ci.yml

name: CI

on:
  push:
    branches:
      - master
  pull_request:
    branches:
      - master

permissions:
  contents: read

concurrency:
  group: ci-${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true

env:
  NODE_VERSION: 24.18.0
  PNPM_VERSION: 8.15.9

jobs:
  backend-tests:
    name: Backend tests
    runs-on: ubuntu-24.04
    timeout-minutes: 15
    env:
      WAITQUEUE_REDIS_INTEGRATION_URL: redis://127.0.0.1:6379/15
    services:
      redis:
        image: redis:7.4.10-alpine
        ports:
          - 6379:6379
        options: >-
          --health-cmd "redis-cli ping"
          --health-interval 2s
          --health-timeout 2s
          --health-retries 20
    steps:
      - name: Check out repository
        uses: actions/checkout@v7
        with:
          persist-credentials: false

      - name: Set up Node.js
        uses: actions/setup-node@v7
        with:
          node-version: ${{ env.NODE_VERSION }}
          check-latest: false

      - name: Activate pnpm
        shell: bash
        run: |
          set -Eeuo pipefail
          corepack enable
          corepack prepare "pnpm@${PNPM_VERSION}" --activate

      - name: Locate pnpm store
        id: pnpm-store
        shell: bash
        run: |
          set -Eeuo pipefail
          echo "path=$(pnpm store path --silent)" >> "$GITHUB_OUTPUT"

      - name: Restore pnpm store
        uses: actions/cache@v6
        with:
          path: ${{ steps.pnpm-store.outputs.path }}
          key: ${{ runner.os }}-${{ runner.arch }}-node-${{ env.NODE_VERSION }}-pnpm-${{ env.PNPM_VERSION }}-backend-${{ hashFiles('wait-queue/pnpm-lock.yaml') }}
          restore-keys: |
            ${{ runner.os }}-${{ runner.arch }}-node-${{ env.NODE_VERSION }}-pnpm-${{ env.PNPM_VERSION }}-backend-

      - name: Install backend dependencies
        shell: bash
        run: |
          set -Eeuo pipefail
          corepack pnpm --dir wait-queue install --frozen-lockfile

      - name: Run backend tests
        shell: bash
        run: |
          set -Eeuo pipefail
          corepack pnpm --dir wait-queue test

  dashboard-typecheck:
    name: Dashboard typecheck
    runs-on: ubuntu-24.04
    timeout-minutes: 15
    steps:
      - name: Check out repository
        uses: actions/checkout@v7
        with:
          persist-credentials: false

      - name: Set up Node.js
        uses: actions/setup-node@v7
        with:
          node-version: ${{ env.NODE_VERSION }}
          check-latest: false

      - name: Activate pnpm
        shell: bash
        run: |
          set -Eeuo pipefail
          corepack enable
          corepack prepare "pnpm@${PNPM_VERSION}" --activate

      - name: Locate pnpm store
        id: pnpm-store
        shell: bash
        run: |
          set -Eeuo pipefail
          echo "path=$(pnpm store path --silent)" >> "$GITHUB_OUTPUT"

      - name: Restore pnpm store
        uses: actions/cache@v6
        with:
          path: ${{ steps.pnpm-store.outputs.path }}
          key: ${{ runner.os }}-${{ runner.arch }}-node-${{ env.NODE_VERSION }}-pnpm-${{ env.PNPM_VERSION }}-dashboard-${{ hashFiles('admin-dashboard/pnpm-lock.yaml') }}
          restore-keys: |
            ${{ runner.os }}-${{ runner.arch }}-node-${{ env.NODE_VERSION }}-pnpm-${{ env.PNPM_VERSION }}-dashboard-

      - name: Install dashboard dependencies
        shell: bash
        run: |
          set -Eeuo pipefail
          corepack pnpm --dir admin-dashboard install --frozen-lockfile

      - name: Run dashboard typecheck
        shell: bash
        run: |
          set -Eeuo pipefail
          corepack pnpm --dir admin-dashboard typecheck

      - name: Check dashboard design contract
        shell: bash
        run: |
          set -Eeuo pipefail
          corepack pnpm --dir admin-dashboard check:design

  production-build:
    name: Production build
    runs-on: ubuntu-24.04
    timeout-minutes: 20
    steps:
      - name: Check out repository
        uses: actions/checkout@v7
        with:
          persist-credentials: false

      - name: Set up Node.js
        uses: actions/setup-node@v7
        with:
          node-version: ${{ env.NODE_VERSION }}
          check-latest: false

      - name: Activate pnpm
        shell: bash
        run: |
          set -Eeuo pipefail
          corepack enable
          corepack prepare "pnpm@${PNPM_VERSION}" --activate

      - name: Locate pnpm store
        id: pnpm-store
        shell: bash
        run: |
          set -Eeuo pipefail
          echo "path=$(pnpm store path --silent)" >> "$GITHUB_OUTPUT"

      - name: Restore pnpm store
        uses: actions/cache@v6
        with:
          path: ${{ steps.pnpm-store.outputs.path }}
          key: ${{ runner.os }}-${{ runner.arch }}-node-${{ env.NODE_VERSION }}-pnpm-${{ env.PNPM_VERSION }}-all-${{ hashFiles('wait-queue/pnpm-lock.yaml', 'admin-dashboard/pnpm-lock.yaml') }}
          restore-keys: |
            ${{ runner.os }}-${{ runner.arch }}-node-${{ env.NODE_VERSION }}-pnpm-${{ env.PNPM_VERSION }}-all-

      - name: Install all dependencies
        shell: bash
        run: |
          set -Eeuo pipefail
          corepack pnpm install:all

      - name: Build production artifacts
        shell: bash
        run: |
          set -Eeuo pipefail
          corepack pnpm build

      - name: Build and verify static dashboard demo
        shell: bash
        env:
          PAGES_BASE_PATH: /waitqueue.js
        run: |
          set -Eeuo pipefail
          corepack pnpm --dir admin-dashboard build:pages
          corepack pnpm --dir admin-dashboard check:pages

  dependency-audit:
    name: Dependency audit
    runs-on: ubuntu-24.04
    timeout-minutes: 10
    steps:
      - name: Check out repository
        uses: actions/checkout@v7
        with:
          persist-credentials: false

      - name: Set up Node.js
        uses: actions/setup-node@v7
        with:
          node-version: ${{ env.NODE_VERSION }}
          check-latest: false

      - name: Activate pnpm
        shell: bash
        run: |
          set -Eeuo pipefail
          corepack enable
          corepack prepare "pnpm@${PNPM_VERSION}" --activate

      - name: Audit backend production dependencies
        shell: bash
        run: |
          set -Eeuo pipefail
          corepack pnpm --dir wait-queue audit --prod --audit-level high

      - name: Audit dashboard production dependencies
        shell: bash
        run: |
          set -Eeuo pipefail
          corepack pnpm --dir admin-dashboard audit --prod --audit-level high

  compose-smoke:
    name: Compose smoke
    needs:
      - backend-tests
      - dashboard-typecheck
      - production-build
      - dependency-audit
    runs-on: ubuntu-24.04
    timeout-minutes: 30
    env:
      COMPOSE_PROJECT_NAME: waitqueue-ci-${{ github.run_id }}-${{ github.run_attempt }}
      BIND_ADDRESS: 127.0.0.1
      API_PORT: 3000
      DASHBOARD_PORT: 3001
      DB_DATABASE: waitqueue_ci
      DB_USER: waitqueue_ci
      HOOK_URL_ALLOWLIST: https://worker.example.com,http://127.0.0.1:3101
    steps:
      - name: Check out repository
        uses: actions/checkout@v7
        with:
          persist-credentials: false

      - name: Create ephemeral database credentials
        shell: bash
        run: |
          set -Eeuo pipefail
          db_password="$(openssl rand -hex 24)"
          db_root_password="$(openssl rand -hex 24)"
          api_token="$(openssl rand -hex 32)"
          echo "::add-mask::$db_password"
          echo "::add-mask::$db_root_password"
          echo "::add-mask::$api_token"
          {
            echo "DB_PASSWORD=$db_password"
            echo "DB_ROOT_PASSWORD=$db_root_password"
            echo "WAITQUEUE_API_TOKEN=$api_token"
          } >> "$GITHUB_ENV"

      - name: Validate Compose configuration
        shell: bash
        run: |
          set -Eeuo pipefail
          docker compose config --quiet

      - name: Build and start the stack
        shell: bash
        run: |
          set -Eeuo pipefail
          docker compose up --build --detach --wait --wait-timeout 300

      - name: Verify HTTP health endpoints
        shell: bash
        run: |
          set -Eeuo pipefail

          health_json="$(curl --fail --silent --show-error --retry 10 --retry-all-errors --retry-delay 2 \
            "http://127.0.0.1:${API_PORT}/waitqueue/health")"
          jq --exit-status \
            '.code == 0 and .data.status == "ok"' \
            <<< "$health_json" > /dev/null

          live_json="$(curl --fail --silent --show-error \
            "http://127.0.0.1:${API_PORT}/health/live")"
          jq --exit-status \
            '.code == 0 and .data.status == "ok"' \
            <<< "$live_json" > /dev/null

          ready_json="$(curl --fail --silent --show-error --retry 10 --retry-all-errors --retry-delay 2 \
            "http://127.0.0.1:${API_PORT}/waitqueue/ready")"
          jq --exit-status \
            '.code == 0 and .data.status == "ready" and .data.dependencies.mysql == "ok" and .data.dependencies.redis == "ok"' \
            <<< "$ready_json" > /dev/null

          ready_alias_json="$(curl --fail --silent --show-error \
            "http://127.0.0.1:${API_PORT}/health/ready")"
          jq --exit-status \
            '.code == 0 and .data.status == "ready" and .data.dependencies.mysql == "ok" and .data.dependencies.redis == "ok"' \
            <<< "$ready_alias_json" > /dev/null

          unauthenticated_metrics_status="$(curl --silent --show-error --output /dev/null --write-out '%{http_code}' \
            "http://127.0.0.1:${API_PORT}/metrics")"
          test "$unauthenticated_metrics_status" = "401"

          unauthenticated_metrics_slash_status="$(curl --silent --show-error --output /dev/null --write-out '%{http_code}' \
            "http://127.0.0.1:${API_PORT}/metrics/")"
          test "$unauthenticated_metrics_slash_status" = "401"

          wrong_token_metrics_slash_status="$(curl --silent --show-error --output /dev/null --write-out '%{http_code}' \
            --header 'Authorization: Bearer definitely-wrong' \
            "http://127.0.0.1:${API_PORT}/metrics/")"
          test "$wrong_token_metrics_slash_status" = "401"

          metrics_body="$(curl --fail --silent --show-error \
            --header "Authorization: Bearer ${WAITQUEUE_API_TOKEN}" \
            "http://127.0.0.1:${API_PORT}/metrics")"
          grep --fixed-strings --quiet '# TYPE waitqueue_queue_waiting_tasks gauge' <<< "$metrics_body"
          grep --fixed-strings --quiet '# TYPE waitqueue_callback_attempts_total counter' <<< "$metrics_body"
          if grep --extended-regexp --quiet 'namespace=|task_id=|taskId=|token=|hook_url=|hookUrl=' <<< "$metrics_body"; then
            exit 1
          fi

          unauthenticated_status="$(curl --silent --show-error --output /dev/null --write-out '%{http_code}' \
            "http://127.0.0.1:${API_PORT}/waitqueue/admin/overview")"
          test "$unauthenticated_status" = "401"

          wrong_token_status="$(curl --silent --show-error --output /dev/null --write-out '%{http_code}' \
            --header 'Authorization: Bearer definitely-wrong' \
            "http://127.0.0.1:${API_PORT}/waitqueue/admin/overview")"
          test "$wrong_token_status" = "401"

          authenticated_json="$(curl --fail --silent --show-error \
            --header "Authorization: Bearer ${WAITQUEUE_API_TOKEN}" \
            "http://127.0.0.1:${API_PORT}/waitqueue/admin/overview")"
          jq --exit-status \
            '.code == 0 and .data.summary.queueCount == 0 and .data.summary.retrying == 0 and .data.summary.deadLetters == 0 and .data.summary.oldestWaitingAt == null and .data.summary.oldestWaitingAgeSeconds == null and (.data.metricsStartedAt | type) == "string"' \
            <<< "$authenticated_json" > /dev/null

          private_hook_status="$(curl --silent --show-error --output /dev/null --write-out '%{http_code}' \
            --request POST \
            --header "Authorization: Bearer ${WAITQUEUE_API_TOKEN}" \
            --header 'Content-Type: application/json' \
            --data '{"namespace":"blocked","hookUrl":"http://127.0.0.1:3101/callback"}' \
            "http://127.0.0.1:${API_PORT}/waitqueue/queue/newQueue")"
          test "$private_hook_status" = "400"

          oversized_status="$(python3 -c \
            'import json; print(json.dumps({"namespace":"large","hookUrl":"https://worker.example.com/" + "x" * 40000}))' \
            | curl --silent --show-error --output /dev/null --write-out '%{http_code}' \
                --request POST \
                --header "Authorization: Bearer ${WAITQUEUE_API_TOKEN}" \
                --header 'Content-Type: application/json' \
                --data-binary @- \
                "http://127.0.0.1:${API_PORT}/waitqueue/queue/newQueue")"
          test "$oversized_status" = "413"

          dashboard_html="$(curl --fail --silent --show-error --retry 10 --retry-all-errors --retry-delay 2 \
            "http://127.0.0.1:${DASHBOARD_PORT}/")"
          grep --fixed-strings --quiet 'data-product="waitqueue-console"' <<< "$dashboard_html"
          node -e '
            let html = "";
            process.stdin.setEncoding("utf8");
            process.stdin.on("data", (chunk) => { html += chunk; });
            process.stdin.on("end", () => {
              const css = html.match(/<style id="antd-ssr">([\s\S]*?)<\/style>/)?.[1] || "";
              if (css.length < 1000 || !/\.ant-(app|btn|layout|menu|table)/.test(css)) process.exit(1);
            });
          ' <<< "$dashboard_html"

          dashboard_live_json="$(curl --fail --silent --show-error \
            "http://127.0.0.1:${DASHBOARD_PORT}/waitqueue/health/live")"
          jq --exit-status \
            '.code == 0 and .data.status == "ok"' \
            <<< "$dashboard_live_json" > /dev/null

          dashboard_metrics_status="$(curl --silent --show-error --output /dev/null --write-out '%{http_code}' \
            "http://127.0.0.1:${DASHBOARD_PORT}/waitqueue/metrics")"
          test "$dashboard_metrics_status" = "404"

          proxy_content_type_status="$(curl --silent --show-error --output /dev/null --write-out '%{http_code}' \
            --request POST \
            --header 'Content-Type: text/plain' \
            --data 'not-json' \
            "http://127.0.0.1:${DASHBOARD_PORT}/waitqueue/queue/newQueue")"
          test "$proxy_content_type_status" = "415"

          proxy_jsonp_status="$(curl --silent --show-error --output /dev/null --write-out '%{http_code}' \
            --request POST \
            --header 'Content-Type: application/jsonp' \
            --data '{}' \
            "http://127.0.0.1:${DASHBOARD_PORT}/waitqueue/queue/newQueue")"
          test "$proxy_jsonp_status" = "415"

          untrusted_host_status="$(curl --silent --show-error --output /dev/null --write-out '%{http_code}' \
            --header "Host: attacker.example:${DASHBOARD_PORT}" \
            "http://127.0.0.1:${DASHBOARD_PORT}/waitqueue/admin/overview")"
          test "$untrusted_host_status" = "403"

          proxy_oversized_status="$(python3 -c \
            'import json; print(json.dumps({"namespace":"large","hookUrl":"https://worker.example.com/" + "x" * 40000}))' \
            | curl --silent --show-error --output /dev/null --write-out '%{http_code}' \
                --request POST \
                --header 'Content-Type: application/json' \
                --data-binary @- \
                "http://127.0.0.1:${DASHBOARD_PORT}/waitqueue/queue/newQueue")"
          test "$proxy_oversized_status" = "413"

          proxy_queue_json="$(curl --fail --silent --show-error \
            --request POST \
            --header 'Authorization: Bearer browser-controlled-value' \
            --header 'Cookie: session=browser-controlled-value' \
            --header 'Content-Type: application/json' \
            --data '{"namespace":"ci","hookUrl":"https://worker.example.com/callback","currMaxCount":2,"crontab":{"run":"0 0 0 1 1 *","check":"0 0 0 1 1 *","expire":"0 0 0 1 1 *"}}' \
            "http://127.0.0.1:${DASHBOARD_PORT}/waitqueue/queue/newQueue")"
          jq --exit-status '.code == 0' <<< "$proxy_queue_json" > /dev/null

          proxy_task_json="$(curl --fail --silent --show-error \
            --request POST \
            --header 'Content-Type: application/json' \
            --data '{"namespace":"ci","hookUrl":"https://worker.example.com/callback","taskId":"ci-proxy-task"}' \
            "http://127.0.0.1:${DASHBOARD_PORT}/waitqueue/scheduler/addTask")"
          jq --exit-status '.code == 0' <<< "$proxy_task_json" > /dev/null

          proxied_json="$(curl --fail --silent --show-error \
            "http://127.0.0.1:${DASHBOARD_PORT}/waitqueue/admin/overview")"
          jq --exit-status \
            '.code == 0 and .data.summary.queueCount == 1 and .data.summary.waiting == 1' \
            <<< "$proxied_json" > /dev/null

          queue_id="$(jq --raw-output '.data.queues[0].queueId' <<< "$proxied_json")"
          dead_entry_id='ci-dead-entry-1'
          dead_task_id='ci-dead-task'
          dead_metadata="$(jq --compact-output --null-input \
            --arg entryId "$dead_entry_id" \
            '{entryId: $entryId, retryCount: 2, failedAt: 1700000000000, reason: "callback_failed", token: "pending:ci-old-claim"}')"
          docker compose exec -T redis redis-cli HSET \
            "TaskQueue:ci:${queue_id}:deadLetterHashKv" "$dead_task_id" "$dead_metadata" > /dev/null
          docker compose exec -T redis redis-cli ZADD \
            "TaskQueue:ci:${queue_id}:deadLetterZset" 1700000000000 "$dead_task_id" > /dev/null
          docker compose exec -T redis redis-cli HSET \
            "TaskQueue:ci:${queue_id}:taskStateHashKv" "$dead_task_id" dead > /dev/null
          docker compose exec -T redis redis-cli HSET \
            "TaskQueue:ci:${queue_id}:taskGenerationHashKv" "$dead_task_id" "$dead_entry_id" > /dev/null

          dead_letters_json="$(curl --fail --silent --show-error --get \
            --data-urlencode "queueId=${queue_id}" \
            --data-urlencode 'limit=10' \
            "http://127.0.0.1:${DASHBOARD_PORT}/waitqueue/admin/deadLetters")"
          jq --exit-status \
            --arg entryId "$dead_entry_id" --arg taskId "$dead_task_id" \
            '.code == 0 and .data.total == 1 and .data.items[0].entryId == $entryId and .data.items[0].taskId == $taskId' \
            <<< "$dead_letters_json" > /dev/null

          rejected_query_status="$(curl --silent --show-error --output /dev/null --write-out '%{http_code}' \
            "http://127.0.0.1:${DASHBOARD_PORT}/waitqueue/admin/deadLetters?queueId=${queue_id}&token=not-forwarded")"
          test "$rejected_query_status" = "400"

          replay_json="$(jq --compact-output --null-input \
            --argjson queueId "$queue_id" --arg taskId "$dead_task_id" --arg entryId "$dead_entry_id" \
            '{queueId: $queueId, taskId: $taskId, entryId: $entryId}')"
          curl --fail --silent --show-error \
            --request POST \
            --header 'Content-Type: application/json' \
            --data "$replay_json" \
            "http://127.0.0.1:${DASHBOARD_PORT}/waitqueue/admin/deadLetters/replay" \
            | jq --exit-status '.code == 0 and .data.isOk == true' > /dev/null

          replayed_waiting="$(docker compose exec -T redis redis-cli LLEN \
            "TaskQueue:ci:${queue_id}:waitingQueue")"
          test "$replayed_waiting" = "2"

          docker compose exec -T dashboard sh -eu -c \
            '! grep --recursive --fixed-strings --quiet "$WAITQUEUE_API_TOKEN" /app/.next/static'

      - name: Verify migration history and idempotency
        shell: bash
        run: |
          set -Eeuo pipefail

          expected_count=0
          while IFS= read -r migration_path; do
            migration_name="${migration_path##*/}"
            if [[ "$migration_name" =~ ^V[1-9][0-9]*__.+\.sql$ ]]; then
              expected_count=$((expected_count + 1))
            fi
          done < <(find wait-queue/sql -maxdepth 1 -type f -print)

          if (( expected_count == 0 )); then
            echo "No versioned migrations were discovered" >&2
            exit 1
          fi

          before_count="$(docker compose exec -T mysql sh -eu -c '
            MYSQL_PWD="$MYSQL_PASSWORD" mysql \
              --batch --skip-column-names \
              --user="$MYSQL_USER" "$MYSQL_DATABASE" \
              --execute="SELECT COUNT(*) FROM waitqueue_schema_migrations"
          ')"

          if [[ "$before_count" != "$expected_count" ]]; then
            echo "Expected $expected_count migration records, found $before_count" >&2
            exit 1
          fi

          rerun_output="$(docker compose run --rm --no-deps -T migrate)"
          printf '%s\n' "$rerun_output"

          if ! grep --extended-regexp --quiet '"applied":0([,}])' <<< "$rerun_output"; then
            echo "The idempotency run did not report zero applied migrations" >&2
            exit 1
          fi

          after_count="$(docker compose exec -T mysql sh -eu -c '
            MYSQL_PWD="$MYSQL_PASSWORD" mysql \
              --batch --skip-column-names \
              --user="$MYSQL_USER" "$MYSQL_DATABASE" \
              --execute="SELECT COUNT(*) FROM waitqueue_schema_migrations"
          ')"

          if [[ "$after_count" != "$before_count" ]]; then
            echo "Migration history changed on the idempotency run" >&2
            exit 1
          fi

      - name: Print diagnostics on failure
        if: failure()
        shell: bash
        run: |
          set -Eeuo pipefail
          docker compose ps --all || true
          docker compose logs --no-color --timestamps || true

      - name: Remove CI stack and volumes
        if: always()
        shell: bash
        run: |
          set -Eeuo pipefail
          docker compose down --volumes --remove-orphans --timeout 20