Flight-Ops/.gitea/workflows/ci.yml

name: CI

on:
  push:
    branches: [master]
  pull_request:
    branches: [master]
  workflow_dispatch:

jobs:
  ci:
    name: build + unit + e2e
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      # The runner provides a working docker CLI out of the box (full-dind) — no endpoint
      # resolution needed. Job and app containers share the daemon, so put them on one
      # user-defined network and reach the app by service DNS (the job's netns has no
      # default route here, so host-IP URLs are unreliable). The alias `app` is declared
      # in docker-compose.ci.yml.
      - name: Prepare e2e network
        run: |
          set -u
          docker network inspect flight-ci-e2e >/dev/null 2>&1 || docker network create flight-ci-e2e
          if ! docker network connect flight-ci-e2e "$(hostname)"; then
            echo "::error::failed to attach job container '$(hostname)' to flight-ci-e2e — the job must run in a container on the shared daemon (check runner config)" >&2
            exit 1
          fi
          docker network inspect flight-ci-e2e --format 'containers on flight-ci-e2e: {{range .Containers}}{{.Name}} {{end}}'
          echo "E2E_BASE_URL=http://app:3000" >> "$GITHUB_ENV"

      # Non-fatal DNS diagnostics (runner outbound DNS is flaky — EAI_AGAIN seen in CI):
      # logs job-container vs daemon-side resolver config + per-host lookups so the next
      # failure shows which layer is broken. Every probe is guarded; this step never fails.
      - name: DNS diagnostics
        run: |
          set -u
          echo '=== job container ==='
          cat /etc/resolv.conf || echo 'resolv.conf FAILED'
          for h in registry.npmjs.org cdn.playwright.dev github.com docker.io; do
            getent hosts "$h" >/dev/null 2>&1 && echo "getent $h OK" || echo "getent $h FAILED"
          done
          curl -so /dev/null --max-time 10 -w 'registry.npmjs.org https %{time_total}s\n' https://registry.npmjs.org || echo 'curl registry FAILED'
          echo '=== daemon-side (default bridge) ==='
          # node:22-alpine is already local on the shared daemon (CI builds use it) — no pull needed when the network is down.
          timeout 90 docker run --rm node:22-alpine sh -c "cat /etc/resolv.conf; node -e \"require('dns').lookup('registry.npmjs.org',(e,a)=>{console.log(e?'daemon-bridge DNS FAILED':'daemon-bridge DNS OK '+a);process.exit(e?1:0)})\"" || echo 'daemon-side probe FAILED'

      - name: Setup Node
        uses: actions/setup-node@v4
        with:
          node-version: 22

      # bun drives installs (repo ships bun.lock, no package-lock.json); pinned to the
      # same major as oven/bun in the Dockerfile.
      - name: Install bun
        run: |
          npm i -g bun@1.4.2
          bun --version

      # Job-level dep cache via the runner's built-in cache server. continue-on-error on
      # both steps: an unreachable/broken cache server must never break the run.
      - name: Restore deps cache
        uses: actions/cache@v4
        continue-on-error: true
        with:
          path: |
            node_modules
            $HOME/.bun/install/cache
          key: ${{ runner.os }}-deps-bun-${{ hashFiles('bun.lock') }}

      - name: Install dependencies
        run: bun install --frozen-lockfile

      - name: Save deps cache
        uses: actions/cache@v4
        continue-on-error: true
        with:
          path: |
            node_modules
            $HOME/.bun/install/cache
          key: ${{ runner.os }}-deps-bun-${{ hashFiles('bun.lock') }}

      - name: Build
        run: npm run build

      - name: Unit tests
        run: npx vitest run

      # Browsers run locally in CI (PW_REMOTE_BROWSER=0 below): the shared remote browser
      # server at 192.168.1.4 cannot reach a stack inside dind, and local chromium keeps
      # the job self-contained.
      - name: Install browsers (local)
        run: npx playwright install --with-deps chromium

      # E2E against an isolated stack on the shared daemon — never the production instance.
      # docker-compose.ci.yml joins the flight-ci-e2e network prepared above; project name
      # flight-ci keeps it distinct from production. E2E_DEPLOY_CMD makes the config's
      # webServer block deploy + wait for readiness (http://app:3000 via service DNS);
      # E2E_COMPOSE_ARGS points state.spec.ts' mid-run `docker compose restart flight` at
      # the same file + project. E2E_BASE_URL comes from GITHUB_ENV (Prepare e2e network).
      - name: E2E (isolated stack in dind)
        env:
          PW_REMOTE_BROWSER: "0"
          # Build separately with plain progress so BuildKit step output is visible in the
          # job log (auto progress hides it), then start without rebuilding.
          E2E_DEPLOY_CMD: "docker compose -f docker-compose.ci.yml -p flight-ci build --progress=plain && docker compose -f docker-compose.ci.yml -p flight-ci up -d"
          E2E_COMPOSE_ARGS: "-f docker-compose.ci.yml -p flight-ci"
        run: npx playwright test

      # The daemon is shared with production — never leave our stack or network behind.
      # -v drops the named DB volume so every run seeds fresh (no schema drift between PRs).
      - name: Cleanup e2e stack + network
        if: always()
        run: |
          docker compose -f docker-compose.ci.yml -p flight-ci down --remove-orphans -v || true
          docker network remove flight-ci-e2e 2>/dev/null || true