proj_main.yml

name: main
on:
  push:
    branches:
      - main
  pull_request:

jobs:
  build:
    name: Build {{ project_name }}
    strategy:
      matrix:
        python: [3.12]
        node: [22.20]
    env:
      DATABASE_URL: "sqlite:///"
      REDIS_URL: "redis://"
    runs-on: ubuntu-latest

    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Store branch and latest SHA
        id: git
        shell: bash
        run: |
          echo "branch=${GITHUB_REF#refs/heads/}" >> $GITHUB_OUTPUT
          echo "sha_short=$(git rev-parse --short HEAD)" >> $GITHUB_OUTPUT

      - name: Setup Python ${% templatetag openvariable %} matrix.python {% templatetag closevariable %}
        uses: actions/setup-python@v5
        with:
          python-version: ${% templatetag openvariable %} matrix.python {% templatetag closevariable %}

      - name: Install pnpm
        uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4.2.0
        with:
          run_install: false

      - name: Verify pnpm is available
        shell: bash
        run: |
          which pnpm
          pnpm --version

      - name: Setup Node ${% templatetag openvariable %} matrix.node {% templatetag closevariable %}
        uses: actions/setup-node@v4
        with:
          node-version: ${% templatetag openvariable %} matrix.node {% templatetag closevariable %}
          cache: "pnpm"
          cache-dependency-path: **/pnpm-lock.yaml   # ← ensures cache is invalidated when lockfile changes

      - name: Compute lockfile hash
        id: lockhash
        shell: bash
        run: |
          set -euo pipefail
          files=$(git ls-files '**/pnpm-lock.yaml' || true)
          if [ -z "$files" ]; then
            echo "hash=none" >> "$GITHUB_OUTPUT"
          else
            hash=$(cat $files | sha256sum | cut -d' ' -f1)
            echo "hash=$hash" >> "$GITHUB_OUTPUT"
          fi

      - name: Cache pnpm store
        uses: actions/cache@v4
        env:
          cache_name: pnpm-store-cache
        with:
          path: ~/.pnpm-store
          key: build-${% templatetag openvariable %} env.cache_name {% templatetag closevariable %}-${% templatetag openvariable %} steps.git.outputs.branch {% templatetag closevariable %}-${% templatetag openvariable %} steps.git.outputs.sha_short {% templatetag closevariable %}-${% templatetag openvariable %} steps.lockhash.outputs.hash {% templatetag closevariable %}
          restore-keys: |
            build-${% templatetag openvariable %} env.cache_name {% templatetag closevariable %}-${% templatetag openvariable %} steps.git.outputs.branch {% templatetag closevariable %}-${% templatetag openvariable %} steps.git.outputs.sha_short {% templatetag closevariable %}
            build-${% templatetag openvariable %} env.cache_name {% templatetag closevariable %}-${% templatetag openvariable %} steps.git.outputs.branch {% templatetag closevariable %}
            build-${% templatetag openvariable %} env.cache_name {% templatetag closevariable %}

      - name: Cache pip
        uses: actions/cache@v4
        env:
          cache_name: pip-cache
        with:
          path: ~/.cache/pip
          key: build-${% templatetag openvariable %} env.cache_name {% templatetag closevariable %}-${% templatetag openvariable %} steps.git.outputs.branch {% templatetag closevariable %}-${% templatetag openvariable %} steps.git.outputs.sha_short {% templatetag closevariable %}
          restore-keys: |
            build-${% templatetag openvariable %} env.cache_name {% templatetag closevariable %}-${% templatetag openvariable %} steps.git.outputs.branch {% templatetag closevariable %}
            build-${% templatetag openvariable %} env.cache_name {% templatetag closevariable %}

      - run: python -m pip install --upgrade pip
        shell: bash

      - run: python -m pip install poetry==2.0.1
        shell: bash

      - run: curl -s https://packagecloud.io/install/repositories/github/git-lfs/script.deb.sh | sudo bash
        shell: bash

      - run: sudo apt-get install git-lfs --upgrade
        shell: bash

      - name: Poetry install (backend & deps)
        run: poetry install --with dev --no-root --no-interaction --no-ansi
        shell: bash

      - name: Install frontend dependencies
        run: pnpm install --frozen-lockfile
        shell: bash

      - name: Build frontend
        run: pnpm run build
        shell: bash

      - name: Lint frontend
        run: pnpm run lint
        shell: bash

      - name: Generate secret key
        id: secret_id_generator
        shell: bash
        run: |
          secret=$(python -c "import uuid; print(uuid.uuid4().hex + uuid.uuid4().hex)")
          echo "SECRET_KEY=$secret" >> $GITHUB_OUTPUT

      - name: Linting backend
        run: poetry run ruff check ./backend/
        env:
          DJANGO_SETTINGS_MODULE: "{{ project_name }}.settings.local_base"
          SECRET_KEY: ${% templatetag openvariable %} steps.secret_id_generator.outputs.SECRET_KEY {% templatetag closevariable %}
          DATABASE_URL: "sqlite:///"
          ALLOWED_HOSTS: ".example.org"
          SENDGRID_USERNAME: "test"
          SENDGRID_PASSWORD: "test"
          REDIS_URL: "redis://"
        shell: bash

      - run: poetry run pre-commit run --all-files
        env:
          SKIP: ruff,eslint,missing-migrations,backend-schema
        shell: bash

      - name: Check migrations (dry-run)
        run: |
          poetry run python manage.py makemigrations --check --dry-run
        working-directory: backend
        env:
          DJANGO_SETTINGS_MODULE: "{{ project_name }}.settings.production"
          SECRET_KEY: ${% templatetag openvariable %} steps.secret_id_generator.outputs.SECRET_KEY {% templatetag closevariable %}
          DATABASE_URL: "sqlite:///"
          ALLOWED_HOSTS: ".example.org"
          SENDGRID_USERNAME: "test"
          SENDGRID_PASSWORD: "test"
          REDIS_URL: "redis://"
        shell: bash

      - name: Django deploy checks
        run: |
          poetry run python manage.py check --deploy
        working-directory: backend
        env:
          DJANGO_SETTINGS_MODULE: "{{ project_name }}.settings.production"
          SECRET_KEY: ${% templatetag openvariable %} steps.secret_id_generator.outputs.SECRET_KEY {% templatetag closevariable %}
          DATABASE_URL: "sqlite:///"
          ALLOWED_HOSTS: ".example.org"
          SENDGRID_USERNAME: "test"
          SENDGRID_PASSWORD: "test"
          REDIS_URL: "redis://"
        shell: bash

      - name: Run backend tests with coverage
        run: |
          poetry run coverage run manage.py test
          mkdir -p junit
          poetry run coverage xml -o junit/test-results.xml
        working-directory: backend
        shell: bash

      - name: Run frontend tests
        run: pnpm run test
        shell: bash