name: Frontend Tests on: push: branches: [main] paths: - "apps/cli/**" - "apps/package.json" - "apps/prettier.config.mjs" - "apps/.prettierignore" - "apps/web/**" - "apps/packages/**" - "apps/pnpm-lock.yaml" - "apps/backend/go.mod" - "apps/backend/go.sum" - ".github/workflows/frontend-tests.yml" - "!**/*.md" - "!**/*.mdx" - "!**/*.markdown" pull_request: branches: [main] paths: - "apps/cli/**" - "apps/package.json" - "apps/prettier.config.mjs" - "apps/.prettierignore" - "apps/web/**" - "apps/packages/**" - "apps/pnpm-lock.yaml" - "apps/backend/go.mod" - "apps/backend/go.sum" - ".github/workflows/frontend-tests.yml" - "!**/*.md" - "!**/*.mdx" - "!**/*.markdown" concurrency: group: ${{ github.workflow }}-${{ github.ref }} cancel-in-progress: true # Least-privilege: the `frontend` job only reads source and runs tests. # `packages: read` lets the container job pull the kandev-ci image from GHCR. permissions: contents: read packages: read jobs: frontend: name: Run Frontend Lint, Tests, and Build runs-on: ubuntu-latest # Pre-baked image bundles Node 24, pnpm 9.15.9, Go, and go-licenses — # see .github/docker/ci-base/Dockerfile. container: ghcr.io/kdlbs/kandev-ci:build-latest defaults: run: # Container jobs default to `sh` (dash); pin to bash for `set -euo # pipefail` and other bash-isms used by the formatting / licenses steps. shell: bash working-directory: apps steps: - name: Checkout code uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 with: fetch-depth: 0 - name: Mark workspace safe for git shell: bash working-directory: ${{ github.workspace }} run: git config --global --add safe.directory "$GITHUB_WORKSPACE" - name: Cache pnpm store uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4 with: path: ~/.local/share/pnpm/store key: pnpm-${{ runner.os }}-${{ hashFiles('apps/pnpm-lock.yaml') }} restore-keys: pnpm-${{ runner.os }}- - name: Install dependencies run: pnpm install --frozen-lockfile - name: Regenerate OSS licenses manifest run: pnpm --filter @kandev/web licenses:gen - name: Verify licenses manifest is fresh shell: bash continue-on-error: true run: | set -euo pipefail # `defaults.run.working-directory` is `apps`, so the path is relative. # The diff is reported as a warning, not a hard failure: `go-licenses` # resolves slightly different license metadata across platforms (macOS # dev vs. ubuntu CI) for the same Go modules, and we have not yet # eliminated that drift. The committed file is still the source of # truth for what the page renders. if ! git diff --quiet --exit-code web/generated/licenses.json; then echo "::warning::apps/web/generated/licenses.json differs from a fresh re-run." echo "::warning::Run 'pnpm --filter @kandev/web licenses:gen' and commit if the drift is real." git --no-pager diff --stat web/generated/licenses.json || true fi - name: Check formatting shell: bash run: | set -euo pipefail # On `pull_request` the checkout is the MERGE REF, whose first parent is # the base branch tip. `pull_request.base.sha` is the base tip from when # the PR event fired, so it is an ANCESTOR of that merge ref — which # makes `base...HEAD` collapse to a two-dot diff and list everything # main landed since the PR opened. Over-broad is harmless here (the # extra files are already formatted), but it is the same trap the i18n # ratchet below hit for real, so do not copy the old idiom. The fork # point is what "changed in this PR" actually means. if [[ "${{ github.event_name }}" == "pull_request" ]]; then BASE_SHA="$(git merge-base HEAD "origin/${{ github.base_ref }}")" else BASE_SHA="${{ github.event.before }}" fi if [[ -z "${BASE_SHA}" || "${BASE_SHA}" == "0000000000000000000000000000000000000000" ]]; then BASE_SHA="$(git rev-list --max-parents=0 HEAD)" fi CHANGED_FILES="$( git diff --name-only --diff-filter=ACMRT "${BASE_SHA}" HEAD \ | grep -E '^apps/(web|cli|packages)/.*\.(ts|tsx|js|jsx|mjs|cjs|json|md|mdx|yml|yaml|css|scss)$' \ || true )" if [[ -z "${CHANGED_FILES}" ]]; then echo "No Prettier-scoped files changed." exit 0 fi # Skip symlinks — prettier errors with exit 123 when an explicit # pattern is a symbolic link. CLAUDE.md files in the tree are symlinks # to sibling AGENTS.md files (Codex / Claude Code convention). FILES_TO_CHECK="$( echo "${CHANGED_FILES}" \ | sed 's#^apps/##' \ | while IFS= read -r f; do [ -L "$f" ] || echo "$f"; done )" if [[ -z "${FILES_TO_CHECK}" ]]; then echo "No non-symlink Prettier-scoped files changed." exit 0 fi echo "Checking Prettier on changed files:" echo "${FILES_TO_CHECK}" echo "${FILES_TO_CHECK}" | xargs pnpm exec prettier --check --ignore-unknown - name: Run lint run: pnpm --filter @kandev/web lint # Unlike the eslint literal-string guard (scoped to already-migrated paths # via i18nGuardFiles), these four checks scan components/app/hooks/lib # repo-wide. Each one pins a class of i18n bug that fails silently at # runtime: a key with no catalog entry, tag markup rendered # verbatim, an English plural ending passed as a value, and t() at module # scope frozen at the boot locale. See docs/i18n.md. - name: Run i18n checks run: pnpm --filter @kandev/web i18n:check # New-code ratchet. The eslint literal guard is an error only on migrated # paths, which leaves new files under un-migrated directories unguarded. # These two judge the CHANGE instead of the FILE: an added file must be # clean outright, a modified file only on the lines it touched, and the # guard allowlist may not shrink. Same model as # `golangci-lint --new-from-rev` for Go. - name: Run i18n new-code ratchet shell: bash # The job defaults to `apps`; these scripts live one level deeper. working-directory: apps/web run: | set -euo pipefail # DO NOT pass --base on pull_request. The checkout is the merge ref # `refs/pull/N/merge`, and `pull_request.base.sha` is the base branch tip # from when the PR event fired — an ancestor of that merge ref. Handing # it in made the ratchet judge every commit main landed since the PR # opened as this PR's new code, failing PRs on files they never touched # (#2160). The scripts' own default, `merge-base HEAD origin/main`, # resolves to the merge ref's base-side parent and is correct here; # origin/main is present because the checkout is fetch-depth: 0. if [[ "${{ github.event_name }}" == "pull_request" ]]; then node scripts/run-i18n-ratchet.mjs exit 0 fi # push: HEAD *is* the new base branch tip, so there is no fork point to # find and the previous tip is the only meaningful base. BASE_SHA="${{ github.event.before }}" if [[ -z "${BASE_SHA}" || "${BASE_SHA}" == "0000000000000000000000000000000000000000" ]]; then echo "No usable base SHA; skipping the new-code ratchet." exit 0 fi node scripts/run-i18n-ratchet.mjs --base "${BASE_SHA}" - name: Run tests run: pnpm --filter @kandev/web test - name: Build run: pnpm --filter @kandev/web build