dashy/.github/workflows/ci.yml

# CI checks to run when a PR is opened, or manually via workflow_dispatch
name: 🚦 CI

on:
  pull_request:
    branches: ['master', 'develop']
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  changes:
    name: 🔎 Detect Changes
    runs-on: ubuntu-latest
    outputs:
      lockfile: ${{ steps.filter.outputs.lockfile }}
      workflows: ${{ steps.filter.outputs.workflows }}
      locales: ${{ steps.filter.outputs.locales }}
      translations: ${{ steps.filter.outputs.translations }}
      src: ${{ steps.filter.outputs.src }}
    steps:
      - name: Checkout Code
        uses: actions/checkout@v7

      - name: Filter Paths
        uses: dorny/paths-filter@v4
        id: filter
        with:
          filters: |
            lockfile:
              - 'yarn.lock'
            workflows:
              - '.github/workflows/**'
            locales:
              - 'src/assets/locales/**'
              - 'src/**/*.vue'
              - 'src/**/*.js'
              - 'tests/locales/**'
            translations:
              - 'src/assets/locales/**'
            src:
              - 'src/**'
              - 'package.json'
              - 'yarn.lock'
              - 'eslint.config.mjs'
              - 'tsconfig.json'

  lint:
    name: 🛡️ Lint
    runs-on: ubuntu-latest
    needs: changes
    if: needs.changes.outputs.src == 'true' || github.event_name == 'workflow_dispatch'
    steps:
      - name: Checkout Code
        uses: actions/checkout@v7

      - name: Setup Node.js
        uses: actions/setup-node@v7
        with:
          node-version: '20'
          cache: 'yarn'

      - name: Install Dependencies
        run: yarn install --frozen-lockfile

      - name: Run ESLint
        run: yarn lint

  typecheck:
    name: 🦴 Typecheck
    runs-on: ubuntu-latest
    needs: changes
    if: needs.changes.outputs.src == 'true' || github.event_name == 'workflow_dispatch'
    steps:
      - name: Checkout Code
        uses: actions/checkout@v7

      - name: Setup Node.js
        uses: actions/setup-node@v7
        with:
          node-version: '20'
          cache: 'yarn'

      - name: Install Dependencies
        run: yarn install --frozen-lockfile

      - name: Run vue-tsc
        run: yarn typecheck

  test:
    name: 🧪 Test
    runs-on: ubuntu-latest
    steps:
      - name: Checkout Code
        uses: actions/checkout@v7

      - name: Setup Node.js
        uses: actions/setup-node@v7
        with:
          node-version: '20'
          cache: 'yarn'

      - name: Install Dependencies
        run: yarn install --frozen-lockfile

      - name: Run Tests
        run: yarn test

  locales:
    name: 🌐 Locale Check
    runs-on: ubuntu-latest
    needs: changes
    if: needs.changes.outputs.locales == 'true' || github.event_name == 'workflow_dispatch'
    steps:
      - name: Checkout Code
        uses: actions/checkout@v7

      - name: Setup Node.js
        uses: actions/setup-node@v7
        with:
          node-version: '20'

      - name: Check Locales
        run: yarn validate-locales

  spellcheck:
    name: ✏️ Spellcheck
    runs-on: ubuntu-latest
    needs: changes
    if: needs.changes.outputs.translations == 'true' || github.event_name == 'workflow_dispatch'
    steps:
      - name: Checkout Code
        uses: actions/checkout@v7

      - name: Spellcheck en.json
        uses: crate-ci/typos@v1
        with:
          files: src/assets/locales/en.json

  build:
    name: 🏗️ Build Check
    runs-on: ubuntu-latest
    steps:
      - name: Checkout Code
        uses: actions/checkout@v7

      - name: Setup Node.js
        uses: actions/setup-node@v7
        with:
          node-version: '20'
          cache: 'yarn'

      - name: Install Dependencies
        run: yarn install --frozen-lockfile

      - name: Build Project
        run: yarn build

      - name: Verify Build Output
        run: |
          if [ ! -d "dist" ]; then
            echo "❌ Build failed: dist directory not created"
            exit 1
          fi
          if [ ! -f "dist/index.html" ]; then
            echo "❌ Build failed: index.html not found"
            exit 1
          fi
          echo "✅ Build successful"

  docker-smoke:
    name: 🐳 Docker Smoke Test
    runs-on: ubuntu-latest
    continue-on-error: true
    steps:
      - name: Checkout Code
        uses: actions/checkout@v7

      - name: Build & Test Docker Image
        run: sh tests/docker-smoke-test.sh
        timeout-minutes: 10

  dependency-review:
    name: 🔒 Dependency Audit
    runs-on: ubuntu-latest
    needs: changes
    if: needs.changes.outputs.lockfile == 'true' && github.event_name == 'pull_request'
    permissions:
      contents: read
    steps:
      - name: Checkout Code
        uses: actions/checkout@v7

      - name: Review Dependencies
        uses: actions/dependency-review-action@v5
        with:
          fail-on-severity: moderate

  secret-scan:
    name: 🔑 Secret Scanning
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - name: Checkout Code
        uses: actions/checkout@v7
        with:
          fetch-depth: 0

      - name: Scan PR Diff for Secrets
        uses: trufflesecurity/trufflehog@v3.95.9
        with:
          base: ${{ github.event.pull_request.base.sha }}
          head: ${{ github.event.pull_request.head.sha }}
          extra_args: --only-verified

  workflow-audit:
    name: 🛠️ Workflow Audit
    runs-on: ubuntu-latest
    needs: changes
    if: needs.changes.outputs.workflows == 'true' || github.event_name == 'workflow_dispatch'
    steps:
      - name: Checkout Code
        uses: actions/checkout@v7

      - name: Run Actionlint
        uses: raven-actions/actionlint@v2
        with:
          fail-on-error: true

      - name: Run Zizmor
        uses: zizmorcore/zizmor-action@v0.6.0
        with:
          inputs: .github/workflows/
          advanced-security: false
          annotations: true

  # Renders markdown summary of all checks at the end
  summary:
    name: 📋 Summary
    runs-on: ubuntu-latest
    if: always()
    continue-on-error: true
    needs:
      - lint
      - typecheck
      - test
      - locales
      - spellcheck
      - build
      - docker-smoke
      - dependency-review
      - secret-scan
      - workflow-audit
    steps:
      - name: Render Summary
        env:
          NEEDS: ${{ toJSON(needs) }}
        run: |
          label() {
            case "$1" in
              lint) echo "🛡️ Lint" ;;
              typecheck) echo "🦴 Typecheck" ;;
              test) echo "🧪 Test" ;;
              locales) echo "🌐 Locale Check" ;;
              spellcheck) echo "✏️ Spellcheck" ;;
              build) echo "🏗️ Build" ;;
              docker-smoke) echo "🐳 Docker Smoke" ;;
              dependency-review) echo "🔒 Dependency Audit" ;;
              secret-scan) echo "🔑 Secret Scan" ;;
              workflow-audit) echo "🛠️ Workflow Audit" ;;
              *) echo "$1" ;;
            esac
          }
          status() {
            case "$1" in
              success) echo "✅ Passed" ;;
              skipped) echo "⏭️ Skipped" ;;
              cancelled) echo "🚫 Cancelled" ;;
              failure) [ "$2" = docker-smoke ] && echo "⚠️ Warnings" || echo "❌ Failed" ;;
              *) echo "❔ $1" ;;
            esac
          }
          {
            echo "## CI Summary"
            echo ""
            echo "| Check | Status |"
            echo "|-------|--------|"
          } >> "$GITHUB_STEP_SUMMARY"
          for job in $(echo "$NEEDS" | jq -r 'keys[]'); do
            result=$(echo "$NEEDS" | jq -r --arg j "$job" '.[$j].result')
            echo "| $(label "$job") | $(status "$result" "$job") |" >> "$GITHUB_STEP_SUMMARY"
          done