WebMetal/.github/workflows/ci.yml

name: CI

on:
  push:
    branches: [main]
  pull_request:
  workflow_dispatch:

# Superseded runs of the same PR/branch are cancelled to save runner time.
concurrency:
  group: ci-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

env:
  EMSDK_VERSION: 5.0.7 # keep in sync with scripts/build-wasm.sh

jobs:
  cpp-tests:
    name: C++ engine (native tests)
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@v4
      - name: Configure
        run: cmake -S wasm -B wasm/build-native
      - name: Build
        run: cmake --build wasm/build-native --parallel
      - name: Test
        run: ctest --test-dir wasm/build-native --output-on-failure

  wasm:
    name: WASM engine build
    runs-on: ubuntu-latest
    timeout-minutes: 20
    steps:
      - uses: actions/checkout@v4
      - uses: emscripten-core/setup-emsdk@v15
        with:
          version: 5.0.7
          actions-cache-folder: emsdk-cache
      - name: Build engine to WebAssembly
        run: ./scripts/build-wasm.sh
      - name: Conformance vectors against the wasm build (Node)
        run: |
          emcmake cmake -S wasm -B wasm/build-wasm -DCMAKE_BUILD_TYPE=Release -DWEBMETAL_BUILD_NODE_TEST=ON
          cmake --build wasm/build-wasm --parallel
          node scripts/run-conformance-node.mjs
      - uses: actions/upload-artifact@v4
        with:
          name: webmetal-wasm
          path: frontend/public/wasm/
          if-no-files-found: error

  frontend:
    name: Frontend (lint, typecheck, test, build)
    runs-on: ubuntu-latest
    timeout-minutes: 15
    defaults:
      run:
        working-directory: frontend
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: 22
          cache: npm
          cache-dependency-path: frontend/package-lock.json
      - name: Install dependencies
        run: npm ci
      - name: Lint
        run: npm run lint
      - name: Format check
        run: npm run format:check
      - name: Typecheck
        run: npm run typecheck
      - name: Test (unit + conformance + bundled examples)
        run: npm test
      - name: Build (without wasm - must succeed standalone)
        run: npm run build

  integration:
    name: Integration (frontend + wasm together)
    runs-on: ubuntu-latest
    timeout-minutes: 15
    needs: wasm
    defaults:
      run:
        working-directory: frontend
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: 22
          cache: npm
          cache-dependency-path: frontend/package-lock.json
      - uses: actions/download-artifact@v4
        with:
          name: webmetal-wasm
          path: frontend/public/wasm/
      - name: Install dependencies
        run: npm ci
      - name: Build with the engine present
        run: npm run build
      - name: Verify the engine ships in dist/
        run: |
          test -f dist/wasm/webmetal-engine.mjs
          test -f dist/wasm/webmetal-engine.wasm
      - name: Verify dist/ is subdirectory-safe (relative asset paths)
        run: |
          grep -q 'src="\./assets/' dist/index.html
          grep -q 'href="\./' dist/index.html
          if grep -q '"/assets/' dist/index.html; then
            echo 'index.html references absolute /assets/ paths' >&2
            exit 1
          fi
      - name: Upload ready-to-deploy site
        uses: actions/upload-artifact@v4
        with:
          name: webmetal-dist
          path: frontend/dist/
          if-no-files-found: error
          retention-days: 30

  # Single aggregate check for branch protection: require only this job.
  ci-ok:
    name: CI passed
    runs-on: ubuntu-latest
    timeout-minutes: 5
    needs: [cpp-tests, wasm, frontend, integration]
    if: always()
    steps:
      - name: Check that every job succeeded
        run: |
          results='${{ join(needs.*.result, ' ') }}'
          echo "job results: $results"
          for r in $results; do
            if [ "$r" != "success" ]; then
              echo "a required job did not succeed" >&2
              exit 1
            fi
          done