OurHike/.github/workflows/client-tests.yml at main · ghzhost/OurHike · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
name: Client tests

on:
  # `main` only. Matching every branch here would double every PR's CI:
  # pushing to a PR branch fires BOTH the push event and the pull_request
  # event for the same commit, running each job twice for an identical
  # result. The pull_request trigger below already covers branches.
  #
  # This run is still worth keeping for main itself - it is post-merge
  # validation against the real merge commit, which is exactly what caught
  # the flaky staleness boundary test in #32 (green on the PR, red on the
  # merge).
  push:
    branches: [main]
  # Deliberately NOT narrowed with `paths:`, even though that is the obvious
  # way to stop a docs-only PR building the client. A workflow skipped by a
  # path filter reports no status at all, and a required check that reports
  # no status blocks the PR forever rather than passing it - the same trap
  # pr-issue-link.yml documents for job-level `if:`. The scoping happens
  # inside the job instead, where it can still finish green.
  pull_request:
    branches: [main]
  # The event a merge queue raises checks on. This has to be in place before
  # the queue is switched on rather than after: a required check that never
  # reports does not fail a queue entry, it hangs it until the queue times out
  # and ejects the pull request. BRANCHING.md holds the rest of the setup.
  #
  # Deliberately unfiltered, unlike the two triggers above. A queue entry's ref
  # is `refs/heads/gh-readonly-queue/main/pr-N-<sha>` rather than `main`, and
  # `merge_group`'s `branches:` filter is undocumented as to which of those two
  # it matches (github/docs#32879). A filter that guesses wrong costs the same
  # hang as no trigger at all, and there is nothing to scope anyway - a queue
  # is enabled per branch in the ruleset, and only `main` has one.
  merge_group:

# Narrower than the default token. `pull-requests: read` is what lets the
# scope step ask which files the pull request touches.
permissions:
  contents: read
  pull-requests: read

jobs:
  test:
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: client
    steps:
      # No `if:` on this job, and there should never be one - see the note on
      # the trigger above. The steps carry the condition instead, so a PR that
      # touches nothing under client/ still reports success having done
      # nothing, and this can be made a required check without that becoming a
      # trap.
      #
      # Checkout is unconditional because the scope action lives in this
      # repository and has to be on disk before it can decide anything.
      - uses: actions/checkout@v4

      - id: scope
        uses: ./.github/actions/changed-paths
        with:
          # client/ carries its own package.json and lockfile, and nothing
          # outside it is IMPORTED by the client - checked, not assumed.
          # The workflow and the action are in the list so a change to the
          # gate itself still proves the suite it gates.
          #
          # Imported is not the same as read, and the difference was a real
          # hole (TESTING.md's "Redundancy" audit, 2026-08-06). Three suites
          # read files outside client/ at runtime:
          #
          #   pipeline/reference/gain_vectors.json  lib/elevationGain.test.ts
          #   site/index.html                       test/siteLayout.test.ts
          #   .github/ISSUE_TEMPLATE/*.yml          test/issueFormPrefill.test.ts
          #
          # Scoped to client/ alone, a pull request editing the shared gain
          # vectors ran only the Python half of a drift guard whose whole
          # point is that both halves read the same file - and only the
          # unscoped run on `main` closed it, after the merge. The rule that
          # keeps this honest: **a suite's scope list includes every file its
          # tests read.**
          #
          # The issue forms joined that list with #626: Settings links into
          # them with fields prefilled, and GitHub matches a prefilled dropdown
          # by its option TEXT - so rewording a label there and nowhere else
          # breaks the links silently, and this is the run that says so.
          paths: client/ pipeline/reference/ site/ .github/ISSUE_TEMPLATE/ .github/workflows/client-tests.yml .github/actions/changed-paths/

      - uses: actions/setup-node@v4
        if: steps.scope.outputs.run == 'true'
        with:
          node-version: 24
          cache: npm
          cache-dependency-path: client/package-lock.json

      - name: Install dependencies
        if: steps.scope.outputs.run == 'true'
        run: npm ci

      - name: Lint
        if: steps.scope.outputs.run == 'true'
        run: npm run lint

      - name: Check formatting
        if: steps.scope.outputs.run == 'true'
        run: npm run format:check

      - name: Typecheck
        if: steps.scope.outputs.run == 'true'
        run: npm run typecheck

      - name: Run tests
        if: steps.scope.outputs.run == 'true'
        run: npm test

      - name: Build
        if: steps.scope.outputs.run == 'true'
        run: npm run build