ci.yml

name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
  workflow_dispatch:

env:
  NODE_VERSION: 22.x

permissions:
  actions: read
  contents: read
  packages: read

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  lint:
    name: Lint & Format
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - name: Checkout
        uses: actions/checkout@v5

      - name: Setup Node.js
        uses: actions/setup-node@v5
        with:
          cache: 'npm'
          node-version: ${{ env.NODE_VERSION }}
          registry-url: 'https://npm.pkg.github.com'
          scope: '@deepnote'

      - name: Install dependencies
        run: npm ci --prefer-offline --no-audit
        env:
          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Run ESLint
        run: npm run lint

      - name: Check Prettier formatting
        run: npm run format

  typecheck:
    name: TypeCheck
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - name: Checkout
        uses: actions/checkout@v5

      - name: Setup Node.js
        uses: actions/setup-node@v5
        with:
          cache: 'npm'
          node-version: ${{ env.NODE_VERSION }}
          registry-url: 'https://npm.pkg.github.com'
          scope: '@deepnote'

      - name: Install dependencies
        run: npm ci --prefer-offline --no-audit
        env:
          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Run TypeScript type checking
        run: npm run typecheck

  qlty:
    name: Qlty Check
    runs-on: ubuntu-latest
    timeout-minutes: 3

    steps:
      - name: Checkout code
        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8

      - name: Install qlty
        uses: qltysh/qlty-action/install@06730ef41b86b073c3813c0fc07a0c734980ce5d

      - name: Run qlty check
        run: qlty check

      - name: Run qlty code smells analysis
        run: qlty smells

  build:
    name: Build & Test
    runs-on: ubuntu-latest
    timeout-minutes: 15
    permissions:
      id-token: write
      contents: read
    steps:
      - name: Checkout
        uses: actions/checkout@v5

      - name: Setup Node.js
        uses: actions/setup-node@v5
        with:
          cache: 'npm'
          node-version: ${{ env.NODE_VERSION }}
          registry-url: 'https://npm.pkg.github.com'
          scope: '@deepnote'

      - name: Install dependencies
        run: npm ci --prefer-offline --no-audit
        env:
          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Compile TypeScript
        run: npm run compile

      - name: Run tests
        run: npm test
        env:
          VSC_JUPYTER_INSTRUMENT_CODE_FOR_COVERAGE: true

      - name: Upload coverage to Codecov
        uses: codecov/codecov-action@v5
        with:
          use_oidc: true
          files: coverage/lcov.info
          fail_ci_if_error: true

      - name: Upload test results to Codecov
        if: '!cancelled()'
        uses: codecov/test-results-action@v1
        with:
          use_oidc: true
          files: test-results.xml
          fail_ci_if_error: true

      - name: Check dependencies
        run: npm run checkDependencies
        continue-on-error: true

      - name: Check licenses
        run: npm run check-licenses

  check_licenses:
    name: Check Licenses
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v5

      - name: Setup Node.js
        uses: actions/setup-node@v5
        with:
          cache: 'npm'
          node-version: ${{ env.NODE_VERSION }}
          registry-url: 'https://npm.pkg.github.com'
          scope: '@deepnote'

      - name: Install dependencies
        run: npm ci
        env:
          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Check Licenses
        run: npm run check-licenses

  audit-prod:
    name: Audit - Production
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - name: Checkout
        uses: actions/checkout@v5

      - name: Setup Node.js
        uses: actions/setup-node@v5
        with:
          cache: 'npm'
          node-version: ${{ env.NODE_VERSION }}
          registry-url: 'https://npm.pkg.github.com'
          scope: '@deepnote'

      - name: Install dependencies
        run: npm ci --prefer-offline --no-audit
        env:
          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Run audit for production dependencies
        run: npm audit --production

  audit-all:
    name: Audit - All
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - name: Checkout
        uses: actions/checkout@v5

      - name: Setup Node.js
        uses: actions/setup-node@v5
        with:
          cache: 'npm'
          node-version: ${{ env.NODE_VERSION }}
          registry-url: 'https://npm.pkg.github.com'
          scope: '@deepnote'

      - name: Install dependencies
        run: npm ci --prefer-offline --no-audit
        env:
          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Run audit for all dependencies
        run: npm audit