immich-folio/.github/workflows/ci.yml

name: CI

on:
  push:
    branches: [main, dev]
  pull_request:
    # dev is included because dependency and feature PRs target it — without
    # it those PRs would carry no checks at all, and main would only find out
    # at release time.
    branches: [main, dev]

# Neither job writes anything back to the repository: they check out the
# code, build it and report through the run itself. Read is all they need,
# and declaring it here covers every job rather than each one separately.
permissions:
  contents: read

# Cancel in-progress runs for the same PR / branch
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  ci:
    name: Type-check & Test
    runs-on: ubuntu-latest
    timeout-minutes: 10

    steps:
      - uses: actions/checkout@v7
        with:
          # The formatting step diffs against the PR's base, which needs the
          # base branch's history — the default shallow clone has none of it.
          fetch-depth: 0

      - name: Set up Node.js
        uses: actions/setup-node@v7
        with:
          node-version: '22'
          cache: 'npm'

      - name: Install dependencies
        run: npm ci

      - name: TypeScript – type check
        run: npx tsc --noEmit

      - name: Run tests
        run: npx vitest run

      - name: Build
        run: npm run build
        env:
          # Minimal env vars so Next.js build doesn't bail early on env validation
          IMMICH_API_URL: http://localhost:2283
          IMMICH_API_KEY: placeholder-key-for-ci
          AUTH_SECRET: placeholder-secret-for-ci-builds-must-be-32-chars-long

      # Advisory only — this step never fails the job.
      #
      # Prettier is configured as an eslint error but has never been run in CI,
      # so a chunk of the tree predates it. Blocking on that would make a PR red
      # for merely touching an old file, and reformatting the tree wholesale
      # would bury every future diff in unrelated churn. Annotating the files a
      # PR already changes puts the information in front of the author without
      # putting a gate in the way. Runs last so real failures surface first.
      - name: Formatting – changed files (advisory)
        if: github.event_name == 'pull_request'
        continue-on-error: true
        run: |
          files=$(git diff --name-only --diff-filter=d \
            "${{ github.event.pull_request.base.sha }}...HEAD" \
            -- '*.ts' '*.tsx' '*.js' '*.mjs' '*.css' '*.json' '*.md' '*.yml' '*.yaml')
          if [ -z "$files" ]; then
            echo "No formattable files changed."
            exit 0
          fi

          # --list-different prints only the offenders and exits non-zero when
          # there are any; `|| true` keeps that from ending the step.
          unformatted=$(echo "$files" | xargs -d '\n' npx prettier --list-different || true)

          if [ -z "$unformatted" ]; then
            echo "All changed files match Prettier's style."
            exit 0
          fi

          count=$(echo "$unformatted" | wc -l)
          echo "### Prettier: $count changed file(s) not formatted" >> "$GITHUB_STEP_SUMMARY"
          echo '' >> "$GITHUB_STEP_SUMMARY"
          while IFS= read -r f; do
            echo "::warning file=$f::Not formatted. Run: npx prettier --write $f"
            echo "- \`$f\`" >> "$GITHUB_STEP_SUMMARY"
          done <<< "$unformatted"
          echo '' >> "$GITHUB_STEP_SUMMARY"
          echo 'Advisory only — this does not block the merge.' >> "$GITHUB_STEP_SUMMARY"

  # Separate job because it needs a browser and a built server, and because a
  # slow browser run should not hold up the fast type-check/test feedback.
  #
  # Only the admin smoke spec runs here. The other e2e specs render the public
  # gallery, which needs a real Immich behind it — CI has none, so they would
  # fail for reasons that have nothing to do with the change under test. The
  # admin panel reads its state from the repo's config files and degrades
  # gracefully when Immich is unreachable, so it is the part of the suite that
  # can honestly run without a backend.
  e2e-admin:
    name: Admin panel smoke test
    runs-on: ubuntu-latest
    timeout-minutes: 15

    steps:
      - uses: actions/checkout@v7

      - name: Set up Node.js
        uses: actions/setup-node@v7
        with:
          node-version: '22'
          cache: 'npm'

      - name: Install dependencies
        run: npm ci

      - name: Install Chromium
        run: npx playwright install --with-deps chromium

      - name: Build
        run: npm run build
        env:
          IMMICH_API_URL: http://localhost:2283
          IMMICH_API_KEY: placeholder-key-for-ci
          AUTH_SECRET: placeholder-secret-for-ci-builds-must-be-32-chars-long

      # E2E_START runs the spec against `npm run start` rather than the dev
      # server. #542 was a module-evaluation error in shipped output, so the
      # build that ships is the one worth loading in a browser.
      - name: Admin smoke test
        run: npm run test:e2e:admin
        env:
          E2E_START: '1'
          IMMICH_API_URL: http://localhost:2283
          IMMICH_API_KEY: placeholder-key-for-ci
          AUTH_SECRET: placeholder-secret-for-ci-builds-must-be-32-chars-long
          ADMIN_PASSWORD: e2e-admin-password

      - name: Upload Playwright report
        if: failure()
        uses: actions/upload-artifact@v7
        with:
          name: playwright-report
          path: playwright-report/
          retention-days: 7