monorepo.yml

name: Monorepo
permissions:
  contents: read

env:
  # Define supported runtime versions for matrix expansion once for the workflow.
  NODE_VERSIONS_JSON: "[22,24,26]"
  MONGODB_VERSIONS_JSON: '["7","8"]'
  REDIS_VERSION: "7"
  POSTGRES_VERSION: "16"
  # AI live smoke runs once; its mongo version must be one of MONGODB_VERSIONS_JSON
  # so the image comes from the shared docker cache.
  AI_SMOKE_NODE_VERSION: "24"
  AI_SMOKE_MONGODB_VERSION: "8"

on:
  push:
    branches:
      - main
  pull_request:
    branches:
      - "*"
  schedule:
    - cron: "0 0 * * *"
  workflow_dispatch:
    inputs:
      run_all:
        description: Force tests for every package
        required: false
        type: boolean
        default: false
      ai_smoke_only:
        description: Run only the AI live smoke tests (skips package tests)
        required: false
        type: boolean
        default: false

jobs:
  setup:
    name: Impacted packages
    runs-on: ubuntu-latest
    env:
      # DO NOT CHANGE BELOW THIS LINE UNLESS YOU KNOW WHAT YOU ARE DOING
      # DEFAULT_BRANCH tells the detector which branch to diff against when calculating impact.
      DEFAULT_BRANCH: ${{ github.event_name == 'pull_request' && github.event.pull_request.base.ref || github.event.repository.default_branch || 'main' }}
      # BASE_SHA narrows the diff to the merge-base (PR) or latest push SHA for branch builds.
      BASE_SHA: ${{ github.event_name == 'pull_request' && github.event.pull_request.base.sha || github.event.before || '' }}
      # FORCE_ALL flips to true when the workflow_dispatch input is toggled so every package runs.
      FORCE_ALL: ${{ (github.event_name == 'schedule' || inputs.run_all == true || inputs.run_all == 'true') && 'true' || 'false' }}
    outputs:
      matrix: ${{ steps.impact.outputs.matrix }}
      runtime-matrix: ${{ steps.runtime-matrix.outputs.runtime_matrix }}
      node-versions: ${{ steps.node-versions.outputs.node_versions }}
      has-packages: ${{ steps.impact.outputs.has_packages }}
    steps:
      - name: Git checkout
        uses: actions/checkout@v5
        with:
          fetch-depth: 0

      - name: Prepare merge-base context
        run: git fetch origin "$DEFAULT_BRANCH" --depth=1 || true

      - name: Detect impacted packages
        id: impact
        run: |
          node .github/workflows/scripts/detect-impacted-packages.mjs > impact.json
          echo "matrix=$(jq -c '.matrix' impact.json)" >> "$GITHUB_OUTPUT"
          echo "has_packages=$(jq -r '.hasPackages' impact.json)" >> "$GITHUB_OUTPUT"
          cat impact.json | jq '.'

      - name: Expand runtime matrix
        id: runtime-matrix
        # Replace "forbidden" characters to prevent GitHub Actions parsing issues.
        # It looks odd, but it's a safety measure for edge cases.
        run: |
          node .github/workflows/scripts/expand-runtime-matrix.mjs --impact impact.json > runtime-matrix.json
          cat runtime-matrix.json | jq '.'
          matrix_json=$(jq -c '.' runtime-matrix.json)
          matrix_json=${matrix_json//'%'/'%25'}
          matrix_json=${matrix_json//$'\n'/'%0A'}
          matrix_json=${matrix_json//$'\r'/'%0D'}
          echo "runtime_matrix=$matrix_json" >> "$GITHUB_OUTPUT"

      - name: Export node versions
        id: node-versions
        run: echo "node_versions=${{ env.NODE_VERSIONS_JSON }}" >> "$GITHUB_OUTPUT"

  shared-runtime:
    name: Shared runtime
    runs-on: ubuntu-latest
    needs: setup
    # The AI smoke job needs the lockfile and images even when no package is impacted
    if: needs.setup.outputs.has-packages == 'true' || inputs.ai_smoke_only == true
    outputs:
      docker-cache-key: ${{ steps.docker-key.outputs.key }}
    steps:
      - name: Git checkout
        uses: actions/checkout@v5
        with:
          fetch-depth: 0

      - name: Use Node.js 22
        uses: actions/setup-node@v4
        with:
          node-version: 22

      - name: Install pnpm
        uses: pnpm/action-setup@v4
        with:
          version: 10.18.0

      - name: Generate pnpm lockfile
        run: pnpm install --lockfile-only --ignore-scripts

      - name: Upload pnpm lockfile
        uses: actions/upload-artifact@v4
        with:
          name: pnpm-lock
          path: pnpm-lock.yaml
          retention-days: 30

      - name: Determine cache month
        id: cache-month
        run: echo "value=$(date -u +%Y-%m)" >> "$GITHUB_OUTPUT"

      - name: Declare docker cache key
        id: docker-key
        run: |
          month='${{ steps.cache-month.outputs.value }}'
          mongo_suffix=$(jq -r '.[]' <<< '${{ env.MONGODB_VERSIONS_JSON }}' | paste -sd'-' -)
          echo "key=docker-images-${month}-mongo${mongo_suffix}-redis${{ env.REDIS_VERSION }}-pg${{ env.POSTGRES_VERSION }}" >> "$GITHUB_OUTPUT"

      - name: Restore docker image cache
        id: docker-cache
        uses: actions/cache@v4
        with:
          path: .github/docker-cache
          key: ${{ steps.docker-key.outputs.key }}

      - name: Pull and save docker images
        if: steps.docker-cache.outputs.cache-hit != 'true'
        run: |
          mkdir -p .github/docker-cache
          jq -r '.[]' <<< '${{ env.MONGODB_VERSIONS_JSON }}' | while read -r version; do
            docker pull "mongo:${version}"
            docker save "mongo:${version}" -o ".github/docker-cache/mongo-${version}.tar"
          done
          docker pull "redis:${{ env.REDIS_VERSION }}"
          docker save "redis:${{ env.REDIS_VERSION }}" -o ".github/docker-cache/redis-${{ env.REDIS_VERSION }}.tar"
          docker pull "postgres:${{ env.POSTGRES_VERSION }}"
          docker save "postgres:${{ env.POSTGRES_VERSION }}" -o ".github/docker-cache/postgres-${{ env.POSTGRES_VERSION }}.tar"

  package-tests:
    name: ${{ format('{0} ({1}, {2}{3})', matrix.group, matrix.nodeVersion, matrix.adapter || 'n/a', matrix.needsMongo && format(' mongo {0}', matrix.mongodbVersion) || '') }}
    needs:
      - setup
      - shared-runtime
    if: needs.setup.outputs.has-packages == 'true' && inputs.ai_smoke_only != true
    runs-on: ubuntu-latest
    env:
      # False on fork PRs, where secrets are unavailable.
      HAS_PRO_KEY: ${{ secrets.AUTOMATIC_TRANSLATION_DEPLOYMENT_KEY != '' }}
    strategy:
      fail-fast: false
      matrix: ${{ fromJson(needs.setup.outputs['runtime-matrix']) }}
    steps:
      - name: Git checkout
        uses: actions/checkout@v5
        with:
          fetch-depth: 0

      - name: Download pnpm lockfile
        uses: actions/download-artifact@v4
        with:
          name: pnpm-lock
          path: .

      - name: Install pnpm
        uses: pnpm/action-setup@v4
        with:
          version: 10.18.0

      - name: Use Node.js ${{ matrix.nodeVersion }}
        uses: actions/setup-node@v4
        with:
          node-version: ${{ matrix.nodeVersion }}
          cache: pnpm
          cache-dependency-path: pnpm-lock.yaml

      - name: Grant private repositories access
        if: env.HAS_PRO_KEY == 'true'
        uses: webfactory/ssh-agent@v0.9.0
        with:
          ssh-private-key: |
            ${{ secrets.AUTOMATIC_TRANSLATION_DEPLOYMENT_KEY }}

      - name: Restore docker image cache
        id: docker-cache-restore
        uses: actions/cache/restore@v4
        if: matrix.needsMongo || matrix.needsRedis || matrix.needsPostgres
        with:
          path: .github/docker-cache
          key: ${{ needs.shared-runtime.outputs.docker-cache-key }}

      - name: Load cached Mongo image
        if: steps.docker-cache-restore.outputs.cache-hit == 'true' && matrix.needsMongo
        run: docker load -i ".github/docker-cache/mongo-${{ matrix.mongodbVersion }}.tar"

      - name: Load cached Redis image
        if: steps.docker-cache-restore.outputs.cache-hit == 'true' && matrix.needsRedis
        run: docker load -i .github/docker-cache/redis-${{ env.REDIS_VERSION }}.tar

      - name: Pull Mongo image (cache miss)
        if: steps.docker-cache-restore.outputs.cache-hit != 'true' && matrix.needsMongo
        run: docker pull mongo:${{ matrix.mongodbVersion }}

      - name: Pull Redis image (cache miss)
        if: steps.docker-cache-restore.outputs.cache-hit != 'true' && matrix.needsRedis
        run: docker pull redis:${{ env.REDIS_VERSION }}

      - name: Load cached Postgres image
        if: steps.docker-cache-restore.outputs.cache-hit == 'true' && matrix.needsPostgres
        run: docker load -i ".github/docker-cache/postgres-${{ env.POSTGRES_VERSION }}.tar"

      - name: Pull Postgres image (cache miss)
        if: steps.docker-cache-restore.outputs.cache-hit != 'true' && matrix.needsPostgres
        run: docker pull postgres:${{ env.POSTGRES_VERSION }}

      - name: Start MongoDB
        if: matrix.needsMongo
        run: |
          docker rm -f mongo >/dev/null 2>&1 || true
          docker run -d \
            --name mongo \
            --publish 27017:27017 \
            --health-cmd "mongosh --quiet --eval 'db.runCommand({ ping: 1 })'" \
            --health-interval 5s \
            --health-timeout 5s \
            --health-retries 12 \
            mongo:${{ matrix.mongodbVersion }}
          echo "Waiting for MongoDB to report healthy..."
          for attempt in $(seq 1 60); do
            status=$(docker inspect --format='{{.State.Health.Status}}' mongo 2>/dev/null || echo "starting")
            if [ "$status" = "healthy" ]; then
              exit 0
            fi
            if [ "$status" = "unhealthy" ]; then
              echo "MongoDB reported unhealthy" >&2
              docker logs mongo
              exit 1
            fi
            sleep 2
          done
          echo "MongoDB failed to become healthy in time" >&2
          docker logs mongo
          exit 1

      - name: Start Redis
        if: matrix.needsRedis
        run: |
          docker rm -f redis >/dev/null 2>&1 || true
          docker run -d \
            --name redis \
            --publish 6379:6379 \
            --health-cmd "redis-cli ping || exit 1" \
            --health-interval 5s \
            --health-timeout 5s \
            --health-retries 12 \
            redis:${{ env.REDIS_VERSION }}
          echo "Waiting for Redis to report healthy..."
          for attempt in $(seq 1 60); do
            status=$(docker inspect --format='{{.State.Health.Status}}' redis 2>/dev/null || echo "starting")
            if [ "$status" = "healthy" ]; then
              exit 0
            fi
            if [ "$status" = "unhealthy" ]; then
              echo "Redis reported unhealthy" >&2
              docker logs redis
              exit 1
            fi
            sleep 2
          done
          echo "Redis failed to respond in time" >&2
          docker logs redis
          exit 1

      - name: Start PostgreSQL
        if: matrix.needsPostgres
        run: |
          docker rm -f postgres >/dev/null 2>&1 || true
          docker run -d \
            --name postgres \
            --publish 5432:5432 \
            -e POSTGRES_HOST_AUTH_METHOD=trust \
            --health-cmd "pg_isready -U postgres" \
            --health-interval 5s \
            --health-timeout 5s \
            --health-retries 12 \
            postgres:${{ env.POSTGRES_VERSION }}
          echo "Waiting for PostgreSQL to report healthy..."
          for attempt in $(seq 1 60); do
            status=$(docker inspect --format='{{.State.Health.Status}}' postgres 2>/dev/null || echo "starting")
            if [ "$status" = "healthy" ]; then
              exit 0
            fi
            if [ "$status" = "unhealthy" ]; then
              echo "PostgreSQL reported unhealthy" >&2
              docker logs postgres
              exit 1
            fi
            sleep 2
          done
          echo "PostgreSQL failed to become healthy in time" >&2
          docker logs postgres
          exit 1

      - name: Install workspace dependencies
        run: pnpm install --frozen-lockfile

      - name: Run package tests
        run: |
          failed=0
          for pkg in $(echo '${{ matrix.packages }}' | jq -r '.[]'); do
            echo "::group::Testing $pkg"
            if ! pnpm run --filter "$pkg" --if-present test; then
              echo "::error::Tests failed for $pkg"
              failed=1
            fi
            echo "::endgroup::"
          done
          exit $failed
        env:
          CI: true
          # Yes we want import-export to test with automatic-translation,
          # but only when the deploy key is available (not on fork PRs).
          TEST_WITH_PRO: ${{ env.HAS_PRO_KEY == 'true' && '1' || '' }}
          # Adapter selection: mongodb (default), postgres, or sqlite.
          # ADAPTER is used by db-connect tests, APOS_TEST_DB_PROTOCOL by apostrophe tests.
          ADAPTER: ${{ matrix.adapter }}
          APOS_TEST_DB_PROTOCOL: ${{ matrix.adapter }}
          PGUSER: postgres

      - name: Stop PostgreSQL
        if: always() && matrix.needsPostgres
        run: docker rm -f postgres || true

      - name: Stop Redis
        if: always() && matrix.needsRedis
        run: docker rm -f redis || true

      - name: Stop MongoDB
        if: always() && matrix.needsMongo
        run: docker rm -f mongo || true

  # Live provider calls: nightly and manual runs only, so every push does not
  # spend tokens. The keys reach the one step that needs them, never the
  # install; fork PRs never get here.
  ai-smoke:
    name: AI live smoke
    needs: shared-runtime
    if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'
    runs-on: ubuntu-latest
    steps:
      - name: Git checkout
        uses: actions/checkout@v5
        with:
          persist-credentials: false

      - name: Download pnpm lockfile
        uses: actions/download-artifact@v4
        with:
          name: pnpm-lock
          path: .

      - name: Install pnpm
        uses: pnpm/action-setup@v4
        with:
          version: 10.18.0

      - name: Use Node.js ${{ env.AI_SMOKE_NODE_VERSION }}
        uses: actions/setup-node@v4
        with:
          node-version: ${{ env.AI_SMOKE_NODE_VERSION }}
          cache: pnpm
          cache-dependency-path: pnpm-lock.yaml

      - name: Restore docker image cache
        id: docker-cache-restore
        uses: actions/cache/restore@v4
        with:
          path: .github/docker-cache
          key: ${{ needs.shared-runtime.outputs.docker-cache-key }}

      - name: Load cached Mongo image
        if: steps.docker-cache-restore.outputs.cache-hit == 'true'
        run: docker load -i ".github/docker-cache/mongo-${{ env.AI_SMOKE_MONGODB_VERSION }}.tar"

      - name: Pull Mongo image (cache miss)
        if: steps.docker-cache-restore.outputs.cache-hit != 'true'
        run: docker pull mongo:${{ env.AI_SMOKE_MONGODB_VERSION }}

      - name: Start MongoDB
        run: |
          docker rm -f mongo >/dev/null 2>&1 || true
          docker run -d \
            --name mongo \
            --publish 27017:27017 \
            --health-cmd "mongosh --quiet --eval 'db.runCommand({ ping: 1 })'" \
            --health-interval 5s \
            --health-timeout 5s \
            --health-retries 12 \
            mongo:${{ env.AI_SMOKE_MONGODB_VERSION }}
          echo "Waiting for MongoDB to report healthy..."
          for attempt in $(seq 1 60); do
            status=$(docker inspect --format='{{.State.Health.Status}}' mongo 2>/dev/null || echo "starting")
            if [ "$status" = "healthy" ]; then
              exit 0
            fi
            if [ "$status" = "unhealthy" ]; then
              echo "MongoDB reported unhealthy" >&2
              docker logs mongo
              exit 1
            fi
            sleep 2
          done
          echo "MongoDB failed to become healthy in time" >&2
          docker logs mongo
          exit 1

      - name: Install workspace dependencies
        run: pnpm install --frozen-lockfile

      - name: Run AI smoke tests
        working-directory: packages/apostrophe
        run: pnpm exec mocha -t 60000 test/ai-smoke.js
        env:
          CI: true
          APOS_AI_SMOKE: '1'
          APOS_ANTHROPIC_KEY: ${{ secrets.APOS_ANTHROPIC_KEY }}
          APOS_OPENAI_KEY: ${{ secrets.APOS_OPENAI_KEY }}
          APOS_GEMINI_KEY: ${{ secrets.APOS_GEMINI_KEY }}

      - name: Stop MongoDB
        if: always()
        run: docker rm -f mongo || true