name: CI

on:
  push:
    branches: [master, main]
  pull_request:

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  check:
    name: Lint, Typen, Tests, Build
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-node@v4
        with:
          node-version: 22
          cache: npm

      - run: npm ci

      - name: Lint
        run: npm run lint

      - name: Typecheck
        run: npm run typecheck

      # Catches the drift that `tsc` cannot: lib/supabase/types.ts is
      # hand-written, so a migration adding a column leaves it silently stale.
      - name: Schema/Typen-Abgleich
        run: npm run types:check

      - name: Unit- und Komponententests
        run: npm test

      - name: Build
        run: npm run build
        env:
          # Read at module scope by the Supabase browser client, so the build
          # needs them present — never the real project's values.
          NEXT_PUBLIC_SUPABASE_URL: http://127.0.0.1:54321
          NEXT_PUBLIC_SUPABASE_ANON_KEY: build-time-placeholder

  integration:
    name: Integrationstests (echtes Postgres)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-node@v4
        with:
          node-version: 22
          cache: npm

      - run: npm ci

      - uses: supabase/setup-cli@v1
        with:
          version: latest

      # Applies every migration to a fresh database — which also means a
      # migration that cannot be replayed from scratch fails here rather than
      # on a restore or a new environment.
      - name: Supabase starten
        run: supabase start

      # `-o env` emits API_URL / ANON_KEY / SERVICE_ROLE_KEY; the app expects
      # them under its own names.
      - name: Testumgebung schreiben
        run: |
          supabase status -o env \
            --override-name api.url=NEXT_PUBLIC_SUPABASE_URL \
            --override-name auth.anon_key=NEXT_PUBLIC_SUPABASE_ANON_KEY \
            --override-name auth.service_role_key=SUPABASE_SERVICE_ROLE_KEY \
            | grep -E '^(NEXT_PUBLIC_SUPABASE_URL|NEXT_PUBLIC_SUPABASE_ANON_KEY|SUPABASE_SERVICE_ROLE_KEY)=' \
            | tr -d '"' > .env.test.local

      - name: Seed
        run: node --env-file=.env.test.local supabase/seed.ts

      - name: Integrationstests
        run: npm run test:integration

      - name: Supabase-Logs bei Fehlschlag
        if: failure()
        run: supabase status && docker ps -a