static-checks.yml

name: Static Checks

on:
  pull_request:
  push:
    branches:
      - main

permissions:
  contents: read

concurrency:
  group: static-checks-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true

jobs:
  changes:
    name: Detect affected surfaces
    runs-on: ubuntu-24.04
    timeout-minutes: 5
    outputs:
      base_sha: ${{ steps.scope.outputs.base_sha }}
      code: ${{ steps.scope.outputs.code }}
      global_code: ${{ steps.scope.outputs.global_code }}
      head_sha: ${{ steps.scope.outputs.head_sha }}
      knip_browser_driver: ${{ steps.scope.outputs.knip_browser_driver }}
      knip_skill_runtime: ${{ steps.scope.outputs.knip_skill_runtime }}
      nonworkspace_code: ${{ steps.scope.outputs.nonworkspace_code }}
      root_code: ${{ steps.scope.outputs.root_code }}
      skills: ${{ steps.scope.outputs.skills }}
      workflow: ${{ steps.scope.outputs.workflow }}
    steps:
      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
        with:
          fetch-depth: 0
          ref: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.sha }}

      - name: Validate pull request title
        if: github.event_name == 'pull_request'
        env:
          PR_AUTHOR: ${{ github.event.pull_request.user.login }}
          PR_TITLE: ${{ github.event.pull_request.title }}
        run: |
          python3 - <<'PY'
          import os
          import re

          author = os.environ["PR_AUTHOR"]
          title = os.environ["PR_TITLE"]
          pattern = re.compile(
              r"(?:build|chore|ci|docs|feat|fix|perf|refactor|revert|style|test)"
              r"(?:\([a-z0-9][a-z0-9._/-]*\))?!?: \S.*"
          )
          if pattern.fullmatch(title) is None:
              raise SystemExit("Pull request titles must use Conventional Commits.")
          # Dependabot titles are machine-generated from group/directory names, grow past 72 chars, and are not configurable; commitlint's own ceiling is 100.
          if len(title) > 72 and author != "dependabot[bot]":
              raise SystemExit("Pull request titles must be at most 72 characters.")
          PY

      - name: Classify changed files
        id: scope
        env:
          EVENT_NAME: ${{ github.event_name }}
          EVENT_BEFORE_SHA: ${{ github.event.before }}
          EVENT_HEAD_SHA: ${{ github.sha }}
          PR_BASE_SHA: ${{ github.event.pull_request.base.sha }}
          PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
        run: |
          set -Eeuo pipefail

          if [ "$EVENT_NAME" = "pull_request" ]; then
            base_sha="$PR_BASE_SHA"
            head_sha="$PR_HEAD_SHA"
          else
            base_sha="$EVENT_BEFORE_SHA"
            head_sha="$EVENT_HEAD_SHA"
          fi

          force_global=false
          if [[ ! "$base_sha" =~ ^[0-9a-f]{40}$ ]] ||
             [ "$base_sha" = "0000000000000000000000000000000000000000" ]; then
            if parent_sha="$(git rev-parse "$head_sha^" 2>/dev/null)"; then
              base_sha="$parent_sha"
            else
              base_sha="$head_sha"
              force_global=true
            fi
          fi

          code="$force_global"
          global_code="$force_global"
          nonworkspace_code="$force_global"
          root_code="$force_global"
          skills=false
          workflow=false
          knip_browser_driver=false
          knip_skill_runtime=false

          while IFS= read -r -d '' file; do
            case "$file" in
              .github/actions/* | .github/workflows/*)
                workflow=true
                ;;
              apps/* | packages/*)
                if [[ "$file" != *.md ]]; then code=true; fi
                ;;
              skills/*)
                code=true
                nonworkspace_code=true
                skills=true
                ;;
              scripts/*.ts)
                code=true
                nonworkspace_code=true
                root_code=true
                ;;
              .dependency-cruiser.cjs | .npmrc | .nvmrc | biome.jsonc | knip.jsonc | package.json | pnpm-lock.yaml | pnpm-workspace.yaml | tsconfig.base.json | turbo.json)
                code=true
                global_code=true
                nonworkspace_code=true
                root_code=true
                ;;
              commitlint.config.js | lefthook.yml | tsconfig.scripts.json)
                code=true
                nonworkspace_code=true
                root_code=true
                ;;
              infra/containers/sandbox/*.js | infra/containers/sandbox/*.json | infra/containers/sandbox/*.jsonc | infra/containers/sandbox/*.mjs | infra/containers/sandbox/*.ts | infra/containers/sandbox/*.tsx)
                code=true
                nonworkspace_code=true
                ;;
            esac

            case "$file" in
              infra/containers/sandbox/browser-driver/*)
                knip_browser_driver=true
                ;;
              infra/containers/sandbox/skill-runtime/*)
                knip_skill_runtime=true
                ;;
            esac
          done < <(git diff --name-only --diff-filter=ACMR -z "$base_sha" "$head_sha")

          {
            echo "base_sha=$base_sha"
            echo "code=$code"
            echo "global_code=$global_code"
            echo "head_sha=$head_sha"
            echo "knip_browser_driver=$knip_browser_driver"
            echo "knip_skill_runtime=$knip_skill_runtime"
            echo "nonworkspace_code=$nonworkspace_code"
            echo "root_code=$root_code"
            echo "skills=$skills"
            echo "workflow=$workflow"
          } >> "$GITHUB_OUTPUT"

  workflow-lint:
    name: Workflow lint
    needs: changes
    if: needs.changes.outputs.workflow == 'true'
    runs-on: ubuntu-24.04
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
      - name: Lint GitHub Actions and embedded shell
        uses: raven-actions/actionlint@3d39aea434753780c3b3d4a1a31c854b4dbf49d7 # v2.2.0
        with:
          pyflakes: false
          shellcheck: true
          version: 1.7.12

  code-checks:
    name: Affected code checks
    needs: changes
    if: needs.changes.outputs.code == 'true'
    runs-on: ubuntu-24.04
    timeout-minutes: 45
    env:
      BASE_SHA: ${{ needs.changes.outputs.base_sha }}
      GLOBAL_CODE: ${{ needs.changes.outputs.global_code }}
      HEAD_SHA: ${{ needs.changes.outputs.head_sha }}
      SKILLS_CHANGED: ${{ needs.changes.outputs.skills }}
    steps:
      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
        with:
          fetch-depth: 0
          ref: ${{ needs.changes.outputs.head_sha }}
      - uses: ./.github/actions/setup-repository

      - name: Resolve dependency-aware workspace scope
        id: workspace-scope
        run: |
          set -Eeuo pipefail
          filters=()
          if [ "$GLOBAL_CODE" != true ]; then
            filters+=("--filter=...[$BASE_SHA...$HEAD_SHA]")
            if [ "$SKILLS_CHANGED" = true ]; then
              filters+=("--filter=...@cheatcode/skills")
            fi
          fi
          scope="$(pnpm exec turbo run build "${filters[@]}" --dry-run=json)"
          echo "packages=$(jq --compact-output '[.packages[] | select(. != "//")] | unique' <<< "$scope")" >> "$GITHUB_OUTPUT"
          echo "directories=$(jq --compact-output '[.tasks[].directory] | unique' <<< "$scope")" >> "$GITHUB_OUTPUT"

      - name: Lint all files under a changed global configuration
        if: needs.changes.outputs.global_code == 'true'
        run: pnpm lint

      - name: Lint changed non-workspace files
        if: needs.changes.outputs.global_code != 'true' && needs.changes.outputs.nonworkspace_code == 'true'
        run: |
          set -Eeuo pipefail
          lintable=()
          while IFS= read -r -d '' file; do
            case "$file" in
              *.css | *.js | *.json | *.jsonc | *.jsx | *.mjs | *.ts | *.tsx)
                lintable+=("$file")
                ;;
            esac
          done < <(git diff --name-only --diff-filter=ACMR -z "$BASE_SHA" "$HEAD_SHA")
          if [ "${#lintable[@]}" -gt 0 ]; then
            pnpm exec biome check --error-on-warnings --no-errors-on-unmatched "${lintable[@]}"
          fi

      - name: Lint, typecheck, and build affected workspaces
        if: steps.workspace-scope.outputs.packages != '[]'
        env:
          CLERK_SECRET_KEY: sk_test_static_checks_do_not_authenticate
          NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY: pk_test_c3RhdGljLWNoZWNrcy0wMC5jbGVyay5hY2NvdW50cy5kZXYk
          NEXT_PUBLIC_GATEWAY_URL: ${{ vars.NEXT_PUBLIC_GATEWAY_URL }}
          VERCEL_GIT_COMMIT_SHA: ${{ github.sha }}
        run: |
          set -Eeuo pipefail
          filters=()
          if [ "$GLOBAL_CODE" != true ]; then
            filters+=("--filter=...[$BASE_SHA...$HEAD_SHA]")
            if [ "$SKILLS_CHANGED" = true ]; then
              filters+=("--filter=...@cheatcode/skills")
            fi
          fi
          pnpm exec turbo run lint typecheck build "${filters[@]}"

      - name: Typecheck operational scripts
        if: needs.changes.outputs.root_code == 'true'
        run: pnpm typecheck:scripts

      - name: Check affected architecture boundaries
        if: steps.workspace-scope.outputs.directories != '[]'
        env:
          DIRECTORIES: ${{ steps.workspace-scope.outputs.directories }}
        run: |
          set -Eeuo pipefail
          mapfile -t directories < <(jq --raw-output '.[]' <<< "$DIRECTORIES")
          pnpm exec dependency-cruise \
            --config .dependency-cruiser.cjs \
            --ts-config tsconfig.base.json \
            --exclude '(^|/)(\.next|\.turbo|node_modules)/' \
            "${directories[@]}"

      - name: Check dead code
        env:
          KNIP_BROWSER_DRIVER: ${{ needs.changes.outputs.knip_browser_driver }}
          KNIP_SKILL_RUNTIME: ${{ needs.changes.outputs.knip_skill_runtime }}
          PACKAGES: ${{ steps.workspace-scope.outputs.packages }}
          ROOT_CODE: ${{ needs.changes.outputs.root_code }}
        run: |
          set -Eeuo pipefail
          if [ "$GLOBAL_CODE" = true ] || [ "$ROOT_CODE" = true ]; then
            pnpm deadcode
            exit 0
          fi

          workspaces=()
          while IFS= read -r package; do
            workspaces+=(--workspace "$package")
          done < <(jq --raw-output '.[]' <<< "$PACKAGES")
          if [ "$KNIP_BROWSER_DRIVER" = true ]; then
            workspaces+=(--workspace @cheatcode/sandbox-browser-driver)
          fi
          if [ "$KNIP_SKILL_RUNTIME" = true ]; then
            workspaces+=(--workspace @cheatcode/sandbox-skills-runtime)
          fi
          if [ "${#workspaces[@]}" -gt 0 ]; then
            pnpm exec knip --cache "${workspaces[@]}"
          fi

  static-checks:
    name: static-checks
    needs: [changes, workflow-lint, code-checks]
    if: always()
    runs-on: ubuntu-24.04
    timeout-minutes: 5
    steps:
      - name: Require every applicable check to pass
        env:
          CHANGES_RESULT: ${{ needs.changes.result }}
          CODE_RESULT: ${{ needs.code-checks.result }}
          WORKFLOW_LINT_RESULT: ${{ needs.workflow-lint.result }}
        run: |
          set -Eeuo pipefail
          for result in "$CHANGES_RESULT" "$CODE_RESULT" "$WORKFLOW_LINT_RESULT"; do
            case "$result" in
              success | skipped) ;;
              *) exit 1 ;;
            esac
          done