ci.yml

name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
  workflow_dispatch:

permissions:
  actions: read
  contents: read

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  lint:
    name: Lint & Format
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - name: Checkout
        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6

      - name: Setup Node.js
        uses: actions/setup-node@395ad3262231945c25e8478fd5baf05154b1d79f # v6
        with:
          cache: 'npm'
          node-version-file: '.nvmrc'

      - name: Install dependencies
        run: npm ci --prefer-offline --no-audit

      - name: Run ESLint
        run: npm run lint

      - name: Check Prettier formatting
        run: npm run format

  typecheck:
    name: TypeCheck
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - name: Checkout
        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6

      - name: Setup Node.js
        uses: actions/setup-node@395ad3262231945c25e8478fd5baf05154b1d79f # v6
        with:
          cache: 'npm'
          node-version-file: '.nvmrc'

      - name: Install dependencies
        run: npm ci --prefer-offline --no-audit

      - name: Run TypeScript type checking
        run: npm run typecheck

  qlty:
    name: Qlty Check
    runs-on: ubuntu-latest
    timeout-minutes: 3

    steps:
      - name: Checkout code
        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
        with:
          fetch-depth: 0

      - name: Install qlty
        uses: qltysh/qlty-action/install@ea1f343351856554424688e75be09f7fd59936a6

      - name: Run qlty check
        run: qlty check

      - name: Run qlty code smells analysis
        run: qlty smells

  build:
    name: Build & Test
    runs-on: ubuntu-latest
    timeout-minutes: 15
    permissions:
      id-token: write
      contents: read
    steps:
      - name: Checkout
        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6

      - name: Setup Node.js
        uses: actions/setup-node@395ad3262231945c25e8478fd5baf05154b1d79f # v6
        with:
          cache: 'npm'
          node-version-file: '.nvmrc'

      - name: Install dependencies
        run: |
          npm ci --prefer-offline --no-audit
          # Verify Tailwind CSS native modules are installed for Linux (npm optional deps bug)
          # See: https://github.com/npm/cli/issues/4828
          node -e "try { require('lightningcss'); } catch { process.exit(1); }" 2>/dev/null || npm install lightningcss-linux-x64-gnu
          node -e "try { require('@tailwindcss/oxide'); } catch { process.exit(1); }" 2>/dev/null || npm install @tailwindcss/oxide-linux-x64-gnu

      - name: Compile TypeScript
        run: npm run compile

      - name: Run tests
        run: npm test
        env:
          VSC_JUPYTER_INSTRUMENT_CODE_FOR_COVERAGE: true

      - name: Upload coverage to Codecov
        uses: codecov/codecov-action@671740ac38dd9b0130fbe1cec585b89eea48d3de # v5
        with:
          use_oidc: true
          files: coverage/lcov.info
          fail_ci_if_error: true

      - name: Upload test results to Codecov
        if: '!cancelled()'
        uses: codecov/codecov-action@671740ac38dd9b0130fbe1cec585b89eea48d3de # v5
        with:
          use_oidc: true
          files: test-results.xml
          fail_ci_if_error: true
          report_type: test_results

      - name: Check dependencies
        run: npm run checkDependencies
        continue-on-error: true

      - name: Check licenses
        run: npm run check-licenses

  integration-tests:
    name: Integration Tests
    runs-on: ubuntu-latest
    timeout-minutes: 60
    needs: [build]
    # Run on all PRs and main branch pushes
    # Can be disabled by adding [skip-integration] to PR title or commit message
    if: "!contains(github.event.pull_request.title || github.event.head_commit.message || '', '[skip-integration]')"
    steps:
      - name: Checkout
        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6

      - name: Setup Node.js
        uses: actions/setup-node@395ad3262231945c25e8478fd5baf05154b1d79f # v6
        with:
          cache: 'npm'
          node-version-file: '.nvmrc'

      - name: Setup Python
        uses: actions/setup-python@8d9ed9ac5c53483de85588cdf95a591a75ab9f55 # v5.5.0
        with:
          python-version: '3.11'
          cache: 'pip'

      - name: Install npm dependencies
        run: |
          npm ci --prefer-offline --no-audit
          # Verify Tailwind CSS native modules are installed for Linux (npm optional deps bug)
          # See: https://github.com/npm/cli/issues/4828
          node -e "try { require('lightningcss'); } catch { process.exit(1); }" 2>/dev/null || npm install lightningcss-linux-x64-gnu
          node -e "try { require('@tailwindcss/oxide'); } catch { process.exit(1); }" 2>/dev/null || npm install @tailwindcss/oxide-linux-x64-gnu

      - name: Compile TypeScript
        run: npm run compile

      - name: Create test virtual environments
        uses: ./.github/actions/create-venv-for-tests
        with:
          IPyWidgetVersion: '8'

      - name: Set Python path for tests
        uses: ./.github/actions/set-python

      - name: Install xvfb for headless VS Code
        run: |
          sudo apt-get update
          sudo apt-get install -y xvfb libxkbfile1 libsecret-1-0 libgbm1 libnss3 libatk-bridge2.0-0 libgtk-3-0

      - name: Run integration tests
        run: xvfb-run --auto-servernum --server-args="-screen 0 1920x1080x24" npm run test:integration
        env:
          VSC_JUPYTER_CI_TEST: '1'

      - name: Upload test artifacts on failure
        if: failure()
        uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4
        with:
          name: integration-test-results
          path: |
            test-results.xml
            logs/
            **/*.png
          retention-days: 7
          if-no-files-found: ignore

  check_licenses:
    name: Check Licenses
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6

      - name: Setup Node.js
        uses: actions/setup-node@395ad3262231945c25e8478fd5baf05154b1d79f # v6
        with:
          cache: 'npm'
          node-version-file: '.nvmrc'

      - name: Install dependencies
        run: npm ci

      - name: Check Licenses
        run: npm run check-licenses

  spell-check:
    name: Spell Check
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - name: Checkout
        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6

      - name: Setup Node.js
        uses: actions/setup-node@395ad3262231945c25e8478fd5baf05154b1d79f # v6
        with:
          cache: 'npm'
          node-version-file: '.nvmrc'

      - name: Install dependencies
        run: npm ci --prefer-offline --no-audit

      - name: Run spell check
        run: npm run spell-check

  package-lock-drift-check:
    name: Package Lock Drift Check
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
      - name: Checkout
        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6

      - name: Setup Node.js
        uses: actions/setup-node@395ad3262231945c25e8478fd5baf05154b1d79f # v6
        with:
          cache: 'npm'
          node-version-file: '.nvmrc'

      - name: Install dependencies
        run: npm install

      - name: Check package lock drift
        run: |
          git diff --exit-code HEAD

  audit-prod:
    name: Audit - Production
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - name: Checkout
        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6

      - name: Setup Node.js
        uses: actions/setup-node@395ad3262231945c25e8478fd5baf05154b1d79f # v6
        with:
          cache: 'npm'
          node-version-file: '.nvmrc'

      - name: Install dependencies
        run: npm ci --prefer-offline --no-audit

      - name: Run audit for production dependencies
        run: npm audit --production

  audit-all:
    name: Audit - All
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - name: Checkout
        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6

      - name: Setup Node.js
        uses: actions/setup-node@395ad3262231945c25e8478fd5baf05154b1d79f # v6
        with:
          cache: 'npm'
          node-version-file: '.nvmrc'

      - name: Install dependencies
        run: npm ci --prefer-offline --no-audit

      - name: Run audit for all dependencies
        run: npm audit