main.yml

name: Authier monorepo CI
on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

jobs:
  build:
    runs-on: ubuntu-latest
    name: runs typescript, tests, and deploys
    services:
      postgres:
        image: postgres:latest
        env:
          POSTGRES_DB: authier
          POSTGRES_PASSWORD: auth133r
          POSTGRES_USER: authier
        ports:
          - 5432:5432
        # Set health checks to wait until postgres has started
        options: >-
          --health-cmd pg_isready
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5
          --user root
      redis:
        image: redis
        ports:
          - 6379:6379
        # Set health checks to wait until redis has started
        options: >-
          --health-cmd "redis-cli ping"
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5
    env:
      APPNAME: authier-api
      AWS_REGION: eu-central-1
      DEBUG: au:*
      AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY }}
      AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_KEY }}
      DATABASE_URL: ${{ secrets.DATABASE_URL }}
      DIRECT_URL: ${{ secrets.DIRECT_URL }}
      SHADOW_DATABASE_URL: ${{ secrets.SHADOW_DATABASE_URL }}
      ACCESS_TOKEN_SECRET: ${{ secrets.ACCESS_TOKEN_SECRET }}
      REFRESH_TOKEN_SECRET: ${{ secrets.REFRESH_TOKEN_SECRET }}
      COOKIE_SECRET: ${{ secrets.COOKIE_SECRET }}
      FREE_GEOIP_API_KEY: ${{ secrets.FREE_GEOIP_API_KEY }}
      SENTRY_DSN: ${{ secrets.SENTRY_DSN }}
      MJ_APIKEY_PUBLIC: ${{ secrets.MJ_APIKEY_PUBLIC }}
      MJ_APIKEY_PRIVATE: ${{ secrets.MJ_APIKEY_PRIVATE }}
      STRIPE_ENDPOINT: ${{ secrets.STRIPE_ENDPOINT }}
      STRIPE_SECRET_KEY: ${{ secrets.STRIPE_SECRET_KEY }}
      REDIS_URL: ${{ secrets.REDIS_URL }}
      UPSTASH_REDIS_REST_URL: ${{ secrets.UPSTASH_REDIS_REST_URL }}
      UPSTASH_REDIS_REST_TOKEN: ${{ secrets.UPSTASH_REDIS_REST_TOKEN }}
      IP_API_IO_API_KEY: ${{ secrets.IP_API_IO_API_KEY }}
      FIREBASE_PROJECT_ID: ${{ secrets.FIREBASE_PROJECT_ID }}
      FIREBASE_PRIVATE_KEY: ${{ secrets.FIREBASE_PRIVATE_KEY }}
      FIREBASE_CLIENT_EMAIL: ${{ secrets.FIREBASE_CLIENT_EMAIL }}

    steps:
      - uses: actions/checkout@v4
      - uses: pnpm/action-setup@v4
        with:
          version: 10
      - name: Set up Node.js
        uses: actions/setup-node@v4
        with:
          node-version: 22
          cache: 'pnpm'

      - name: Install dependencies
        run: |
          pnpm i ts-node zx -g
          pnpm i --frozen-lockfile --prefer-offline

      - uses: dorny/paths-filter@v2
        id: changes
        with:
          filters: |
            backend:
              - 'backend/**' 
              - '.github/**'
              - 'pnpm-lock.yaml'
            webExtension:
              - 'web-extension/**'
              - '.github/**'
              - 'pnpm-lock.yaml'
            mobileApp:
              - 'mobile-app/**'
              - '.github/**'
              - 'pnpm-lock.yaml'

      - name: schema gen
        working-directory: ./backend
        if: steps.changes.outputs.backend == 'true' || steps.changes.outputs.mobileApp == 'true'
        run: |
          pnpm gen

      - name: backend install deps, check TS and run tests
        working-directory: ./backend
        if: steps.changes.outputs.backend == 'true'
        env:
          DATABASE_URL: postgresql://authier:auth133r@localhost:5432/authier
          REDIS_URL: redis://localhost:6379
          NODE_ENV: test
        run: |
          pnpm tsc
          cp .env.sample .env
          pnpm test:prepare
          pnpm test

      - name: Configure aws credentials
        uses: aws-actions/configure-aws-credentials@v1
        if: github.ref == 'refs/heads/main' && steps.changes.outputs.backend == 'true'
        with:
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY }}
          aws-secret-access-key: ${{ secrets.AWS_SECRET_KEY }}
          aws-region: 'eu-central-1'

      - name: backend build and deploy
        working-directory: ./backend
        if: github.ref == 'refs/heads/main' && steps.changes.outputs.backend == 'true'
        env:
          NODE_ENV: production
        run: |
          pnpm prisma:deploy
          pnpm cdkDeploy

      ## TODO fix sentry release action
      # - name: Create a Sentry.io release
      #   uses: tclindner/sentry-releases-action@v1.2.0
      #   if: steps.changes.outputs.backend == 'true'
      #   env:
      #     SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
      #     SENTRY_ORG: authier-ml
      #     SENTRY_PROJECT: authier-backend
      #   with:
      #     tagName: ${{ github.sha }}
      #     environment: production

      - name: web-extension, check TS and run tests
        working-directory: ./web-extension
        if: steps.changes.outputs.webExtension == 'true' || steps.changes.outputs.backend == 'true'
        run: |
          pnpm tsc
          pnpm test
      # - name: Install Playwright Browsers & Run Playwright tests with backend
      #   if: steps.changes.outputs.backend == 'true'
      #   working-directory: ./web-extension
      #   run: |
      #     npx playwright install --with-deps
      #     xvfb-run --auto-servernum -- pnpm playwright:run
      #
      # - name: Upload test results
      #   if: always()
      #   uses: actions/upload-artifact@v4
      #   with:
      #     name: test-results
      #     path: web-extension/test-results
      #     retention-days: 30

      - name: mobile-app, check TS and run tests
        working-directory: ./mobile-app
        if: steps.changes.outputs.mobileApp == 'true'
        run: |
          pnpm tsc
          pnpm test