name: Docs Tests

on:
  pull_request:
    branches: ['master']
    paths:
      - 'apps/docs/**/*.ts*'
      - 'apps/docs/spec/**/*.json'
      - 'apps/docs/.env.development'
      - 'apps/docs/package.json'
      - 'e2e/docs/local-smoke/**'
      - 'e2e/docs/playwright.local-smoke.config.ts'
      - 'e2e/docs/package.json'

# Cancel old builds on new commit for same workflow + branch/PR
concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true

permissions:
  contents: read

env:
  CI: true

jobs:
  build:
    runs-on: blacksmith-4vcpu-ubuntu-2404

    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false
          sparse-checkout: |
            apps/docs
            examples
            packages
            supabase
            patches

      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
        name: Install pnpm
        with:
          run_install: false

      - name: Use Node.js
        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
        with:
          node-version-file: '.nvmrc'
          cache: 'pnpm'

      - name: Install deps
        run: pnpm install --frozen-lockfile

      - name: Download JS reference TypeDoc dumps
        # The source dumps under apps/docs/spec/reference/<lib>/<ver>/*.json are
        # gitignored — `make download.tsdoc.v2` re-fetches them from
        # supabase.github.io so the reference-content snapshot test has
        # something to walk.
        working-directory: apps/docs/spec
        run: make download.tsdoc.v2

      - name: Generate Dart reference dump
        # Dart has no upstream TypeDoc dump; its gitignored dump is generated
        # from the committed `supabase_dart_v2.yml` so the reference-content
        # snapshot test has something to walk.
        working-directory: apps/docs
        run: pnpm run codegen:references:dart

      - name: Run tests
        run: |
          touch .env
          # Needed to prevent local Supabase startup from erroring, due to
          # GitHub Auth being enabled in config
          echo "GITHUB_CLIENT_ID=dummy-id" >> .env
          echo "GITHUB_SECRET=dummy-secret" >> .env
          pnpm run test:docs

  local-dev-smoke:
    name: Local dev smoke (no credentials)
    runs-on: blacksmith-4vcpu-ubuntu-2404

    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false
          sparse-checkout: |
            apps/docs
            examples
            packages
            supabase
            patches
            e2e/docs

      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
        name: Install pnpm
        with:
          run_install: false

      - name: Use Node.js
        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
        with:
          node-version-file: '.nvmrc'
          cache: 'pnpm'

      - name: Install deps
        run: pnpm install --frozen-lockfile

      - name: Install Playwright Chromium
        run: pnpm -C e2e/docs exec playwright install chromium --with-deps --only-shell

      # Deliberately does not set DOCS_GITHUB_APP_*, SUPABASE_SECRET_KEY,
      # OPENAI_API_KEY, or DOCS_REVALIDATION_KEYS — their absence here is what
      # verifies `pnpm run dev:docs` still works without private credentials.
      - name: Run local dev smoke tests
        run: pnpm run e2e:docs:local-smoke

      - name: Upload Playwright report
        if: failure()
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          name: docs-local-smoke-playwright-report
          path: |
            e2e/docs/playwright-report-local-smoke/
            e2e/docs/test-results/
          retention-days: 7