ci.yml

---
name: CI
on:
  push:
    branches:
    - master
    - release
    - release-candidate
  pull_request:
jobs:
  python-tests:
    runs-on: ubuntu-24.04

    services:
      db:
        image: postgres:18.1
        # Health checks to wait until postgres has started
        options: >-
          --health-cmd pg_isready
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5
        env:
          POSTGRES_USER: postgres
          POSTGRES_PASSWORD: postgres # pragma: allowlist secret
          POSTGRES_DB: postgres
        ports:
        - 5432:5432

      redis:
        image: redis:8.4.0
        ports:
        - 6379:6379

    steps:
    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

    - name: update
      run: sudo apt-get update -y

    - name: Apt install
      run: cat Aptfile | sudo xargs apt-get install

    - name: Install uv
      uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
      with:
        enable-cache: true

    - name: Install Python
      run: uv python install 3.13

    - name: Install dependencies
      run: uv sync --locked

    - name: Tests
      run: |
        uv run ./manage.py check --fail-level WARNING
        export MEDIA_ROOT="$(mktemp -d)"
        sudo mkdir /var/media
        sudo chown -R $USER:$USER /var/media
        uv run ./scripts/test/python_tests.sh
      env:
        OCW_STUDIO_DB_DISABLE_SSL: "True"
        OCW_STUDIO_SECURE_SSL_REDIRECT: "False"
        CELERY_TASK_ALWAYS_EAGER: "True"
        CELERY_BROKER_URL: redis://localhost:6379/4
        CELERY_RESULT_BACKEND: redis://localhost:6379/4
        DATABASE_URL: postgres://postgres:postgres@localhost:5432/postgres   # pragma: allowlist secret
        DEBUG: "False"
        MAILGUN_SENDER_DOMAIN: "fake.example.com"
        MAILGUN_KEY: "fake"
        NODE_ENV: "production"
        OCW_STUDIO_BASE_URL: "http://localhost:8043/"
        SOCIAL_AUTH_SAML_LOGIN_URL: "fake.example.com/login/saml/"
        SECRET_KEY: "secret"   # pragma: allowlist secret
        CONTENT_SYNC_BACKEND:

  frontend-tests:
    runs-on: ubuntu-24.04
    steps:
    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

    - name: Setup NodeJS
      uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f   # v6
      with:
        node-version: 24
        cache: yarn

    - name: Install dependencies
      run: yarn install --immutable

    - name: Lints
      run: npm run lint

    - name: Code formatting
      run: npm run fmt:check

    - name: Scss lint
      run: npm run scss_lint

    - name: Typechecking
      run: npm run typecheck

    - name: Tests
      run: npm run test:coverage
      env:
        NODE_ENV: development

    - name: Webpack build
      run: npm run build