gods-eye-view/.github/workflows/ci.yml

name: CI

on:
  pull_request:
  push:
    branches: [main]

permissions:
  contents: read

concurrency:
  group: ci-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  verify:
    name: Node ${{ matrix.node }}
    runs-on: ubuntu-latest
    timeout-minutes: 20
    strategy:
      fail-fast: false
      matrix:
        node: [24.14.0, 26.x]
    env:
      PUPPETEER_SKIP_DOWNLOAD: '1'
      GEV_REQUIRE_ALLOCATION_GATE: ${{ matrix.node == '24.14.0' && '1' || '0' }}
    steps:
      - name: Check out source
        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
        with:
          persist-credentials: false
          fetch-depth: 0

      - name: Use Node.js
        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
        with:
          node-version: ${{ matrix.node }}
          cache: npm

      - name: Install locked dependencies
        run: npm ci

      - name: Run setup policy checks
        run: npm run doctor -- --json

      - name: Check adopted formatting
        run: npm run format:check

      - name: Check package boundaries
        run: npm run check:boundaries

      - name: Check published layer-token allocations
        if: github.event_name == 'pull_request'
        run: npm run layer-token:check -- --base-ref origin/main

      - name: Run unit tests
        run: npm test

      - name: Build production bundle
        run: npm run build

  street-level-browser:
    # The Street Level gate in its hermetic mode, against a production build
    # served by `vite preview`: coverage tiles, the Graph API and the image
    # CDN are answered from fixtures (scripts/fixtures/street-level), so no
    # real token and no Mapillary network are needed, and the whole photo
    # flow runs. The server gets a dummy, non-secret client token: the build
    # bakes it into the bundle (the viewer needs one to ask for photos) and
    # the preview server's status route reports it as configured. The page
    # intercepts every *.mapillary.com request, so the token never leaves it.
    name: Street Level browser gate
    runs-on: ubuntu-latest
    timeout-minutes: 30
    env:
      GEV_REQUIRE_ALLOCATION_GATE: '0'
      # A header press that misses is a real layout shift under the pointer
      # (the right rail now aligns to where the left rail settles), not noise.
      QA_FAIL_ON_RETRY: '1'
    steps:
      - name: Check out source
        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
        with:
          persist-credentials: false

      - name: Use Node.js
        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
        with:
          node-version: 24.14.0
          cache: npm

      - name: Install locked dependencies and headless Chrome
        run: npm ci

      - name: Build production bundle with a dummy Mapillary token
        env:
          MAPILLARY_CLIENT_TOKEN: 'MLY|0|qa-fixture'
        run: npm run build

      - name: Start the preview server
        env:
          MAPILLARY_CLIENT_TOKEN: 'MLY|0|qa-fixture'
        run: |
          npx vite preview --port 4173 --strictPort > preview.log 2>&1 &
          for attempt in $(seq 1 90); do
            curl -sf http://localhost:4173/ > /dev/null && exit 0
            sleep 2
          done
          cat preview.log
          exit 1

      - name: Street Level gate with Mapillary fixtures
        run: npm run qa:street-level:fixtures -- --strict --url http://localhost:4173

      - name: Portable panel gate
        if: success() || failure()
        run: npm run qa:panel-resize -- --url http://localhost:4173

      - name: Preview server log
        if: failure()
        run: cat preview.log

      - name: Upload gate evidence
        if: failure()
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          name: browser-gate-evidence
          path: qa-artifacts/
          if-no-files-found: ignore
          retention-days: 14

  windows-onboarding:
    name: Windows onboarding
    runs-on: windows-latest
    timeout-minutes: 20
    env:
      PUPPETEER_SKIP_DOWNLOAD: '1'
      GEV_REQUIRE_ALLOCATION_GATE: '0'
    steps:
      - name: Check out source
        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
        with:
          persist-credentials: false

      - name: Use Node.js
        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
        with:
          node-version: 24.14.0
          cache: npm

      - name: Run the Pinokio install path
        run: node scripts/pinokio-install.mjs

      - name: Check adopted formatting
        run: npm run format:check

      - name: Check package boundaries
        run: npm run check:boundaries

      - name: Run focused onboarding tests
        run: node --test src/setupDoctor.test.mjs src/pinokioEnvironment.test.mjs src/pinokioPreflight.test.mjs src/pinokioLauncherContract.test.mjs src/keySetupHardening.test.mjs src/mapStartup.test.mjs src/hudSummaryResponse.test.mjs

      - name: Build production bundle
        run: npm run build