ci.yml

---
name: CI

on: # yamllint disable-line rule:truthy
  push:
    branches: [main]
  pull_request:
    branches: [main]

concurrency:
  group: '${{ github.head_ref || github.ref }}-${{ github.workflow }}'
  cancel-in-progress: true

env:
  POETRY_VERSION: '1.8.4' # keep in sync with pyproject.toml, Dockerfile

jobs:
  lint:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Install Poetry
        run: pipx install poetry==${{ env.POETRY_VERSION }}

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version-file: .python-version
          cache: poetry

      - name: Install dependencies
        run: make install-dev

      - name: Lint Python
        run: make lint-py
      - name: Lint HTML
        run: make lint-html

  lint-front-end:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version-file: '.nvmrc'
      - name: Install npm dependencies
        run: npm ci --no-audit
      - name: CSS linting
        run: npm run lint:css
      - name: JS linting
        run: npm run lint:js
      - name: Prettier
        run: npm run lint:format

  compile_static:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version-file: '.nvmrc'
      - id: node-cache
        uses: actions/cache@v4
        with:
          path: node_modules
          key: ${{ runner.os }}-node-${{ hashFiles('**/.nvmrc') }}-${{ hashFiles('**/package-lock.json') }}
      - if: steps.node-cache.outputs.cache-hit != 'true'
        run: npm ci --no-audit
      - run: npm run build:prod
      - uses: actions/upload-artifact@v4
        with:
          name: static
          path: cms/static_compiled/

  test-python:
    runs-on: ubuntu-latest
    needs:
      - lint
      - lint-front-end
      - compile_static

    env:
      DJANGO_SETTINGS_MODULE: cms.settings.test
      DATABASE_URL: postgres://postgres:postgres@localhost/postgres # pragma: allowlist secret
      ENABLE_DJANGO_DEFENDER: 'false'
      POSTGRES_HOST_AUTH_METHOD: trust
      SECRET_KEY: fake_secret_key_to_run_tests # pragma: allowlist secret

    services:
      postgres:
        image: postgres:16
        env:
          POSTGRES_USER: postgres
          POSTGRES_PASSWORD: postgres # pragma: allowlist secret
          POSTGRES_DB: postgres
        ports:
          - 5432:5432
        options: --health-cmd pg_isready --health-interval 10s --health-timeout 5s --health-retries 5

    steps:
      - uses: actions/checkout@v4
      - name: Install Poetry
        run: pipx install poetry==${{ env.POETRY_VERSION }}

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version-file: .python-version
          cache: poetry

      - name: Install dependencies
        run: make install-dev

      - uses: actions/download-artifact@v4
        with:
          name: static
          path: cms/static_compiled/

      - name: Fetch Design System templates
        run: make load-design-system-templates
      - name: collectstatic
        run: poetry run ./manage.py collectstatic --verbosity 0 --noinput --clear
      - name: System checks
        run: poetry run ./manage.py check
      - name: Check for missing migrations
        run: poetry run ./manage.py makemigrations --check --noinput
      - name: Create cache table
        run: poetry run ./manage.py createcachetable
      - name: Run migrations to work around Django bug (#35967)
        run: poetry run ./manage.py migrate --noinput
      - name: Test
        run: make test
      - name: Add coverage data to GitHub Action summary
        run: |
          poetry run coverage html --skip-covered --skip-empty
          echo "## Coverage summary" >> "$GITHUB_STEP_SUMMARY"
          poetry run coverage report --format=markdown >> "$GITHUB_STEP_SUMMARY"
      - name: Upload coverage HTML report
        uses: actions/upload-artifact@v4
        with:
          name: html-report
          path: htmlcov
      - name: Lint Migrations
        run: DJANGO_SETTINGS_MODULE=cms.settings.dev make lint-migrations

  docker:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Build Docker Image
        run: docker build --target web -t ons .

  functional-tests:
    runs-on: ubuntu-latest
    strategy:
      matrix:
        browser:
          - chromium
    needs:
      - lint
      - lint-front-end
      - compile_static

    env:
      DJANGO_SETTINGS_MODULE: cms.settings.functional_test
      SECRET_KEY: fake_secret_key_to_run_tests # pragma: allowlist secret
      PLAYWRIGHT_BROWSER: ${{ matrix.browser }}
      PLAYWRIGHT_TRACES_DIR: playwright_traces
      PLAYWRIGHT_TRACE: 'true'

    steps:
      - uses: actions/checkout@v4
      - name: Install Poetry
        run: pipx install poetry==${{ env.POETRY_VERSION }}

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version-file: .python-version
          cache: poetry

      - name: Install dependencies
        run: make install-dev

      - name: Playwright Install
        run: poetry run python -m playwright install --with-deps ${{ matrix.browser }}

      - uses: actions/download-artifact@v4
        with:
          name: static
          path: cms/static_compiled/

      - name: Run Functional Tests
        run: make functional-tests

      - name: Upload Failure Traces
        uses: actions/upload-artifact@v4
        if: failure()
        with:
          name: playwright-traces-${{ matrix.browser }}
          path: playwright_traces/