test_fe.yaml

name: Test FE

on:
  push:
    branches: [main]
  pull_request:

concurrency:
  group: ${{ github.workflow }}-${{ github.event_name == 'pull_request' && github.ref || github.run_id }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

permissions:
  contents: read

env:
  TURBO_TEAM: marimo
  MARIMO_SKIP_UPDATE_CHECK: 1

jobs:
  changes:
    runs-on: ubuntu-latest
    outputs:
      frontend: ${{ steps.filter.outputs.frontend }}
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
      - uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3
        id: filter
        with:
          filters: |
            frontend:
              - 'frontend/**'
              - 'packages/**'

  lint_frontend:
    needs: changes
    if: ${{ needs.changes.outputs.frontend == 'true' }}
    name: 🧹 Lint frontend
    runs-on: ubuntu-latest
    timeout-minutes: 10
    permissions:
      contents: read
      id-token: write # required for Doppler OIDC
    defaults:
      run:
        shell: bash

    steps:
      - name: ⬇️ Checkout repo
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
        with:
          fetch-depth: 0

      - name: 🔐 Fetch Doppler secrets
        # Skip on PRs from forks: id-token write is downgraded to read, so OIDC fails.
        # Downstream tokens (TURBO_TOKEN, CODECOV_TOKEN) are optional and tolerate empty.
        if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
        uses: dopplerhq/secrets-fetch-action@cd2efbf9a404504316435873eff298b82f7e0562 # v1.3.0
        id: secrets
        with:
          auth-method: oidc
          doppler-identity-id: ${{ vars.DOPPLER_IDENTITY_ID }}
          doppler-project: marimo-oss
          doppler-config: ci_test

      - name: 📥 Install repo
        uses: ./.github/actions/install

      - name: 📦 pnpm dedupe
        if: github.event_name == 'pull_request'
        id: dedupe
        run: pnpm dedupe --check

      - name: 🧹 Lint
        id: lint
        env:
          TURBO_TOKEN: ${{ steps.secrets.outputs.TURBO_TOKEN }}
        run: pnpm turbo lint

      - name: 🔒 Verify clean git tree after lint
        id: lint_clean_tree
        run: |
          CHANGES="$(git status --porcelain)"
          if [[ -n "$CHANGES" ]]; then
            echo "Lint changed tracked files. Commit generated/autofixed files."
            echo "$CHANGES"
            git --no-pager diff --stat
            exit 1
          fi

      - name: Summarize lint failure
        if: failure() && steps.lint.outcome == 'failure'
        uses: ./.github/actions/pr-comment-on-failure
        with:
          check-name: "lint"
          command: "pnpm turbo lint"

      - name: Summarize clean-tree failure after lint
        if: failure() && steps.lint_clean_tree.outcome == 'failure'
        uses: ./.github/actions/pr-comment-on-failure
        with:
          check-name: "clean-tree"
          command: "pnpm turbo lint && git status --short"

      - name: Summarize dedupe failure
        if: failure() && steps.dedupe.outcome == 'failure'
        uses: ./.github/actions/pr-comment-on-failure
        with:
          check-name: "dedupe"
          command: "pnpm dedupe"

  test_frontend:
    needs: changes
    if: ${{ needs.changes.outputs.frontend == 'true' }}
    name: 🧪 Test frontend
    runs-on: ubuntu-latest
    timeout-minutes: 10
    permissions:
      contents: read
      id-token: write # required for Doppler OIDC
    defaults:
      run:
        working-directory: ./frontend
        shell: bash

    steps:
      - name: ⬇️ Checkout repo
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
        with:
          fetch-depth: 0

      - name: 🔐 Fetch Doppler secrets
        # Skip on PRs from forks: id-token write is downgraded to read, so OIDC fails.
        # Downstream tokens (TURBO_TOKEN, CODECOV_TOKEN) are optional and tolerate empty.
        if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
        uses: dopplerhq/secrets-fetch-action@cd2efbf9a404504316435873eff298b82f7e0562 # v1.3.0
        id: secrets
        with:
          auth-method: oidc
          doppler-identity-id: ${{ vars.DOPPLER_IDENTITY_ID }}
          doppler-project: marimo-oss
          doppler-config: ci_test

      - name: 📥 Install repo
        uses: ./.github/actions/install

      - name: 📋 Register tsc problem matcher
        run: echo "::add-matcher::${{ github.workspace }}/.github/problemMatchers/tsc.json"

      - name: 🔎 Type check
        id: typecheck
        env:
          TURBO_TOKEN: ${{ steps.secrets.outputs.TURBO_TOKEN }}
        run: pnpm turbo typecheck

      - name: 🔒 Verify clean git tree after typecheck
        id: typecheck_clean_tree
        run: |
          CHANGES="$(git status --porcelain)"
          if [[ -n "$CHANGES" ]]; then
            echo "Typecheck/codegen changed tracked files. Commit generated files."
            echo "$CHANGES"
            git --no-pager diff --stat
            exit 1
          fi

      - name: 🧪 Test
        id: test
        env:
          TURBO_TOKEN: ${{ steps.secrets.outputs.TURBO_TOKEN }}
        run: pnpm turbo test

      - name: Summarize typecheck failure
        if: failure() && steps.typecheck.outcome == 'failure'
        uses: ./.github/actions/pr-comment-on-failure
        with:
          check-name: "typecheck"
          command: "pnpm turbo typecheck"

      - name: Summarize test failure
        if: failure() && steps.test.outcome == 'failure'
        uses: ./.github/actions/pr-comment-on-failure
        with:
          check-name: "test"
          command: "pnpm turbo test"

      - name: Summarize clean-tree failure after typecheck
        if: failure() && steps.typecheck_clean_tree.outcome == 'failure'
        uses: ./.github/actions/pr-comment-on-failure
        with:
          check-name: "clean-tree"
          command: "pnpm turbo typecheck && git status --short"

  build_frontend:
    needs: changes
    if: ${{ needs.changes.outputs.frontend == 'true' }}
    name: 📦 Build frontend
    runs-on: ubuntu-latest
    timeout-minutes: 15
    permissions:
      contents: read
      id-token: write # required for Doppler OIDC
    defaults:
      run:
        working-directory: ./frontend
        shell: bash

    steps:
      - name: ⬇️ Checkout repo
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
        with:
          fetch-depth: 0

      - name: 🔐 Fetch Doppler secrets
        # Skip on PRs from forks: id-token write is downgraded to read, so OIDC fails.
        # Downstream tokens (TURBO_TOKEN, CODECOV_TOKEN) are optional and tolerate empty.
        if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
        uses: dopplerhq/secrets-fetch-action@cd2efbf9a404504316435873eff298b82f7e0562 # v1.3.0
        id: secrets
        with:
          auth-method: oidc
          doppler-identity-id: ${{ vars.DOPPLER_IDENTITY_ID }}
          doppler-project: marimo-oss
          doppler-config: ci_test

      - name: 📥 Install repo
        uses: ./.github/actions/install

      - name: 🔍 Check pinned deps
        run: |
          if ! grep -q '"react-hook-form": "7.54.2"' package.json; then
            echo "Error: react-hook-form version in package.json must be exactly 7.54.2. As it breaks mo.ui.dataframe"
            exit 1
          fi
          if ! grep -q '"html-to-image": "1.11.13"' package.json; then
            echo "Error: html-to-image version in package.json must be exactly 1.11.13. Newer versions break matplotlib toolbars"
            exit 1
          fi

      - name: 📦 Build
        id: build
        run: pnpm turbo build
        env:
          NODE_ENV: production
          TURBO_TOKEN: ${{ steps.secrets.outputs.TURBO_TOKEN }}

      - name: 📦 Build islands frontend
        env:
          NODE_ENV: production
          VITE_MARIMO_ISLANDS: "true"
          VITE_MARIMO_VERSION: "0.0.0"
          TURBO_TOKEN: ${{ steps.secrets.outputs.TURBO_TOKEN }}
        run: |
          npm version 0.0.0 --no-git-tag-version
          pnpm turbo build:islands
          ./islands/validate.sh

      - name: Summarize build failure
        if: failure() && steps.build.outcome == 'failure'
        uses: ./.github/actions/pr-comment-on-failure
        with:
          check-name: "build"
          command: "pnpm turbo build"