ci-reusable.yml

# Reusable CI workflow for btravstack repos. Consumers call it from a thin
# `.github/workflows/ci.yml`:
#
#   name: CI
#   on:
#     push: { branches: [main] }
#     pull_request: { branches: [main] }
#   jobs:
#     ci:
#       uses: btravstack/tools/.github/workflows/ci-reusable.yml@workflows-v1
#       with:
#         changeset: true          # contract repos that enforce changesets
#         integration-tests: true  # run the integration suite
#         node-versions: '["", "22.19"]'  # test the primary + the engines floor
#
# Each check is its OWN job so the PR check summary lists them individually
# (Format, Lint, Type Check, …) rather than one opaque job. The unit/integration
# test commands and bundle-size reporting are standardized here (identical across
# repos) — callers only toggle what genuinely differs (integration, changeset,
# node-floor). knip runs standalone (repos scope `!generated` in knip.json, so no
# codegen pre-step is needed). Every job restores the `.turbo` cache.
name: CI (reusable)

on:
  workflow_call:
    inputs:
      knip:
        description: "Run the Knip job."
        type: boolean
        default: true
      changeset:
        description: "Run the changeset-status job on PRs."
        type: boolean
        default: false
      security-audit:
        description: "Run the security-audit job."
        type: boolean
        default: true
      bundle-size:
        description: "Run the bundle-size report job."
        type: boolean
        default: true
      integration-tests:
        description: "Run the integration-tests job."
        type: boolean
        default: false
      test-command:
        description: "Unit test command (standardized; override only if a repo truly differs)."
        type: string
        default: "pnpm test -- --coverage --reporter=default --reporter=github-actions"
      integration-command:
        description: "Integration test command (capped concurrency for testcontainers)."
        type: string
        default: "pnpm test:integration --concurrency 3 -- --coverage --reporter=default --reporter=github-actions"
      node-versions:
        description: 'JSON array of Node versions the test job runs on; "" = the .node-version file. e.g. ["", "22.19"] tests the primary + the engines floor.'
        type: string
        default: '[""]'
      node-version-file:
        description: "File the primary Node version is read from."
        type: string
        default: ".node-version"

permissions:
  contents: read

env:
  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true

jobs:
  format:
    name: Format
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4.3.0
      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
        with:
          node-version-file: ${{ inputs.node-version-file }}
          cache: pnpm
      - uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
        with:
          path: .turbo
          key: ${{ runner.os }}-turbo-${{ github.sha }}
          restore-keys: ${{ runner.os }}-turbo-
      - run: pnpm install --frozen-lockfile
      - run: pnpm format --check

  lint:
    name: Lint
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4.3.0
      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
        with:
          node-version-file: ${{ inputs.node-version-file }}
          cache: pnpm
      - uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
        with:
          path: .turbo
          key: ${{ runner.os }}-turbo-${{ github.sha }}
          restore-keys: ${{ runner.os }}-turbo-
      - run: pnpm install --frozen-lockfile
      - run: pnpm lint

  typecheck:
    name: Type Check
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4.3.0
      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
        with:
          node-version-file: ${{ inputs.node-version-file }}
          cache: pnpm
      - uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
        with:
          path: .turbo
          key: ${{ runner.os }}-turbo-${{ github.sha }}
          restore-keys: ${{ runner.os }}-turbo-
      - run: pnpm install --frozen-lockfile
      - run: pnpm typecheck

  build:
    name: Build
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4.3.0
      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
        with:
          node-version-file: ${{ inputs.node-version-file }}
          cache: pnpm
      - uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
        with:
          path: .turbo
          key: ${{ runner.os }}-turbo-${{ github.sha }}
          restore-keys: ${{ runner.os }}-turbo-
      - run: pnpm install --frozen-lockfile
      - run: pnpm build

  knip:
    name: Knip
    if: ${{ inputs.knip }}
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4.3.0
      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
        with:
          node-version-file: ${{ inputs.node-version-file }}
          cache: pnpm
      - uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
        with:
          path: .turbo
          key: ${{ runner.os }}-turbo-${{ github.sha }}
          restore-keys: ${{ runner.os }}-turbo-
      - run: pnpm install --frozen-lockfile
      - run: pnpm exec knip --reporter github-actions

  test:
    # "" -> the .node-version file (shows as "Tests"); a version -> "Tests (Node <ver>)".
    name: Tests${{ matrix.node != '' && format(' (Node {0})', matrix.node) || '' }}
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        node: ${{ fromJSON(inputs.node-versions) }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4.3.0
      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
        with:
          # setup-node ignores an empty node-version and falls back to the file.
          node-version: ${{ matrix.node }}
          node-version-file: ${{ inputs.node-version-file }}
          cache: pnpm
      - uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
        with:
          path: .turbo
          key: ${{ runner.os }}-turbo-node${{ matrix.node }}-${{ github.sha }}
          restore-keys: ${{ runner.os }}-turbo-
      - run: pnpm install --frozen-lockfile
      - run: ${{ inputs.test-command }}

  security-audit:
    name: Security Audit
    if: ${{ inputs.security-audit }}
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4.3.0
      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
        with:
          node-version-file: ${{ inputs.node-version-file }}
          cache: pnpm
      - run: pnpm install --frozen-lockfile
      - run: pnpm audit --audit-level=high

  changeset:
    name: Changeset
    if: >-
      ${{ inputs.changeset
          && github.event_name == 'pull_request'
          && !(github.head_ref == 'changeset-release/main'
               && github.event.pull_request.head.repo.full_name == github.repository) }}
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
      - uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4.3.0
      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
        with:
          node-version-file: ${{ inputs.node-version-file }}
          cache: pnpm
      - run: pnpm install --frozen-lockfile
      - run: |
          git fetch --no-tags origin main
          pnpm exec changeset status --since=origin/main

  bundle-size:
    name: Bundle Size
    if: ${{ inputs.bundle-size }}
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4.3.0
      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
        with:
          node-version-file: ${{ inputs.node-version-file }}
          cache: pnpm
      - uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
        with:
          path: .turbo
          key: ${{ runner.os }}-turbo-${{ github.sha }}
          restore-keys: ${{ runner.os }}-turbo-
      - run: pnpm install --frozen-lockfile
      - run: pnpm build
      - name: Report bundle sizes
        run: |
          echo "## Bundle Sizes" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "| Package | Size |" >> $GITHUB_STEP_SUMMARY
          echo "|---------|------|" >> $GITHUB_STEP_SUMMARY
          for pkg in packages/*/dist; do
            if [ -d "$pkg" ]; then
              size=$(du -sh "$pkg" 2>/dev/null | cut -f1)
              name=$(basename "$(dirname "$pkg")")
              echo "| $name | $size |" >> $GITHUB_STEP_SUMMARY
            fi
          done

  integration:
    name: Integration Tests
    if: ${{ inputs.integration-tests }}
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4.3.0
      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
        with:
          node-version-file: ${{ inputs.node-version-file }}
          cache: pnpm
      - uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
        with:
          path: .turbo
          key: ${{ runner.os }}-turbo-${{ github.sha }}
          restore-keys: ${{ runner.os }}-turbo-
      - run: pnpm install --frozen-lockfile
      - run: ${{ inputs.integration-command }}