name: Web Tests

on:
  pull_request:
  push:
    branches: [master, stable-*]

jobs:
  detect-web-changes:
    name: detect-web-changes
    runs-on: ubuntu-latest
    timeout-minutes: 5
    outputs:
      web-changed: ${{ steps.check.outputs.web-changed }}
      full-run: ${{ steps.check.outputs.full-run }}
    steps:
      - name: Checkout code
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0

      - name: Check if web/ changed
        id: check
        env:
          PR_TITLE: ${{ github.event.pull_request.title }}
        run: |
          # full-run: push to master/stable-* or an explicit [full-ci] request always run
          # everything, unscoped - same as before Nx. A normal PR gets the affected-scoped
          # path instead (see web-build-test), since only those two cases actually need every
          # project checked.
          if [[ "${{ github.event_name }}" == "push" ]]; then
            echo "web-changed=true" >> "$GITHUB_OUTPUT"
            echo "full-run=true" >> "$GITHUB_OUTPUT"
            exit 0
          fi

          if echo "$PR_TITLE" | grep -qi "\[full-ci\]"; then
            echo "web-changed=true" >> "$GITHUB_OUTPUT"
            echo "full-run=true" >> "$GITHUB_OUTPUT"
            exit 0
          fi

          echo "full-run=false" >> "$GITHUB_OUTPUT"

          CHANGED_FILES=$(git diff --name-only "${{ github.event.pull_request.base.sha }}" "${{ github.sha }}" 2>/dev/null || git diff --name-only HEAD~1)

          WEB_CHANGED=false
          while IFS= read -r file; do
            case "$file" in
              web/*) WEB_CHANGED=true; break ;;
              .github/workflows/web-tests.yml) WEB_CHANGED=true; break ;;
            esac
          done <<< "$CHANGED_FILES"

          echo "web-changed=$WEB_CHANGED" >> "$GITHUB_OUTPUT"
          echo "web/ changed: $WEB_CHANGED"

  web-build-test:
    name: web-build-test
    needs: [detect-web-changes]
    if: needs.detect-web-changes.outputs.web-changed == 'true'
    runs-on: ubuntu-latest
    timeout-minutes: 60
    defaults:
      run:
        working-directory: web
    steps:
      - name: Checkout code
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          # nx affected --base=<pr-base-sha> (used below) needs that commit present locally
          fetch-depth: 0

      - name: Setup pnpm
        uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
        with:
          version: 10.33.3

      - name: Setup Node.js
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: 24.15.0
          cache: pnpm
          cache-dependency-path: web/pnpm-lock.yaml

      - name: Install dependencies
        run: pnpm install

      - name: Check licenses
        run: pnpm licenses:check

      - name: Save licenses
        run: pnpm licenses:csv && pnpm licenses:save

      - name: Check types
        # Whole-repo, unconditional: only 5/27 projects have a per-project typecheck target
        # (nx/vite's typecheck inference needs a project's own vite.config.ts, which most
        # web-app-* packages don't have), so `nx affected -t typecheck` can't safely stand
        # in for this yet.
        run: pnpm check:types

      - name: Check format
        run: pnpm check:format

      - name: Lint
        env:
          FULL_RUN: ${{ needs.detect-web-changes.outputs.full-run }}
        run: |
          if [[ "$FULL_RUN" == "true" ]]; then
            pnpm lint
          else
            pnpm exec nx affected -t lint --base="${{ github.event.pull_request.base.sha }}"
          fi

      - name: Run unit tests
        env:
          FULL_RUN: ${{ needs.detect-web-changes.outputs.full-run }}
        run: |
          if [[ "$FULL_RUN" == "true" ]]; then
            pnpm test:unit --coverage
          else
            pnpm exec nx affected -t test --base="${{ github.event.pull_request.base.sha }}"
          fi

      - name: Build
        run: pnpm build

  web-tests-passed:
    name: web-tests-passed
    needs: [detect-web-changes, web-build-test]
    runs-on: ubuntu-latest
    timeout-minutes: 5
    if: always()
    steps:
      - name: Check web-build-test passed or was skipped
        run: |
          if [[ "${{ needs.web-build-test.result }}" == "failure" || "${{ needs.web-build-test.result }}" == "cancelled" ]]; then
            exit 1
          fi