ci.yml

name: 🔗 CI

# CI orchestrator that runs checks and tests.
#
# By default runs `pnpm run check --all` (lint + type) as a single job.
# Set `run-check: false` and enable `run-lint`/`run-type-check` to split them.
#
# Dependencies:
#   - SocketDev/socket-registry/.github/actions/setup-and-install
#   - SocketDev/socket-registry/.github/actions/run-script

on:
  workflow_call:
    inputs:
      check-node-version:
        description: 'Node.js version for checks'
        required: false
        type: string
        default: '25.9.0'
      check-script:
        description: 'Check command — runs lint + type checks (e.g., "pnpm run check --all")'
        required: false
        type: string
        default: 'pnpm run check --all'
      check-setup-script:
        description: 'Setup script before checks'
        required: false
        type: string
        default: ''
      check-timeout-minutes:
        description: 'Timeout for check job in minutes'
        required: false
        type: number
        default: 10
      debug:
        description: 'Enable debug output (e.g., "1" for verbose logging)'
        required: false
        type: string
        default: '0'
      fail-fast:
        description: 'Cancel all matrix jobs if one fails'
        required: false
        type: boolean
        default: false
      lint-node-version:
        description: 'Node.js version for linting'
        required: false
        type: string
        default: '25.9.0'
      lint-script:
        description: 'Lint command (e.g., "pnpm run lint --all")'
        required: false
        type: string
        default: 'pnpm run lint --all'
      lint-setup-script:
        description: 'Setup script before linting'
        required: false
        type: string
        default: ''
      lint-timeout-minutes:
        description: 'Timeout for lint job in minutes'
        required: false
        type: number
        default: 10
      max-parallel:
        description: 'Maximum parallel test jobs'
        required: false
        type: number
        default: 4
      node-versions:
        description: 'Node.js versions for testing (e.g., ''["22", "24"]'')'
        required: false
        type: string
        default: '["25.9.0"]'
      os-versions:
        description: 'Operating systems for testing (e.g., ''["ubuntu-latest", "windows-latest"]'')'
        required: false
        type: string
        default: '["ubuntu-latest", "macos-latest", "windows-latest"]'
      run-check:
        description: 'Include combined check job (lint + type)'
        required: false
        type: boolean
        default: true
      run-lint:
        description: 'Include standalone lint job'
        required: false
        type: boolean
        default: false
      run-test:
        description: 'Include test matrix job'
        required: false
        type: boolean
        default: true
      run-type-check:
        description: 'Include standalone type check job'
        required: false
        type: boolean
        default: false
      test-script:
        description: 'Test command (e.g., "pnpm test")'
        required: false
        type: string
        default: 'pnpm test'
      test-setup-script:
        description: 'Setup script before tests (e.g., "pnpm run build")'
        required: false
        type: string
        default: 'pnpm run build'
      test-timeout-minutes:
        description: 'Timeout for test jobs in minutes'
        required: false
        type: number
        default: 15
      type-check-node-version:
        description: 'Node.js version for type checking'
        required: false
        type: string
        default: '25.9.0'
      type-check-script:
        description: 'Type check command (e.g., "pnpm run type")'
        required: false
        type: string
        default: 'pnpm run type'
      type-check-setup-script:
        description: 'Setup script before type checking'
        required: false
        type: string
        default: ''
      type-check-timeout-minutes:
        description: 'Timeout for type check job in minutes'
        required: false
        type: number
        default: 10
      working-directory:
        description: 'Working directory (e.g., "packages/core" for monorepos)'
        required: false
        type: string
        default: '.'
    secrets:
      SOCKET_API_KEY:
        description: 'Socket API key — when provided, uses sfw-enterprise instead of sfw-free'
        required: false

permissions:
  contents: read

concurrency:
  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
  cancel-in-progress: true

jobs:
  check:
    if: inputs.run-check
    name: 🔎 Check
    runs-on: ubuntu-latest
    timeout-minutes: ${{ inputs.check-timeout-minutes }}
    steps:
      - uses: SocketDev/socket-registry/.github/actions/setup-and-install@ea60ce98fb4a0070c3ec98c3bd41709d034c9e8a # main
        with:
          debug: ${{ inputs.debug }}
          node-version: ${{ inputs.check-node-version }}
          socket-api-key: ${{ secrets.SOCKET_API_TOKEN }}
          working-directory: ${{ inputs.working-directory }}

      - uses: SocketDev/socket-registry/.github/actions/run-script@ea60ce98fb4a0070c3ec98c3bd41709d034c9e8a # main
        with:
          main-script: ${{ inputs.check-script }}
          setup-script: ${{ inputs.check-setup-script }}
          working-directory: ${{ inputs.working-directory }}

  lint:
    if: inputs.run-lint
    name: 🧹 Lint
    runs-on: ubuntu-latest
    timeout-minutes: ${{ inputs.lint-timeout-minutes }}
    steps:
      - uses: SocketDev/socket-registry/.github/actions/setup-and-install@ea60ce98fb4a0070c3ec98c3bd41709d034c9e8a # main
        with:
          debug: ${{ inputs.debug }}
          node-version: ${{ inputs.lint-node-version }}
          socket-api-key: ${{ secrets.SOCKET_API_TOKEN }}
          working-directory: ${{ inputs.working-directory }}

      - uses: SocketDev/socket-registry/.github/actions/run-script@ea60ce98fb4a0070c3ec98c3bd41709d034c9e8a # main
        with:
          main-script: ${{ inputs.lint-script }}
          setup-script: ${{ inputs.lint-setup-script }}
          working-directory: ${{ inputs.working-directory }}

  type-check:
    if: inputs.run-type-check
    name: 🏷️ Type Check
    runs-on: ubuntu-latest
    timeout-minutes: ${{ inputs.type-check-timeout-minutes }}
    steps:
      - uses: SocketDev/socket-registry/.github/actions/setup-and-install@ea60ce98fb4a0070c3ec98c3bd41709d034c9e8a # main
        with:
          debug: ${{ inputs.debug }}
          node-version: ${{ inputs.type-check-node-version }}
          socket-api-key: ${{ secrets.SOCKET_API_TOKEN }}
          working-directory: ${{ inputs.working-directory }}

      - uses: SocketDev/socket-registry/.github/actions/run-script@ea60ce98fb4a0070c3ec98c3bd41709d034c9e8a # main
        with:
          main-script: ${{ inputs.type-check-script }}
          setup-script: ${{ inputs.type-check-setup-script }}
          working-directory: ${{ inputs.working-directory }}

  test:
    if: inputs.run-test
    name: 🧪 Test Matrix
    strategy:
      fail-fast: ${{ inputs.fail-fast }}
      max-parallel: ${{ inputs.max-parallel }}
      matrix:
        node-version: ${{ fromJson(inputs.node-versions) }}
        os: ${{ fromJson(inputs.os-versions) }}
    runs-on: ${{ matrix.os }}
    timeout-minutes: ${{ inputs.test-timeout-minutes }}
    steps:
      - uses: SocketDev/socket-registry/.github/actions/setup-and-install@ea60ce98fb4a0070c3ec98c3bd41709d034c9e8a # main
        with:
          debug: ${{ inputs.debug }}
          node-version: ${{ matrix.node-version }}
          socket-api-key: ${{ secrets.SOCKET_API_TOKEN }}
          working-directory: ${{ inputs.working-directory }}

      - uses: SocketDev/socket-registry/.github/actions/run-script@ea60ce98fb4a0070c3ec98c3bd41709d034c9e8a # main
        with:
          main-script: ${{ inputs.test-script }}
          setup-script: ${{ inputs.test-setup-script }}
          working-directory: ${{ inputs.working-directory }}