ci.yml

name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
  workflow_call:

# Default to read-only for all jobs; individual jobs override only what they need.
permissions:
  contents: read

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  docs-quality:
    name: Docs Quality
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

      - name: Set up Node.js
        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6
        with:
          node-version: '24'
          cache: 'npm'

      - name: Install dependencies
        run: npm ci

      - name: Lint documentation markdown
        run: npm run lint:docs:markdown

      - name: Validate documentation links
        run: npm run lint:docs:links

  lint-js:
    name: Lint JS & CSS
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

      - name: Set up Node.js
        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6
        with:
          node-version: '24'
          cache: 'npm'

      - name: Install dependencies
        run: npm ci

      - name: Lint JavaScript
        run: npm run lint:js

      - name: Lint CSS
        run: npm run lint:css

      - name: Audit npm dependencies
        # All npm packages are devDependencies (build tooling only — nothing ships
        # to WordPress). Audit only production deps to avoid false positives from
        # build tools like @wordpress/scripts that can't be patched without a
        # breaking downgrade.
        run: npm audit --audit-level=high --omit=dev

  test-js:
    name: JavaScript Unit Tests
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

      - name: Set up Node.js
        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6
        with:
          node-version: '24'
          cache: 'npm'

      - name: Install dependencies
        run: npm ci

      - name: Run JavaScript unit tests with coverage
        run: npm run test:js:coverage

      - name: Upload JS coverage to Codecov
        uses: codecov/codecov-action@1af58845a975a7985b0beb0cbe6fbbb71a41dbad # v5.5.3
        with:
          flags: jest
          fail_ci_if_error: false

  lint-php:
    name: Lint PHP
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

      - name: Set up PHP
        uses: shivammathur/setup-php@accd6127cb78bee3e8082180cb391013d204ef9f # 2.37.0
        with:
          php-version: '8.2'
          tools: composer
          coverage: none

      - name: Install Composer dependencies
        run: composer install --prefer-dist --no-progress

      - name: Run PHP_CodeSniffer
        run: composer lint

      - name: Audit Composer dependencies
        run: composer audit

  phpstan:
    name: PHPStan Static Analysis
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

      - name: Set up Node.js
        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6
        with:
          node-version: '24'
          cache: 'npm'

      - name: Set up PHP
        uses: shivammathur/setup-php@accd6127cb78bee3e8082180cb391013d204ef9f # 2.37.0
        with:
          php-version: '8.2'
          tools: composer
          coverage: none

      - name: Install JS dependencies and build assets
        # PHPStan statically follows the include() in class-telex-admin.php and
        # requires the build/*.asset.php files to exist at analysis time.
        run: npm ci && npm run build

      - name: Install Composer dependencies
        run: composer install --prefer-dist --no-progress

      - name: Run PHPStan
        run: php -d memory_limit=2G vendor/bin/phpstan analyse --no-progress --memory-limit=2G

  test-php:
    name: PHP Tests (PHP ${{ matrix.php }})
    runs-on: ubuntu-latest

    strategy:
      fail-fast: false
      matrix:
        php: ['8.2', '8.3', '8.4']

    services:
      mysql:
        image: mysql:8.0
        env:
          MYSQL_ROOT_PASSWORD: root
          MYSQL_DATABASE: wordpress_test
        ports:
          - 3306:3306
        options: >-
          --health-cmd="mysqladmin ping --silent"
          --health-interval=10s
          --health-timeout=5s
          --health-retries=5

    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

      - name: Set up PHP ${{ matrix.php }}
        uses: shivammathur/setup-php@accd6127cb78bee3e8082180cb391013d204ef9f # 2.37.0
        with:
          php-version: ${{ matrix.php }}
          extensions: mysqli, openssl
          tools: composer
          coverage: xdebug

      - name: Install Composer dependencies
        run: composer install --prefer-dist --no-progress

      - name: Install WordPress test suite
        run: |
          bash bin/install-wp-tests.sh wordpress_test root root 127.0.0.1 latest

      - name: Run PHPUnit with coverage
        run: composer test -- --coverage-clover coverage.xml

      - name: Upload coverage to Codecov
        if: matrix.php == '8.2'
        uses: codecov/codecov-action@1af58845a975a7985b0beb0cbe6fbbb71a41dbad # v5.5.3
        with:
          files: coverage.xml
          flags: phpunit
          fail_ci_if_error: false

  plugin-check:
    name: WordPress Plugin Check
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

      - name: Set up PHP
        uses: shivammathur/setup-php@accd6127cb78bee3e8082180cb391013d204ef9f # 2.37.0
        with:
          php-version: '8.2'
          tools: composer
          coverage: none

      - name: Install Composer dependencies (production only)
        run: composer install --prefer-dist --no-progress --no-dev --optimize-autoloader

      - name: Build clean distribution directory
        # Mirrors what bin/build-zip.sh does: copy only production files so
        # dev tooling (bin/, tests/, .github/, .eslintrc.js, etc.) is absent
        # when plugin-check runs — those files must not be in a WP.org zip.
        run: |
          mkdir -p /tmp/plugin-dist/dispatch
          rsync -r --exclude-from=.distignore . /tmp/plugin-dist/dispatch/

      - name: WordPress Plugin Check
        uses: wordpress/plugin-check-action@6f5a57e173c065a394b78688f75df543e4011902 # v1
        with:
          build-dir: '/tmp/plugin-dist/dispatch'
          # plugin_readme  — readme.txt is for wordpress.org listing, not runtime.
          # plugin_review_phpcs — covered by the dedicated lint-php job.
          # plugin_updater — false positive: the update hooks inject updates for
          #   Telex-managed blocks/themes into WP's native update UI, not for
          #   self-updating this plugin outside wordpress.org.
          exclude-checks: 'plugin_readme,plugin_review_phpcs,plugin_updater'