open-design/.github/workflows/ci.yml

name: ci

on:
  pull_request:
  # Release validation is owned by the release workflows rather than this CI
  # workflow: `release-stable` has a verify job before publishing, and
  # `release-beta` builds from its selected release commit. Keep this trigger
  # focused on PRs, main, and manual reruns instead of duplicating tag/release
  # events that would run after those release workflows have already selected
  # or validated their commit.
  push:
    branches:
      - main
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: ci-${{ github.event.pull_request.number || github.ref }}
  # Prefer current-head signal over preserving superseded logs: PR authors often
  # push fixups while this workflow is still running, and stale runs can report
  # failures for commits reviewers no longer need to evaluate. Release workflows
  # use cancel-in-progress: false where preserving build evidence matters more.
  cancel-in-progress: true

jobs:
  change_scopes:
    name: Detect CI change scopes
    runs-on: ubuntu-latest
    outputs:
      daemon_tests_required: ${{ steps.detect.outputs.daemon_tests_required }}
      web_tests_required: ${{ steps.detect.outputs.web_tests_required }}
      tools_dev_tests_required: ${{ steps.detect.outputs.tools_dev_tests_required }}
      tools_pack_tests_required: ${{ steps.detect.outputs.tools_pack_tests_required }}
      workspace_validation_required: ${{ steps.detect.outputs.workspace_validation_required }}

    steps:
      - name: Checkout
        uses: actions/checkout@v6.0.2
        with:
          fetch-depth: 0

      - name: Detect workspace and app test scopes
        id: detect
        shell: bash
        run: |
          set -euo pipefail
          daemon_tests_required=false
          web_tests_required=false
          tools_dev_tests_required=false
          tools_pack_tests_required=false
          workspace_validation_required=false
          if [ "${{ github.event_name }}" = "pull_request" ]; then
            git diff --name-only "${{ github.event.pull_request.base.sha }}" "${{ github.event.pull_request.head.sha }}" > "$RUNNER_TEMP/changed-files.txt"
            while IFS= read -r file; do
              if [[ "$file" == "apps/daemon/"* || "$file" == "packages/contracts/"* || "$file" == "packages/platform/"* || "$file" == "packages/sidecar/"* || "$file" == "packages/sidecar-proto/"* ]]; then
                daemon_tests_required=true
              fi
              if [[ "$file" == "apps/web/"* || "$file" == "packages/contracts/"* || "$file" == "packages/platform/"* || "$file" == "packages/sidecar/"* || "$file" == "packages/sidecar-proto/"* ]]; then
                web_tests_required=true
              fi
              if [[ "$file" == "scripts/"* || "$file" == "assets/"* || "$file" == "skills/"* || "$file" == "prompt-templates/"* || "$file" == "design-systems/"* || "$file" == "design-templates/"* || "$file" == "craft/"* ]]; then
                daemon_tests_required=true
                web_tests_required=true
              fi
              if [[ "$file" == "tools/dev/"* || "$file" == "packages/platform/"* || "$file" == "packages/sidecar/"* || "$file" == "packages/sidecar-proto/"* ]]; then
                tools_dev_tests_required=true
              fi
              if [[ "$file" == "tools/pack/"* || "$file" == "apps/packaged/"* || "$file" == "apps/desktop/"* || "$file" == "packages/platform/"* || "$file" == "packages/sidecar/"* || "$file" == "packages/sidecar-proto/"* ]]; then
                tools_pack_tests_required=true
              fi
              if [[ "$file" == "package.json" || "$file" == "pnpm-lock.yaml" || "$file" == "pnpm-workspace.yaml" || "$file" == ".github/workflows/ci.yml" ]]; then
                daemon_tests_required=true
                web_tests_required=true
                tools_dev_tests_required=true
                tools_pack_tests_required=true
              fi
              case "$file" in
                *.md|*.mdx|*.txt|LICENSE|.gitignore|.editorconfig|.vscode/*|.idea/*|docs/*|.github/ISSUE_TEMPLATE/*|.github/CODEOWNERS)
                  ;;
                apps/landing-page/*|.github/workflows/landing-page-ci.yml|.github/workflows/landing-page-deploy.yml|.github/workflows/blog-indexing-on-deploy.yml|.github/workflows/blog-indexing-monitor.yml)
                  ;;
                *)
                  workspace_validation_required=true
                  ;;
              esac
              if [ "$daemon_tests_required" = "true" ] \
                && [ "$web_tests_required" = "true" ] \
                && [ "$tools_dev_tests_required" = "true" ] \
                && [ "$tools_pack_tests_required" = "true" ] \
                && [ "$workspace_validation_required" = "true" ]; then
                break
              fi
            done < "$RUNNER_TEMP/changed-files.txt"
            if [ "$daemon_tests_required" = "true" ] \
              || [ "$web_tests_required" = "true" ] \
              || [ "$tools_dev_tests_required" = "true" ] \
              || [ "$tools_pack_tests_required" = "true" ]; then
              workspace_validation_required=true
            fi
          else
            daemon_tests_required=true
            web_tests_required=true
            tools_dev_tests_required=true
            tools_pack_tests_required=true
            workspace_validation_required=true
          fi
          {
            echo "daemon_tests_required=$daemon_tests_required"
            echo "web_tests_required=$web_tests_required"
            echo "tools_dev_tests_required=$tools_dev_tests_required"
            echo "tools_pack_tests_required=$tools_pack_tests_required"
            echo "workspace_validation_required=$workspace_validation_required"
          } >> "$GITHUB_OUTPUT"          

  preflight:
    name: Preflight
    needs: [change_scopes]
    if: ${{ needs.change_scopes.outputs.workspace_validation_required == 'true' }}
    runs-on: ubuntu-latest
    timeout-minutes: 45

    steps:
      - name: Checkout
        uses: actions/checkout@v6.0.2

      - name: Setup pnpm
        uses: pnpm/action-setup@v6.0.8
        with:
          version: 10.33.2

      - name: Setup Node.js
        uses: actions/setup-node@v6.4.0
        with:
          node-version: 24
          package-manager-cache: false

      - name: Resolve pnpm store path
        id: pnpm-store
        shell: bash
        run: echo "path=$(pnpm store path --silent)" >> "$GITHUB_OUTPUT"

      - name: Restore pnpm store cache
        uses: actions/cache/restore@v5.0.5
        with:
          path: ${{ steps.pnpm-store.outputs.path }}
          key: pnpm-store-${{ runner.os }}-${{ hashFiles('pnpm-lock.yaml') }}

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      # `scripts/postinstall.mjs` only prebuilds package/tool entrypoints that
      # are needed immediately after install for linked bins and shared
      # sidecar/platform imports. It intentionally skips app outputs because
      # building all apps would make every install run a Next/Electron-adjacent
      # app build, even when a developer only needs packages/tools.
      #
      # Fresh CI typecheck/test still need these specific generated declarations:
      #   - `apps/daemon/dist/*.d.ts` for packaged/runtime consumers of the daemon
      #     package export
      #   - `apps/desktop/dist/main/index.d.ts` for `apps/packaged` imports of
      #     `@open-design/desktop/main`
      #   - `apps/web/dist/sidecar/index.d.ts` for `apps/packaged` imports of
      #     `@open-design/web/sidecar`
      # If postinstall grows a targeted app type-generation phase covering these
      # three exports without broad app builds, this CI prebuild can be removed.
      - name: Prebuild workspace type declarations
        run: |
          pnpm --filter @open-design/daemon build
          pnpm --filter @open-design/desktop build
          pnpm --filter @open-design/web build:sidecar          

      - name: Typecheck workspaces
        run: pnpm -r --workspace-concurrency=4 --if-present run typecheck

      - name: Check repository layout policies
        run: pnpm guard

      - name: Check i18n structure
        run: pnpm i18n:check

  core_tests:
    name: Core package tests
    needs: [change_scopes]
    if: ${{ needs.change_scopes.outputs.workspace_validation_required == 'true' }}
    runs-on: ubuntu-latest
    timeout-minutes: 20

    steps:
      - name: Checkout
        uses: actions/checkout@v6.0.2

      - name: Setup pnpm
        uses: pnpm/action-setup@v6.0.8
        with:
          version: 10.33.2

      - name: Setup Node.js
        uses: actions/setup-node@v6.4.0
        with:
          node-version: 24
          package-manager-cache: false

      - name: Resolve pnpm store path
        id: pnpm-store
        shell: bash
        run: echo "path=$(pnpm store path --silent)" >> "$GITHUB_OUTPUT"

      - name: Restore pnpm store cache
        uses: actions/cache/restore@v5.0.5
        with:
          path: ${{ steps.pnpm-store.outputs.path }}
          key: pnpm-store-${{ runner.os }}-${{ hashFiles('pnpm-lock.yaml') }}

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Core package tests
        run: |
          pnpm --filter @open-design/contracts test
          pnpm --filter @open-design/platform test
          pnpm --filter @open-design/sidecar test
          pnpm --filter @open-design/sidecar-proto test          

  tools_workspace_tests:
    name: Tools workspace tests
    needs: [change_scopes]
    if: ${{ needs.change_scopes.outputs.tools_dev_tests_required == 'true' || needs.change_scopes.outputs.tools_pack_tests_required == 'true' }}
    runs-on: ubuntu-latest
    timeout-minutes: 20

    steps:
      - name: Checkout
        uses: actions/checkout@v6.0.2

      - name: Setup pnpm
        uses: pnpm/action-setup@v6.0.8
        with:
          version: 10.33.2

      - name: Setup Node.js
        uses: actions/setup-node@v6.4.0
        with:
          node-version: 24
          package-manager-cache: false

      - name: Resolve pnpm store path
        id: pnpm-store
        shell: bash
        run: echo "path=$(pnpm store path --silent)" >> "$GITHUB_OUTPUT"

      - name: Restore pnpm store cache
        uses: actions/cache/restore@v5.0.5
        with:
          path: ${{ steps.pnpm-store.outputs.path }}
          key: pnpm-store-${{ runner.os }}-${{ hashFiles('pnpm-lock.yaml') }}

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Tools workspace smoke tests
        run: |
          if [ "${{ needs.change_scopes.outputs.tools_dev_tests_required }}" = "true" ]; then
            pnpm --filter @open-design/tools-dev test
          fi
          if [ "${{ needs.change_scopes.outputs.tools_pack_tests_required }}" = "true" ]; then
            pnpm --filter @open-design/tools-pack test
          fi          

  daemon_workspace_tests:
    name: Daemon workspace tests
    needs: [change_scopes]
    if: ${{ needs.change_scopes.outputs.daemon_tests_required == 'true' }}
    runs-on: ubuntu-latest
    timeout-minutes: 20

    steps:
      - name: Checkout
        uses: actions/checkout@v6.0.2

      - name: Setup pnpm
        uses: pnpm/action-setup@v6.0.8
        with:
          version: 10.33.2

      - name: Setup Node.js
        uses: actions/setup-node@v6.4.0
        with:
          node-version: 24
          package-manager-cache: false

      - name: Resolve pnpm store path
        id: pnpm-store
        shell: bash
        run: echo "path=$(pnpm store path --silent)" >> "$GITHUB_OUTPUT"

      - name: Restore pnpm store cache
        uses: actions/cache/restore@v5.0.5
        with:
          path: ${{ steps.pnpm-store.outputs.path }}
          key: pnpm-store-${{ runner.os }}-${{ hashFiles('pnpm-lock.yaml') }}

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Prebuild daemon entrypoint declarations
        run: pnpm --filter @open-design/daemon build

      - name: Daemon workspace tests
        run: pnpm --filter @open-design/daemon test

  web_workspace_tests:
    name: Web workspace tests
    needs: [change_scopes]
    if: ${{ needs.change_scopes.outputs.web_tests_required == 'true' }}
    runs-on: ubuntu-latest
    timeout-minutes: 20

    steps:
      - name: Checkout
        uses: actions/checkout@v6.0.2

      - name: Setup pnpm
        uses: pnpm/action-setup@v6.0.8
        with:
          version: 10.33.2

      - name: Setup Node.js
        uses: actions/setup-node@v6.4.0
        with:
          node-version: 24
          package-manager-cache: false

      - name: Resolve pnpm store path
        id: pnpm-store
        shell: bash
        run: echo "path=$(pnpm store path --silent)" >> "$GITHUB_OUTPUT"

      - name: Restore pnpm store cache
        uses: actions/cache/restore@v5.0.5
        with:
          path: ${{ steps.pnpm-store.outputs.path }}
          key: pnpm-store-${{ runner.os }}-${{ hashFiles('pnpm-lock.yaml') }}

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Prebuild web sidecar declarations
        run: pnpm --filter @open-design/web build:sidecar

      - name: Web workspace tests
        run: pnpm --filter @open-design/web test

  app_tests:
    name: App workspace tests
    needs:
      - change_scopes
      - tools_workspace_tests
      - daemon_workspace_tests
      - web_workspace_tests
    if: ${{ always() && needs.change_scopes.result == 'success' && (needs.change_scopes.outputs.tools_dev_tests_required == 'true' || needs.change_scopes.outputs.tools_pack_tests_required == 'true' || needs.change_scopes.outputs.daemon_tests_required == 'true' || needs.change_scopes.outputs.web_tests_required == 'true') }}
    runs-on: ubuntu-latest
    timeout-minutes: 5

    steps:
      - name: Check app workspace test jobs
        env:
          NEEDS_JSON: ${{ toJSON(needs) }}
          TOOLS_REQUIRED: ${{ needs.change_scopes.outputs.tools_dev_tests_required == 'true' || needs.change_scopes.outputs.tools_pack_tests_required == 'true' }}
          DAEMON_REQUIRED: ${{ needs.change_scopes.outputs.daemon_tests_required }}
          WEB_REQUIRED: ${{ needs.change_scopes.outputs.web_tests_required }}
        run: |
          set -euo pipefail
          echo "$NEEDS_JSON" | jq .
          failures=()
          if [ "$TOOLS_REQUIRED" = "true" ] && [ "$(echo "$NEEDS_JSON" | jq -r '.tools_workspace_tests.result')" != "success" ]; then
            failures+=("tools_workspace_tests=$(echo "$NEEDS_JSON" | jq -r '.tools_workspace_tests.result')")
          fi
          if [ "$DAEMON_REQUIRED" = "true" ] && [ "$(echo "$NEEDS_JSON" | jq -r '.daemon_workspace_tests.result')" != "success" ]; then
            failures+=("daemon_workspace_tests=$(echo "$NEEDS_JSON" | jq -r '.daemon_workspace_tests.result')")
          fi
          if [ "$WEB_REQUIRED" = "true" ] && [ "$(echo "$NEEDS_JSON" | jq -r '.web_workspace_tests.result')" != "success" ]; then
            failures+=("web_workspace_tests=$(echo "$NEEDS_JSON" | jq -r '.web_workspace_tests.result')")
          fi
          if [ "${#failures[@]}" -gt 0 ]; then
            printf 'App workspace validation failed:\n'
            printf '%s\n' "${failures[@]}"
            exit 1
          fi          

  e2e_vitest:
    name: E2E vitest
    needs: [change_scopes]
    if: ${{ needs.change_scopes.outputs.workspace_validation_required == 'true' }}
    runs-on: ubuntu-latest
    timeout-minutes: 20

    steps:
      - name: Checkout
        uses: actions/checkout@v6.0.2

      - name: Setup pnpm
        uses: pnpm/action-setup@v6.0.8
        with:
          version: 10.33.2

      - name: Setup Node.js
        uses: actions/setup-node@v6.4.0
        with:
          node-version: 24
          package-manager-cache: false

      - name: Resolve pnpm store path
        id: pnpm-store
        shell: bash
        run: echo "path=$(pnpm store path --silent)" >> "$GITHUB_OUTPUT"

      - name: Restore pnpm store cache
        uses: actions/cache/restore@v5.0.5
        with:
          path: ${{ steps.pnpm-store.outputs.path }}
          key: pnpm-store-${{ runner.os }}-${{ hashFiles('pnpm-lock.yaml') }}

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: E2E vitest
        run: pnpm --filter @open-design/e2e test

  ui_e2e_critical:
    name: Playwright critical
    needs: [change_scopes]
    if: ${{ needs.change_scopes.outputs.workspace_validation_required == 'true' }}
    runs-on: ubuntu-latest
    timeout-minutes: 30

    steps:
      - name: Checkout
        uses: actions/checkout@v6.0.2

      - name: Setup pnpm
        uses: pnpm/action-setup@v6.0.8
        with:
          version: 10.33.2

      - name: Setup Node.js
        uses: actions/setup-node@v6.4.0
        with:
          node-version: 24
          package-manager-cache: false

      - name: Resolve pnpm store path
        id: pnpm-store
        shell: bash
        run: echo "path=$(pnpm store path --silent)" >> "$GITHUB_OUTPUT"

      - name: Restore pnpm store cache
        uses: actions/cache/restore@v5.0.5
        with:
          path: ${{ steps.pnpm-store.outputs.path }}
          key: pnpm-store-${{ runner.os }}-${{ hashFiles('pnpm-lock.yaml') }}

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      # Restore Playwright browser binaries without saving from CI runs. The
      # key follows the @playwright/test version so browser revisions update
      # with package bumps.
      - name: Resolve Playwright version
        id: playwright-version
        run: |
          version=$(node -p "require('./e2e/package.json').devDependencies['@playwright/test'].replace(/[^0-9.]/g,'')")
          echo "version=$version" >> "$GITHUB_OUTPUT"          

      - name: Restore Playwright browser cache
        uses: actions/cache/restore@v5.0.5
        with:
          path: ~/.cache/ms-playwright
          key: playwright-${{ runner.os }}-${{ steps.playwright-version.outputs.version }}

      - name: Install Playwright browsers
        run: pnpm -C e2e exec playwright install --with-deps chromium

      - name: Prebuild workspace type declarations
        run: |
          pnpm --filter @open-design/daemon build
          pnpm --filter @open-design/desktop build
          pnpm --filter @open-design/web build:sidecar          

      - name: Playwright critical
        run: |
          pnpm -C e2e exec tsx scripts/playwright.ts clean
          pnpm --filter @open-design/e2e run test:ui:critical          

  build_workspaces:
    name: Build workspaces
    needs: [change_scopes]
    if: ${{ needs.change_scopes.outputs.workspace_validation_required == 'true' }}
    runs-on: ubuntu-latest
    timeout-minutes: 30

    steps:
      - name: Checkout
        uses: actions/checkout@v6.0.2

      - name: Setup pnpm
        uses: pnpm/action-setup@v6.0.8
        with:
          version: 10.33.2

      - name: Setup Node.js
        uses: actions/setup-node@v6.4.0
        with:
          node-version: 24
          package-manager-cache: false

      - name: Resolve pnpm store path
        id: pnpm-store
        shell: bash
        run: echo "path=$(pnpm store path --silent)" >> "$GITHUB_OUTPUT"

      - name: Restore pnpm store cache
        uses: actions/cache/restore@v5.0.5
        with:
          path: ${{ steps.pnpm-store.outputs.path }}
          key: pnpm-store-${{ runner.os }}-${{ hashFiles('pnpm-lock.yaml') }}

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Prebuild workspace type declarations
        run: |
          pnpm --filter @open-design/daemon build
          pnpm --filter @open-design/desktop build
          pnpm --filter @open-design/web build:sidecar          

      # Keep workspace builds serialized so generated dist output and local
      # runtime artifacts are produced in a deterministic order. Parallel
      # recursive builds would surface late-package failures sooner, but the
      # current workspace is small enough that safer logs and fewer shared-FS
      # races outweigh the lost parallelism; revisit if the package count grows.
      - name: Build workspaces
        run: pnpm -r --workspace-concurrency=1 --if-present run build

  validate:
    name: Validate workspace
    needs:
      - preflight
      - core_tests
      - app_tests
      - e2e_vitest
      - ui_e2e_critical
      - build_workspaces
    if: ${{ always() }}
    runs-on: ubuntu-latest
    timeout-minutes: 5

    steps:
      - name: Check workspace validation jobs
        env:
          NEEDS_JSON: ${{ toJSON(needs) }}
        run: |
          set -euo pipefail
          echo "$NEEDS_JSON" | jq .
          failures="$(echo "$NEEDS_JSON" | jq -r 'to_entries[] | select(.value.result != "success" and .value.result != "skipped") | "\(.key)=\(.value.result)"')"
          if [ -n "$failures" ]; then
            echo "Workspace validation failed:"
            echo "$failures"
            exit 1
          fi