name: e2e

on:
  pull_request:
    branches: [main]
  push:
    branches: [main]

permissions:
  contents: read

# Cancel in-progress runs when a new commit lands on the same PR.
concurrency:
  group: e2e-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  e2e:
    runs-on: ubuntu-latest
    timeout-minutes: 20
    services:
      postgres:
        image: postgres:16-alpine
        env:
          POSTGRES_USER: healthlog
          POSTGRES_PASSWORD: healthlog
          POSTGRES_DB: healthlog
        ports:
          - 5432:5432
        options: >-
          --health-cmd "pg_isready -U healthlog"
          --health-interval 5s
          --health-timeout 5s
          --health-retries 10

    env:
      DATABASE_URL: postgresql://healthlog:healthlog@localhost:5432/healthlog?schema=public
      ENCRYPTION_KEYS: '{"v1":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"}'
      ENCRYPTION_ACTIVE_KEY_ID: v1
      API_TOKEN_HMAC_KEY: ci-hmac-key-32-bytes-min-padding-x
      AUTH_RP_NAME: HealthLog
      AUTH_RP_ID: localhost
      AUTH_RP_ORIGIN: http://localhost:3000
      NODE_ENV: production

    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9

      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version: 22
          cache: pnpm

      - run: pnpm install --frozen-lockfile

      - run: pnpm db:generate

      - run: pnpm db:migrate:deploy

      - name: Cache Playwright browsers
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: ~/.cache/ms-playwright
          key: playwright-${{ runner.os }}-${{ hashFiles('pnpm-lock.yaml') }}
          restore-keys: |
            playwright-${{ runner.os }}-

      - run: pnpm exec playwright install --with-deps chromium

      # `pnpm build` (not bare `next build`): the prebuild hook generates
      # the versioned service-worker stamp AND the static i18n catalog
      # assets (public/i18n/<locale>.js) the client boots from — without
      # them every UI interaction waits on missing catalogs.
      - run: pnpm build

      # Client-bundle budget gate — rides this job because it is the one
      # place CI already has a production build on disk. Catches the
      # regressions the dead webpack-era tooling (ANALYZE=1, the old
      # bundle-report) let through: a statically imported message catalog
      # (~100 KB gz on every route) or a chart import bypassing the shared
      # chart-runtime boundary (a duplicated ~92 KB gz recharts chunk).
      - run: pnpm bundle-check

      - run: pnpm exec playwright test
        env:
          E2E_BASE_URL: http://localhost:3000

      - name: Upload Playwright HTML report on failure
        if: failure()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: playwright-report
          path: playwright-report/
          retention-days: 7