name: test / unit

on:
  push:
    branches: [main]
    paths-ignore:
      - "docs/**"
      - "README.md"
      - "examples/**"
      - "showcase/**"
      - "sdk-python/**"
  pull_request:
    branches: [main]
    paths-ignore:
      - "docs/**"
      - "README.md"
      - "examples/**"
      - "showcase/**"
      - "sdk-python/**"
  workflow_dispatch:
    inputs:
      branch:
        description: "Branch to run the workflow on"
        required: true
        default: "main"
        type: string
env:
  NODE_OPTIONS: "--max-old-space-size=4096"
  NX_VERBOSE_LOGGING: true
  NX_CI_EXECUTION_ID: ${{ github.head_ref }}-${{ github.sha }}-${{ github.run_attempt }}
  NX_CI_EXECUTION_ENV: "Unit Tests"

# Least-privilege by default. Individual jobs/steps can widen when needed.
# id-token: write is required for Depot OIDC auth (runs-on: depot-ubuntu-*).
permissions:
  contents: read
  id-token: write

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  unit:
    name: "unit"
    runs-on: depot-ubuntu-24.04-4
    timeout-minutes: 15
    strategy:
      fail-fast: false
      matrix:
        node-version: [20.x, 22.x, 24.x]
    steps:
      - name: Checkout
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
        with:
          ref: ${{ github.event.inputs.branch || github.ref }}
          persist-credentials: false

      - name: Setup pnpm
        # Omit `version:` so pnpm/action-setup inherits from the repo's
        # `packageManager` field in package.json (via corepack).
        uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8

      - name: Use Node.js ${{ matrix.node-version }}
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version: ${{ matrix.node-version }}
          # Do NOT use cache: "pnpm" here — its key omits the Node.js version,
          # so a better-sqlite3 binary compiled for one Node ABI (e.g. ABI 137
          # from Node 24) would be served to a job running a different ABI
          # (Node 20 = ABI 115, Node 22 = ABI 127), causing "Module did not
          # self-register". We handle pnpm caching manually below with the
          # node-version in the key.
          # Fork-safety note: actions/cache is equally fork-safe — GitHub
          # prevents fork PRs from writing to the base repo's cache at the platform level.

      - name: Get pnpm store directory
        id: pnpm-cache
        run: echo "store-path=$(pnpm store path --silent)" >> $GITHUB_OUTPUT

      - name: Cache pnpm store (scoped to Node.js version)
        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
        with:
          path: ${{ steps.pnpm-cache.outputs.store-path }}
          key: ${{ runner.os }}-pnpm-store-${{ matrix.node-version }}-${{ hashFiles('pnpm-lock.yaml') }}
          restore-keys: |
            ${{ runner.os }}-pnpm-store-${{ matrix.node-version }}-

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Configure Nx Cloud environment
        run: |
          echo "NX_CI_EXECUTION_ID=${{ github.run_id }}-${{ github.run_attempt }}-unit-v1-${{ matrix.node-version }}" >> $GITHUB_ENV
          echo "NX_CLOUD_NO_TIMEOUTS=true" >> $GITHUB_ENV
          echo "NX_CLOUD_DISTRIBUTED_EXECUTION=false" >> $GITHUB_ENV
          echo "NX_NO_CLOUD=true" >> $GITHUB_ENV

      - name: Generate GraphQL codegen files
        run: npx nx run @copilotkit/runtime-client-gql:graphql-codegen

      - name: Build
        run: pnpm run build

      - name: Run tests
        run: pnpm run test

      - name: Run release script tests
        run: npx vitest run --config scripts/release/vitest.config.mts