kandev/.github/workflows/frontend-tests.yml

name: Frontend Tests

on:
  push:
    branches: [main]
    paths:
      - "apps/cli/**"
      - "apps/package.json"
      - "apps/prettier.config.mjs"
      - "apps/.prettierignore"
      - "apps/web/**"
      - "apps/packages/**"
      - "apps/pnpm-lock.yaml"
      - "apps/backend/go.mod"
      - "apps/backend/go.sum"
      - ".github/workflows/frontend-tests.yml"
      - "!**/*.md"
      - "!**/*.mdx"
      - "!**/*.markdown"
  pull_request:
    branches: [main]
    paths:
      - "apps/cli/**"
      - "apps/package.json"
      - "apps/prettier.config.mjs"
      - "apps/.prettierignore"
      - "apps/web/**"
      - "apps/packages/**"
      - "apps/pnpm-lock.yaml"
      - "apps/backend/go.mod"
      - "apps/backend/go.sum"
      - ".github/workflows/frontend-tests.yml"
      - "!**/*.md"
      - "!**/*.mdx"
      - "!**/*.markdown"

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

# Least-privilege: the `frontend` job only reads source and runs tests.
# `packages: read` lets the container job pull the kandev-ci image from GHCR.
permissions:
  contents: read
  packages: read

jobs:
  frontend:
    name: Run Frontend Lint, Tests, and Build
    runs-on: ubuntu-latest
    # Pre-baked image bundles Node 24, pnpm 9.15.9, Go, and go-licenses —
    # see .github/docker/ci-base/Dockerfile.
    container: ghcr.io/kdlbs/kandev-ci:build-latest
    defaults:
      run:
        # Container jobs default to `sh` (dash); pin to bash for `set -euo
        # pipefail` and other bash-isms used by the formatting / licenses steps.
        shell: bash
        working-directory: apps

    steps:
      - name: Checkout code
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
        with:
          fetch-depth: 0

      - name: Mark workspace safe for git
        shell: bash
        working-directory: ${{ github.workspace }}
        run: git config --global --add safe.directory "$GITHUB_WORKSPACE"

      - name: Cache pnpm store
        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
        with:
          path: ~/.local/share/pnpm/store
          key: pnpm-${{ runner.os }}-${{ hashFiles('apps/pnpm-lock.yaml') }}
          restore-keys: pnpm-${{ runner.os }}-

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Regenerate OSS licenses manifest
        run: pnpm --filter @kandev/web licenses:gen

      - name: Verify licenses manifest is fresh
        shell: bash
        continue-on-error: true
        run: |
          set -euo pipefail
          # `defaults.run.working-directory` is `apps`, so the path is relative.
          # The diff is reported as a warning, not a hard failure: `go-licenses`
          # resolves slightly different license metadata across platforms (macOS
          # dev vs. ubuntu CI) for the same Go modules, and we have not yet
          # eliminated that drift. The committed file is still the source of
          # truth for what the page renders.
          if ! git diff --quiet --exit-code web/generated/licenses.json; then
            echo "::warning::apps/web/generated/licenses.json differs from a fresh re-run."
            echo "::warning::Run 'pnpm --filter @kandev/web licenses:gen' and commit if the drift is real."
            git --no-pager diff --stat web/generated/licenses.json || true
          fi

      - name: Check formatting
        shell: bash
        run: |
          set -euo pipefail

          if [[ "${{ github.event_name }}" == "pull_request" ]]; then
            BASE_SHA="${{ github.event.pull_request.base.sha }}"
          else
            BASE_SHA="${{ github.event.before }}"
          fi

          if [[ -z "${BASE_SHA}" || "${BASE_SHA}" == "0000000000000000000000000000000000000000" ]]; then
            BASE_SHA="$(git rev-list --max-parents=0 HEAD)"
          fi

          CHANGED_FILES="$(
            git diff --name-only --diff-filter=ACMRT "${BASE_SHA}"..."${{ github.sha }}" \
            | grep -E '^apps/(web|cli|packages)/.*\.(ts|tsx|js|jsx|mjs|cjs|json|md|mdx|yml|yaml|css|scss)$' \
            || true
          )"

          if [[ -z "${CHANGED_FILES}" ]]; then
            echo "No Prettier-scoped files changed."
            exit 0
          fi

          # Skip symlinks — prettier errors with exit 123 when an explicit
          # pattern is a symbolic link. CLAUDE.md files in the tree are symlinks
          # to sibling AGENTS.md files (Codex / Claude Code convention).
          FILES_TO_CHECK="$(
            echo "${CHANGED_FILES}" \
              | sed 's#^apps/##' \
              | while IFS= read -r f; do [ -L "$f" ] || echo "$f"; done
          )"

          if [[ -z "${FILES_TO_CHECK}" ]]; then
            echo "No non-symlink Prettier-scoped files changed."
            exit 0
          fi

          echo "Checking Prettier on changed files:"
          echo "${FILES_TO_CHECK}"
          echo "${FILES_TO_CHECK}" | xargs pnpm exec prettier --check --ignore-unknown

      - name: Run lint
        run: pnpm --filter @kandev/web lint

      # Unlike the eslint literal-string guard (scoped to already-migrated paths
      # via i18nGuardFiles), these four checks scan components/app/hooks/lib
      # repo-wide. Each one pins a class of i18n bug that fails silently at
      # runtime: a key with no catalog entry, <Trans> tag markup rendered
      # verbatim, an English plural ending passed as a value, and t() at module
      # scope frozen at the boot locale. See docs/i18n.md.
      - name: Run i18n checks
        run: pnpm --filter @kandev/web i18n:check

      # New-code ratchet. The eslint literal guard is an error only on migrated
      # paths, which leaves new files under un-migrated directories unguarded.
      # These two judge the CHANGE instead of the FILE: an added file must be
      # clean outright, a modified file only on the lines it touched, and the
      # guard allowlist may not shrink. Same model as
      # `golangci-lint --new-from-rev` for Go. Base SHA is resolved the same way
      # as the Prettier step above.
      - name: Run i18n new-code ratchet
        shell: bash
        # The job defaults to `apps`; these scripts live one level deeper.
        working-directory: apps/web
        run: |
          set -euo pipefail

          if [[ "${{ github.event_name }}" == "pull_request" ]]; then
            BASE_SHA="${{ github.event.pull_request.base.sha }}"
          else
            BASE_SHA="${{ github.event.before }}"
          fi

          if [[ -z "${BASE_SHA}" || "${BASE_SHA}" == "0000000000000000000000000000000000000000" ]]; then
            echo "No usable base SHA; skipping the new-code ratchet."
            exit 0
          fi

          node scripts/check-new-code-i18n.mjs --base "${BASE_SHA}"
          node scripts/check-guard-allowlist.mjs --base "${BASE_SHA}"

      - name: Run tests
        run: pnpm --filter @kandev/web test

      - name: Build
        run: pnpm --filter @kandev/web build