-store-${{ hashFiles('bun.lock') }}
          restore-keys: |
            ${{ runner.os }}-bun-store-

      - name: Install node dependencies
        run: bun install --frozen-lockfile

      - name: Check formatting
        run: mix format --check-formatted

      - name: JavaScript Standard
        run: bun run lint:standard

      - name: Run JavaScript tests
        run: bun run test:js

      - name: Build docs with warnings as errors
        run: mix docs --warnings-as-errors

      - name: Credo
        run: mix credo

      - name: Sobelow
        run: mix sobelow --config

      - name: Run tests
        run: mix test

      - name: Run doc tests
        run: mix test test/doc_test.exs

      - name: Deps Audit
        continue-on-error: true
        run: mix deps.audit

      - name: Gettext Check
        run: mix gettext.extract --check-up-to-date

      - name: Check assets up-to-date
        run: mix assets.check

  test-integration:
    name: "Integration tests and coverage (backpex)"
    runs-on: ubuntu-latest
    timeout-minutes: 20
    services:
      postgres:
        image: postgres:18.6@sha256:e3d24f6906d0760bf4da0dae872415391ededefad23fd471c47dc53b0ddf3c42
        env:
          POSTGRES_PASSWORD: postgres
        ports:
          - 5432:5432
        options: >-
          --health-cmd "pg_isready -U postgres"
          --health-interval 5s
          --health-timeout 5s
          --health-retries 10
    env:
      DB_HOSTNAME: localhost
      DB_PORT: 5432
      DB_USERNAME: postgres
      DB_PASSWORD: postgres

    steps:
      - name: Checkout code
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Set runner image
        # Part of the cache keys, so caches don't carry over to a new Ubuntu version behind ubuntu-latest
        run: echo "RUNNER_IMAGE=$ImageOS" >> "$GITHUB_ENV"

      - name: Set Playwright version
        # Keys the browser cache. The browsers only change with this version, not with every lockfile change.
        run: echo "PLAYWRIGHT_VERSION=$(jq -r .devDependencies.playwright package.json)" >> "$GITHUB_ENV"

      - uses: erlef/setup-beam@54075bcc5e249e4758d363f27d099f55d843f124 # v1.24.1
        with:
          version-file: .tool-versions
          version-type: strict

      - name: Setup bun
        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
        with:
          bun-version-file: .tool-versions

      - name: Setup node
        # Playwright runs its CLI with node
        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
        with:
          node-version: 26

      - name: Restore the deps and _build cache
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        id: restore-cache
        env:
          TOOL_VERSIONS_HASH: ${{ hashFiles('.tool-versions') }}
          MIX_LOCK_HASH: ${{ hashFiles(format('{0}{1}', github.workspace, '/mix.lock')) }}
        with:
          path: |
            deps
            _build
          key: ${{ runner.os }}-${{ env.RUNNER_IMAGE }}-${{ env.TOOL_VERSIONS_HASH }}-build-deps-integration-mixlockhash-${{ env.MIX_LOCK_HASH }}
          restore-keys: ${{ runner.os }}-${{ env.RUNNER_IMAGE }}-${{ env.TOOL_VERSIONS_HASH }}-build-deps-integration-

      - name: Install dependencies
        if: steps.restore-cache.outputs.cache-hit != 'true'
        run: mix deps.get

      - name: Compile dependencies
        if: steps.restore-cache.outputs.cache-hit != 'true'
        run: MIX_ENV=test mix deps.compile

      - name: Cache bun install cache
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: ~/.bun/install/cache
          key: ${{ runner.os }}-bun-store-${{ hashFiles('bun.lock') }}
          restore-keys: |
            ${{ runner.os }}-bun-store-

      - name: Cache Playwright browsers
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        id: playwright-cache
        with:
          path: ~/.cache/ms-playwright
          key: ${{ runner.os }}-${{ env.RUNNER_IMAGE }}-playwright-${{ env.PLAYWRIGHT_VERSION }}
          restore-keys: |
            ${{ runner.os }}-${{ env.RUNNER_IMAGE }}-playwright-

      - name: Deps Unused
        # Only the latest Elixir loads the dependencies of the integration tests, see mix.exs.
        run: mix deps.unlock --check-unused

      - name: Install node dependencies
        run: bun install --frozen-lockfile

      - name: Install Playwright
        if: steps.playwright-cache.outputs.cache-hit != 'true'
        # With a cache miss, `--with-deps` needs apt, which fails when the runner can't resolve the Ubuntu mirrors.
        # The runner image already has the system libraries (a cache hit skips this step), so retry without apt.
        run: bun run e2e:install || bun x playwright install chromium --only-shell

      - name: Build the assets of the browser tests
        run: bun run e2e:assets

      - name: Compile the test app with warnings as errors
        run: MIX_ENV=test mix compile --warnings-as-errors

      - name: Run unit and integration tests with coverage
        run: mix test --cover --export-coverage default

      - name: Run browser tests with coverage
        # A failed test runs again with traces for the artifact, but the step fails anyway, so a flaky test shows up
        # and the coverage check never merges the export of a failed run.
        run: |
          mix test --only e2e --cover --export-coverage e2e || {
            status=$?
            if [[ $status = 2 ]]; then PW_TRACE=true mix test --only e2e --max-cases 1 --failed || true; fi
            exit $status
          }

      - name: Convert the merged coverage to LCOV
        run: MIX_ENV=test mix run --no-start scripts/coverage_lcov.exs

      - name: Upload the coverage to Codecov
        uses: codecov/codecov-action@303a32d7a59b442fa8d48b6a1cc6825c09c847a5 # v7.1.1
        with:
          # Pull requests from forks get no secrets and upload without a token, which Codecov may rate limit.
          token: ${{ secrets.CODECOV_TOKEN }}
          files: cover/lcov.info
          disable_search: true
          fail_ci_if_error: ${{ github.event.pull_request.head.repo.fork != true }}

      - name: Check the merged coverage
        run: MIX_ENV=test mix test.coverage

      - name: Upload the coverage report
        if: always()
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: coverage
          path: cover/
          retention-days: 7

      - name: Upload Playwright traces
        if: failure()
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: playwright-traces-backpex
          path: tmp/e2e/traces/
          retention-days: 7

  publish:
    needs: [test, test-integration, test-demo]
    if: github.event_name == 'release'
    name: "Publish package on hex.pm"
    runs-on: ubuntu-latest
    timeout-minutes: 10
    environment: hex

    steps:
      - name: Checkout code
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - uses: erlef/setup-beam@54075bcc5e249e4758d363f27d099f55d843f124 # v1.24.1
        id: beam
        with:
          version-file: .tool-versions
          version-type: strict

      - name: Install dependencies
        run: |
          mix local.hex --force --if-missing
          mix local.rebar --force --if-missing
          mix deps.get

      - name: Publish package on hex.pm
        env:
          HEX_API_KEY: ${{ secrets.HEX_API_KEY }}
        run: mix hex.publish --yes

  test-demo:
    name: "Test (Demo)"
    runs-on: ubuntu-latest
    timeout-minutes: 20

    steps:
      - name: Checkout code
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Start Postgres
        id: postgres
        background: true
        # The step ends once the database accepts TCP connections, so `wait: postgres` blocks until it is ready.
        # The image's init server only listens on the socket, so checking 127.0.0.1 skips it.
        run: |
          docker run -d --name postgres -p 5432:5432 -e POSTGRES_PASSWORD=postgres \
            postgres:16.15@sha256:ca0bd484cb98bf4b24eb1010e73fb3fcbd6714d240fbc1a10eea5b7dbecb641d
          timeout 60 bash -c 'until docker exec postgres pg_isready -h 127.0.0.1 -U postgres; do sleep 1; done'

      - name: Set runner image
        # Part of the cache keys, so caches don't carry over to a new Ubuntu version behind ubuntu-latest
        run: echo "RUNNER_IMAGE=$ImageOS" >> "$GITHUB_ENV"

      - name: Set Playwright version
        # Keys the browser cache. The browsers only change with this version, not with every lockfile change.
        run: echo "PLAYWRIGHT_VERSION=$(jq -r .devDependencies.playwright demo/package.json)" >> "$GITHUB_ENV"

      - parallel:
          - name: Setup beam
            uses: erlef/setup-beam@54075bcc5e249e4758d363f27d099f55d843f124 # v1.24.1
            with:
              version-file: .tool-versions
              version-type: strict

          - name: Setup node
            uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
            with:
              node-version: 26

          - name: Setup bun
            uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
            with:
              bun-version-file: .tool-versions

          - name: Restore the deps and _build cache
            uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
            id: restore-cache
            env:
              # setup-beam's outputs aren't available inside the group. With `version-type: strict` the versions are
              # exactly the ones in .tool-versions.
              TOOL_VERSIONS_HASH: ${{ hashFiles('.tool-versions') }}
              MIX_LOCK_HASH: ${{ hashFiles(format('{0}{1}', github.workspace, '/demo/mix.lock')) }}
            with:
              path: |
                demo/deps
                demo/_build
              key: ${{ runner.os }}-${{ env.RUNNER_IMAGE }}-${{ env.TOOL_VERSIONS_HASH }}-build-deps-demo-mixlockhash-${{ env.MIX_LOCK_HASH }}
              restore-keys: ${{ runner.os }}-${{ env.RUNNER_IMAGE }}-${{ env.TOOL_VERSIONS_HASH }}-build-deps-demo-

          - name: Cache bun install cache
            uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
            with:
              path: ~/.bun/install/cache
              key: ${{ runner.os }}-bun-store-${{ hashFiles('demo/bun.lock', 'bun.lock') }}
              restore-keys: |
                ${{ runner.os }}-bun-store-

          - name: Cache Playwright browsers
            uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
            id: playwright-cache
            with:
              path: ~/.cache/ms-playwright
              key: ${{ runner.os }}-${{ env.RUNNER_IMAGE }}-playwright-${{ env.PLAYWRIGHT_VERSION }}
              restore-keys: |
                ${{ runner.os }}-${{ env.RUNNER_IMAGE }}-playwright-

      - name: Install dependencies
        if: steps.restore-cache.outputs.cache-hit != 'true'
        working-directory: demo
        run: mix deps.get

      - name: Compile dependencies
        if: steps.restore-cache.outputs.cache-hit != 'true'
        working-directory: demo
        run: mix deps.compile

      - name: Compile with warnings as errors
        working-directory: demo
        run: mix compile --warnings-as-errors --force

      - name: Install node dependencies
        working-directory: demo
        run: bun install --frozen-lockfile

      - name: Install Backpex node dependencies
        run: bun install --frozen-lockfile

      - name: Setup assets
        working-directory: demo
        run: mix assets.setup

      - name: Build assets
        working-directory: demo
        run: mix assets.build

      # The lints run in the background while the tests run. They use MIX_ENV=dev, the tests MIX_ENV=test, so they
      # don't share a _build directory.
      - name: lint:mix
        working-directory: demo
        background: true
        run: bun run lint:mix

      - name: lint:credo
        working-directory: demo
        background: true
        run: bun run lint:credo

      - name: lint:sobelow
        working-directory: demo
        background: true
        run: bun run lint:sobelow

      - name: lint:style
        working-directory: demo
        background: true
        run: bun run lint:style

      - name: lint:standard
        working-directory: demo
        background: true
        run: bun run lint:standard

      - name: lint:deps-unused
        working-directory: demo
        background: true
        run: bun run lint:deps-unused

      - name: lint:gettext
        working-directory: demo
        background: true
        run: bun run lint:gettext

      - name: Deps audit
        working-directory: demo
        background: true
        continue-on-error: true
        run: mix deps.audit

      - name: Wait for Postgres
        wait: postgres

      - name: Run test
        working-directory: demo
        env:
          DB_HOSTNAME: localhost
          DB_USERNAME: postgres
          DB_PASSWORD: postgres
          DB_DATABASE: test
        run: bun run test

      - name: Install playwright
        if: steps.playwright-cache.outputs.cache-hit != 'true'
        working-directory: demo
        # With a cache miss, `--with-deps` needs apt, which fails when the runner can't resolve the Ubuntu mirrors.
        # The runner image already has the system libraries (a cache hit skips this step), so retry without apt.
        run: bun x playwright install chromium --with-deps --only-shell || bun x playwright install chromium --only-shell

      - name: Run playwright test
        working-directory: demo
        env:
          DB_HOSTNAME: localhost
          DB_USERNAME: postgres
          DB_PASSWORD: postgres
          DB_DATABASE: test
        run: bun run test:playwright || if [[ $? = 2 ]]; then PW_TRACE=true bun run test:playwright --max-cases 1 --failed; else false; fi

      - name: Upload Playwright traces
        if: failure()
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: playwright-traces
          path: demo/tmp/
          retention-days: 7

      - name: Wait for the lints
        wait-all:

  lint-dockerfile:
    name: "Lint Dockerfile"
    runs-on: ubuntu-latest
    timeout-minutes: 5

    steps:
      - name: Checkout code
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Hadolint
        uses: hadolint/hadolint-action@06be81baf89a55ffd0e24b8f04a4185738dd3387 # v3.5.0
        with:
          config: .hadolint.yaml

  build-runtime:
    name: "Build and push image (Demo)"
    runs-on: ubuntu-latest
    timeout-minutes: 20
    env:
      PUSH_IMAGE: ${{ github.event_name == 'push' && (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/develop') }}

    permissions:
      contents: read
      packages: write

    steps:
      - name: Checkout code
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
        with:
          # The runner is ephemeral, so skip the post step that removes the builder
          cleanup: false

      - name: Log in to the container registry
        if: env.PUSH_IMAGE == 'true'
        uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Extract metadata (tags, labels) for Docker
        id: meta
        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
        with:
          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME_RUNTIME }}

      - name: Build container
        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
        with:
          push: ${{ env.PUSH_IMAGE }}
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          cache-from: type=registry,ref=${{ env.REGISTRY }}/${{ env.IMAGE_NAME_RUNTIME }}:buildcache
          cache-to: ${{ env.PUSH_IMAGE == 'true' && format('type=registry,ref={0}/{1}:buildcache,mode=max', env.REGISTRY, env.IMAGE_NAME_RUNTIME) || '' }}
          target: runtime
          build-args: |
            MIX_ENV=prod