ci.yml

name: CI

permissions:
  contents: read

on:
  pull_request:
  push:
    branches:
      - main

concurrency:
  group: ci-${{ github.ref }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

env:
  CI_IS_FORK_PULL_REQUEST: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name != github.repository }}

jobs:
  pinned_dependency_policy:
    name: Pinned Dependency Policy
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Setup pnpm
        uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413
        with:
          version: 10.16.0

      - name: Setup Node
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: 24.22.1
          cache: pnpm

      - name: Install
        run: pnpm install --frozen-lockfile

      - name: Require exact direct dependency versions
        run: node scripts/check-pinned-dependency-versions.mjs

  translation_catalog_policy:
    name: Translation Catalog Policy
    if: github.event_name == 'pull_request'
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0

      - name: Require source-only or translation-only catalog changes
        env:
          I18N_BASE_REF: origin/${{ github.base_ref }}
          I18N_HEAD_BRANCH: ${{ github.head_ref }}
          I18N_HEAD_REPOSITORY: ${{ github.event.pull_request.head.repo.full_name }}
          I18N_BASE_REPOSITORY: ${{ github.repository }}
        run: node .github/scripts/check-catalog-change-policy.mjs

  migration_compat_policy:
    name: Migration Compatibility Policy
    if: github.event_name == 'pull_request'
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
          # The PR's own tip, not the merge ref: a stack's merge ref also carries main commits the stack lacks.
          ref: ${{ github.event.pull_request.head.sha }}

      - name: Setup pnpm
        uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86
        with:
          version: 10.16.0

      - name: Setup Node
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: 24.22.1
          cache: pnpm

      - name: Install
        run: pnpm install --frozen-lockfile

      - name: Require rollback-safe migrations
        env:
          # The parent branch tip: on a stacked PR, github.base_ref is the stack base.
          MIGRATION_COMPAT_BASE_REF: ${{ github.event.pull_request.base.sha }}
        run: pnpm check:migration-compat

  module_boundaries:
    name: Module Boundaries
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Setup pnpm
        uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413
        with:
          version: 10.16.0

      - name: Setup Node
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6
        with:
          node-version: 24.22.1

      - name: Check module boundaries
        run: pnpm check:module-boundaries

  lint:
    name: Lint
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0

      - name: Setup pnpm
        uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413
        with:
          version: 10.16.0

      - name: Setup Node
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: 24.22.1
          cache: pnpm

      - name: Install
        run: pnpm install --frozen-lockfile

      - name: Lint
        run: |
          git diff --name-only --diff-filter=d -z origin/main...HEAD \
            | xargs -0 --no-run-if-empty pnpm exec biome check --no-errors-on-unmatched

      # Scripts sit outside every TypeScript program, and the diff-scoped lint above never re-reads
      # one when the package it imports changes its exports, so these are linted in full every run.
      - name: Lint script imports
        run: |
          git ls-files -z ':(glob)**/*.mjs' ':(glob)**/*.cjs' ':(glob)**/scripts/**' ':(glob).github/scripts/**' ':(exclude,glob)examples/**' \
            | xargs -0 pnpm exec biome lint --no-errors-on-unmatched --diagnostic-level=error

      # A package.json edit changes what every file in its workspace may import, and the
      # diff-scoped lint re-reads only the manifest, so the dependency rule runs over all sources.
      - name: Lint declared dependencies
        run: pnpm exec biome lint --only=correctness/noUndeclaredDependencies --diagnostic-level=error apps packages

      # Biome's noRestrictedImports does not read vi.mock-family strings or typeof import() type
      # queries, and its options are replaced per override, so every copy must carry the ../ group.
      - name: Check parent-relative imports
        run: |
          if git grep -nE "(vi\.(mock|doMock|unmock|importActual|importMock)|import)\(['\"]\.\./" -- ':(glob)apps/*/src/**' ':(glob)apps/*/scripts/**' ':(glob)packages/*/src/**' ':(exclude,glob)**/generated/**'; then exit 1; fi
          jq -e '[.. | objects | .noRestrictedImports? | objects] | length == 5 and all(.options.patterns | any(.group | index("../**")))' biome.json

      - name: Check pinned dependencies
        run: pnpm check:pinned-dependencies

  translation_agent:
    name: Translation Agent
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: agents/sdp-translation-agent
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Setup pnpm
        uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413
        with:
          version: 10.16.0

      - name: Setup Node
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: 24.22.1
          cache: pnpm
          cache-dependency-path: agents/sdp-translation-agent/pnpm-lock.yaml

      - name: Install
        run: pnpm install --frozen-lockfile --ignore-workspace

      - name: Typecheck and build
        run: pnpm typecheck && pnpm build

  typecheck:
    name: Typecheck
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0

      - name: Setup pnpm
        uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413
        with:
          version: 10.16.0

      - name: Setup Node
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: 24.22.1
          cache: pnpm

      - name: Install
        run: pnpm install --frozen-lockfile

      - name: Detect changed packages
        id: changed
        run: |
          PACKAGES=$(bash scripts/ci/changed-packages.sh)
          echo "packages=${PACKAGES}" >> "$GITHUB_OUTPUT"

      - name: Typecheck
        if: steps.changed.outputs.packages != ''
        env:
          CHANGED_PACKAGES: ${{ steps.changed.outputs.packages }}
        # "...{dir}" selects the changed package and every workspace package that depends on it,
        # so a change confined to a shared package (say @sdp/ui) still typechecks its consumers.
        run: |
          FILTERS=""
          for pkg in $CHANGED_PACKAGES; do
            FILTERS="$FILTERS --filter ...{./$pkg}"
          done
          pnpm --if-present $FILTERS typecheck

  unit_test_scope:
    name: Unit Test Scope
    runs-on: ubuntu-latest
    outputs:
      api: ${{ steps.detect.outputs.api }}
      rest: ${{ steps.detect.outputs.rest }}
      e2e: ${{ steps.detect.outputs.e2e }}
      docker: ${{ steps.detect.outputs.docker }}
      embedded_yield_example: ${{ steps.detect.outputs.embedded_yield_example }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
      - id: detect
        env:
          BASE_REF: ${{ github.base_ref }}
        run: |
          set -euo pipefail
          if [ "${{ github.event_name }}" != "pull_request" ]; then
            for scope in api rest e2e docker embedded_yield_example; do echo "${scope}=true" >> "$GITHUB_OUTPUT"; done
            exit 0
          fi
          changed=$(git diff --name-only "origin/${BASE_REF}...HEAD")
          printf '%s\n' "$changed"
          detect() {
            if printf '%s\n' "$changed" | grep -E "$2" >/dev/null; then
              echo "$1=true" >> "$GITHUB_OUTPUT"
            else
              echo "$1=false" >> "$GITHUB_OUTPUT"
            fi
          }
          detect api '^(apps/sdp-api/|packages/|package\.json|\.npmrc|pnpm-lock\.yaml|pnpm-workspace\.yaml|patches/|turbo\.json|scripts/run-workspace-tests\.mjs|scripts/doppler/|\.github/workflows/ci\.yml)'
          detect rest '^(apps/|packages/|package\.json|\.npmrc|pnpm-lock\.yaml|pnpm-workspace\.yaml|patches/|turbo\.json|scripts/|\.github/workflows/ci\.yml)'
          detect e2e '^(apps/sdp-api/|apps/sdp-web/|packages/|package\.json|\.npmrc|pnpm-lock\.yaml|pnpm-workspace\.yaml|patches/|turbo\.json|scripts/|\.github/workflows/ci\.yml)'
          detect docker '^(apps/|packages/|package\.json|\.npmrc|tsconfig\.json|pnpm-lock\.yaml|pnpm-workspace\.yaml|patches/|scripts/docker/|docker-compose(\.ci)?\.yml|\.dockerignore|\.github/workflows/ci\.yml)'
          detect embedded_yield_example '^(examples/embedded-yield-bank/|\.github/workflows/ci\.yml)'

  test:
    name: Unit Tests (api ${{ matrix.shard }}/8)
    needs: unit_test_scope
    if: needs.unit_test_scope.outputs.api == 'true'
    runs-on: ubuntu-latest
    timeout-minutes: 20
    permissions:
      contents: read
      id-token: write
    strategy:
      fail-fast: false
      matrix:
        shard: [1, 2, 3, 4, 5, 6, 7, 8]
    env:
      TURBO_CACHE_DIR: ${{ github.workspace }}/.turbo-ci-cache
      CI_HAS_DOPPLER_TOKEN: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
      TEST_WORKSPACE_SPLIT: api
      TEST_CHANGED_SINCE: ${{ github.event_name == 'pull_request' && format('origin/{0}', github.base_ref) || '' }}
      TEST_SHARD: ${{ matrix.shard }}/8
      DOPPLER_PRESERVE_ENV: TEST_CHANGED_SINCE,TEST_WORKSPACE_SPLIT,TEST_SHARD
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0

      - name: Setup pnpm
        uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413
        with:
          version: 10.16.0

      - name: Setup Node
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: 24.22.1
          cache: pnpm

      - name: Restore turbo cache
        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: .turbo-ci-cache
          key: turbo-${{ github.job }}-shard${{ matrix.shard }}-${{ runner.os }}-${{ github.sha }}
          restore-keys: |
            turbo-${{ github.job }}-shard${{ matrix.shard }}-${{ runner.os }}-

      - name: Install
        run: pnpm install --frozen-lockfile

      - name: Validate Doppler OIDC configuration
        if: env.CI_IS_FORK_PULL_REQUEST != 'true'
        run: |
          if [ -z "${{ vars.DOPPLER_CI_IDENTITY_ID }}" ]; then
            echo "DOPPLER_CI_IDENTITY_ID must be configured as a repository variable for secret-aware CI jobs." >&2
            exit 1
          fi

      - name: Install Doppler CLI
        if: env.CI_HAS_DOPPLER_TOKEN == 'true'
        uses: dopplerhq/cli-action@4819d808ab99e5cde19a0637a16536a4038fad73 # v4.0.1

      - name: Doppler OIDC login
        if: env.CI_HAS_DOPPLER_TOKEN == 'true'
        run: scripts/doppler/oidc-login.sh "${{ vars.DOPPLER_CI_IDENTITY_ID }}"

      - name: Unit tests (Doppler)
        if: env.CI_HAS_DOPPLER_TOKEN == 'true'
        env:
          DOPPLER_CONFIG: dev_ci
        run: pnpm test

      - name: Save turbo cache
        if: github.ref == 'refs/heads/main'
        uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: .turbo-ci-cache
          key: turbo-${{ github.job }}-shard${{ matrix.shard }}-${{ runner.os }}-${{ github.sha }}

      - name: Unit tests (fork-safe)
        if: env.CI_IS_FORK_PULL_REQUEST == 'true' && env.CI_HAS_DOPPLER_TOKEN != 'true'
        run: |
          echo "::notice title=Fork-safe unit tests::Doppler OIDC authentication is unavailable to forked pull requests, so unit tests are running with local defaults instead of Doppler dev_ci secrets."
          node scripts/run-workspace-tests.mjs unit

      - name: Upload vitest shard artifacts
        if: always()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.0
        with:
          name: vitest-api-shard-${{ matrix.shard }}
          path: apps/sdp-api/.vitest-reports/blob-${{ matrix.shard }}-8.json
          # A rerun of failed shards must replace the first attempt's blob, or the
          # merge step below keeps re-reporting failures the rerun already fixed.
          overwrite: true
          include-hidden-files: true
          if-no-files-found: error

  test_merge:
    name: Unit Tests
    needs: [unit_test_scope, test]
    if: always() && needs.unit_test_scope.outputs.api == 'true'
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - name: Report shard results
        env:
          SHARD_RESULT: ${{ needs.test.result }}
        run: |
          if [ "${SHARD_RESULT}" != "success" ]; then
            echo "One or more Unit Tests (api) shards finished with ${SHARD_RESULT}." >&2
            exit 1
          fi
          echo "All Unit Tests (api) shards passed."

      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Setup pnpm
        uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413
        with:
          version: 10.16.0

      - name: Setup Node
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: 24.22.1
          cache: pnpm

      - name: Install
        run: pnpm install --frozen-lockfile

      - name: Download shard artifacts
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          pattern: vitest-api-shard-*
          path: shard-artifacts

      - name: Verify and assemble shard blobs
        run: |
          set -euo pipefail
          mkdir -p apps/sdp-api/.vitest-reports
          for shard in 1 2 3 4 5 6 7 8; do
            blob="shard-artifacts/vitest-api-shard-${shard}/blob-${shard}-8.json"
            if [ ! -f "${blob}" ]; then
              echo "Missing blob report for shard ${shard} (expected ${blob})." >&2
              exit 1
            fi
            cp "${blob}" apps/sdp-api/.vitest-reports/
          done
          echo "Assembled $(find apps/sdp-api/.vitest-reports -type f | wc -l | tr -d ' ') blob files."

      - name: Merge coverage and enforce thresholds
        working-directory: apps/sdp-api
        run: pnpm exec vitest run --merge-reports --coverage

  test_embedded_yield_example:
    name: Unit Tests (embedded-yield-bank)
    needs: unit_test_scope
    if: needs.unit_test_scope.outputs.embedded_yield_example == 'true'
    runs-on: ubuntu-latest
    timeout-minutes: 10
    defaults:
      run:
        working-directory: examples/embedded-yield-bank
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Setup pnpm
        uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413
        with:
          version: 10.16.0

      - name: Setup Node
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: 24.22.1
          cache: pnpm
          cache-dependency-path: examples/embedded-yield-bank/pnpm-lock.yaml

      - name: Install
        run: pnpm install --frozen-lockfile

      - name: Test
        run: pnpm test

  test_packages:
    name: Unit Tests (packages)
    needs: unit_test_scope
    if: needs.unit_test_scope.outputs.rest == 'true'
    runs-on: ubuntu-latest
    timeout-minutes: 30
    permissions:
      contents: read
      id-token: write
    env:
      TURBO_CACHE_DIR: ${{ github.workspace }}/.turbo-ci-cache
      CI_HAS_DOPPLER_TOKEN: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
      TEST_WORKSPACE_SPLIT: rest
      TEST_CHANGED_SINCE: ${{ github.event_name == 'pull_request' && format('origin/{0}', github.base_ref) || '' }}
      DOPPLER_PRESERVE_ENV: TEST_CHANGED_SINCE,TEST_WORKSPACE_SPLIT
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0

      - name: Setup pnpm
        uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413
        with:
          version: 10.16.0

      - name: Setup Node
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: 24.22.1
          cache: pnpm

      - name: Restore turbo cache
        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: .turbo-ci-cache
          key: turbo-${{ github.job }}-${{ runner.os }}-${{ github.sha }}
          restore-keys: |
            turbo-${{ github.job }}-${{ runner.os }}-

      - name: Install
        id: install
        run: pnpm install --frozen-lockfile

      - name: Validate Doppler OIDC configuration
        if: env.CI_IS_FORK_PULL_REQUEST != 'true'
        run: |
          if [ -z "${{ vars.DOPPLER_CI_IDENTITY_ID }}" ]; then
            echo "DOPPLER_CI_IDENTITY_ID must be configured as a repository variable for secret-aware CI jobs." >&2
            exit 1
          fi

      - name: Install Doppler CLI
        if: env.CI_HAS_DOPPLER_TOKEN == 'true'
        uses: dopplerhq/cli-action@4819d808ab99e5cde19a0637a16536a4038fad73 # v4.0.1

      - name: Doppler OIDC login
        if: env.CI_HAS_DOPPLER_TOKEN == 'true'
        run: |
          doppler logout --scope=. --yes >/dev/null 2>&1 || true
          scripts/doppler/oidc-login.sh "${{ vars.DOPPLER_CI_IDENTITY_ID }}"
          doppler me >/dev/null

      - name: Unit tests (Doppler)
        if: env.CI_HAS_DOPPLER_TOKEN == 'true'
        env:
          DOPPLER_CONFIG: dev_ci
        run: pnpm test

      - name: Save turbo cache
        if: github.ref == 'refs/heads/main'
        uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: .turbo-ci-cache
          key: turbo-${{ github.job }}-${{ runner.os }}-${{ github.sha }}

      - name: Unit tests (fork-safe)
        if: env.CI_IS_FORK_PULL_REQUEST == 'true' && env.CI_HAS_DOPPLER_TOKEN != 'true'
        run: |
          echo "::notice title=Fork-safe unit tests::Doppler OIDC authentication is unavailable to forked pull requests, so unit tests are running with local defaults instead of Doppler dev_ci secrets."
          node scripts/run-workspace-tests.mjs unit

      - name: Scripts tests
        run: pnpm test:scripts

      # Runs here rather than in the Module Boundaries job because it parses
      # TypeScript with the compiler's own parser, and that job installs no
      # dependencies.
      - name: Check SecretRef serialization
        run: pnpm check:secretref-serialization

      - name: Check UI flow matrix
        run: pnpm check:ui-flow-coverage

      # Pins the constructors that turn a stored secret into signing authority
      # to the custody signer and sponsorship waists, where money admission is
      # enforced (HOO-1955). Needs the TypeScript checker, so it runs where
      # dependencies are installed. It runs whenever the install succeeded, so
      # it and the unit tests each report whatever the other did.
      - name: Check value movement
        if: ${{ !cancelled() && steps.install.outcome == 'success' }}
        run: pnpm check:value-movement

  build_api:
    name: Build API
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0

      - name: Setup pnpm
        uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413
        with:
          version: 10.16.0

      - name: Setup Node
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: 24.22.1
          cache: pnpm

      - name: Install
        run: pnpm install --frozen-lockfile

      - name: Build API (Node bundle)
        run: pnpm --filter ./apps/sdp-api build

  docker_build_api:
    name: Docker Build API
    needs: unit_test_scope
    if: needs.unit_test_scope.outputs.docker == 'true'
    runs-on: ubuntu-latest
    timeout-minutes: 30
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0

      - name: Build sdp-api image (no push)
        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
        with:
          context: .
          file: apps/sdp-api/Dockerfile
          push: false
          load: false
          provenance: false
          sbom: false
          tags: sdp-api:ci-${{ github.sha }}
          build-args: |
            GIT_SHA=${{ github.sha }}
          cache-from: type=gha,scope=sdp-api
          cache-to: type=gha,scope=sdp-api,mode=max

  docker_build_docs:
    name: Docker Build Docs
    needs: unit_test_scope
    if: needs.unit_test_scope.outputs.docker == 'true'
    runs-on: ubuntu-latest
    timeout-minutes: 30
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0

      - name: Build sdp-docs image (no push)
        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
        with:
          context: .
          file: apps/sdp-docs/Dockerfile
          push: false
          load: false
          provenance: false
          sbom: false
          tags: sdp-docs:ci-${{ github.sha }}
          build-args: |
            GIT_SHA=${{ github.sha }}
          cache-from: type=gha,scope=sdp-docs
          cache-to: type=gha,scope=sdp-docs,mode=max

  docker_build_web:
    name: Docker Build Web
    needs: unit_test_scope
    if: needs.unit_test_scope.outputs.docker == 'true'
    runs-on: ubuntu-latest
    timeout-minutes: 30
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0

      - name: Build sdp-web image (no push)
        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
        with:
          context: .
          file: apps/sdp-web/Dockerfile
          push: false
          load: false
          provenance: false
          sbom: false
          tags: sdp-web:ci-${{ github.sha }}
          build-args: |
            GIT_SHA=${{ github.sha }}
            NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY=pk_test_c21va2UubG9jYWwuY2xlcmsuZGV2JA
            NEXT_PUBLIC_SDP_API_BASE_URL=http://localhost:8787
          cache-from: type=gha,scope=sdp-web
          cache-to: type=gha,scope=sdp-web,mode=max

  docker_compose_smoke:
    name: Docker Compose Smoke
    needs: unit_test_scope
    if: needs.unit_test_scope.outputs.docker == 'true'
    runs-on: ubuntu-latest
    timeout-minutes: 25
    env:
      NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY: pk_test_c21va2UubG9jYWwuY2xlcmsuZGV2JA
      CLERK_SECRET_KEY: sk_test_dummy_smoke_for_ci_only
      API_KEY_PEPPER: ci-compose-smoke-pepper-not-a-secret
      COMPOSE_FILE: docker-compose.yml:docker-compose.ci.yml
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0

      - name: Expose GitHub Actions cache to BuildKit
        uses: crazy-max/ghaction-github-runtime@04d248b84655b509d8c44dc1d6f990c879747487 # v4.0.0

      - name: Build compose stack
        run: docker compose build

      - name: Bring up stack and wait for healthy
        run: docker compose up -d --wait --wait-timeout 240

      - name: Dump compose state
        if: always()
        run: |
          docker compose ps
          docker compose logs --no-color --tail=200

      - name: Tear down
        if: always()
        run: docker compose down --volumes --remove-orphans

  build_docs:
    name: Build Docs
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0

      - name: Setup pnpm
        uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413
        with:
          version: 10.16.0

      - name: Setup Node
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: 24.22.1
          cache: pnpm

      - name: Install
        run: pnpm install --frozen-lockfile

      - name: Env configurator drift check
        run: node scripts/check-env-configurator-drift.mjs

      - name: Configurator unit tests
        run: pnpm --filter @sdp/env-config test

      - name: Build docs
        run: pnpm --filter sdp-docs build

  docs_integrity:
    name: Docs Integrity
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0

      - name: Setup pnpm
        uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413
        with:
          version: 10.16.0

      - name: Setup Node
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: 24.22.1
          cache: pnpm

      - name: Install
        run: pnpm install --frozen-lockfile

      - name: Generate public docs artifacts
        run: |
          pnpm --filter sdp-docs generate:api
          pnpm --filter sdp-docs generate:ai

      - name: Committed docs artifacts match generated output
        run: git diff --exit-code apps/sdp-docs/public apps/sdp-docs/src/generated

      - name: Docs release-channel tests
        run: pnpm --filter sdp-docs test

      - name: Check docs links (experimental)
        run: pnpm --filter sdp-docs check:links

      # Production runs stable: its pages must never link to a page or API
      # reference family the stable build leaves out.
      - name: Check docs links (stable)
        env:
          SDP_RELEASE_CHANNEL: stable
        run: |
          pnpm --filter sdp-docs generate:api
          pnpm --filter sdp-docs check:links

  integration_tests_shard:
    name: Integration Tests (${{ matrix.name }})
    runs-on: ubuntu-latest
    permissions:
      contents: read
      id-token: write
    timeout-minutes: 30
    strategy:
      fail-fast: false
      matrix:
        include:
          - name: Kora / Live Smoke
            provider: kora
            test_files: src/tests/kora.test.ts src/tests/kora-flow.test.ts src/tests/kora-earn-sponsorship.test.ts src/tests/private-channels.test.ts src/tests/private-channels-deposit.test.ts
            rpc_provider: alchemy
            custody_provider: privy
          - name: Surfpool / Issuance Core
            provider: surfpool
            test_files: src/tests/issuance-crud.test.ts src/tests/mosaic-custom-mint.test.ts src/tests/dvp-settlement.test.ts
            rpc_provider: quicknode
            custody_provider: local
          - name: Surfpool / Issuance Prepare
            provider: surfpool
            test_files: src/tests/issuance-prepare.test.ts
            rpc_provider: quicknode
            custody_provider: local
          - name: Surfpool / Issuance Execute
            provider: surfpool
            test_files: src/tests/issuance-execute.test.ts
            rpc_provider: alchemy
            custody_provider: local
          - name: Surfpool / Mosaic
            provider: surfpool
            test_files: src/tests/mosaic-token-acl.test.ts src/tests/mosaic-token-acl-constraints.test.ts src/tests/mosaic-abl.test.ts src/tests/mosaic-templates.test.ts
            rpc_provider: quicknode
            custody_provider: local
          - name: Surfpool / Token Flows
            provider: surfpool
            test_files: src/tests/deploy.test.ts src/tests/mint.test.ts src/tests/burn.test.ts src/tests/freeze.test.ts
            rpc_provider: quicknode
            custody_provider: local
          - name: Surfpool / Access
            provider: surfpool
            test_files: src/tests/payments-wallet-scope.test.ts src/tests/api-keys-flow.test.ts src/tests/api-keys-rotation.test.ts src/tests/custody-local.test.ts src/tests/kora-surfpool-shim.test.ts
            rpc_provider: alchemy
            custody_provider: local
          - name: Surfpool / Recurring Payments
            provider: surfpool
            test_files: src/tests/recurring-payments-authority-revocation.test.ts
            rpc_provider: alchemy
            custody_provider: local
          - name: Surfpool / Token and Payment Flows (Kora)
            provider: surfpool
            kora_mode: docker
            test_files: src/tests/deploy.test.ts src/tests/mint.test.ts src/tests/burn.test.ts src/tests/freeze.test.ts src/tests/transfer-batches.test.ts
            rpc_provider: alchemy
            custody_provider: local
    env:
      CI_HAS_DOPPLER_TOKEN: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
      TEST_DATABASE_URL: postgresql://sdp:sdp@127.0.0.1:5432/sdp_test
      REDIS_URL: redis://127.0.0.1:6379
      DOPPLER_PRESERVE_ENV: TEST_DATABASE_URL,REDIS_URL,SOLANA_NETWORK,KORA_SURFPOOL_MODE
      SOLANA_NETWORK: devnet
      INTEGRATION_SHARD_NAME: ${{ matrix.name }}
      INTEGRATION_TEST_FILES: ${{ matrix.test_files }}
      SOLANA_RPC_CI_PREFERRED_PROVIDER: ${{ matrix.rpc_provider }}
      SDP_INTEGRATION_CUSTODY_PROVIDER: ${{ matrix.custody_provider }}
      KORA_SURFPOOL_MODE: ${{ matrix.kora_mode || 'shim' }}
    services:
      postgres:
        image: postgres:16-alpine
        env:
          POSTGRES_DB: sdp
          POSTGRES_USER: sdp
          POSTGRES_PASSWORD: sdp
        ports:
          - 5432:5432
        options: >-
          --health-cmd "pg_isready -U sdp -d sdp"
          --health-interval 5s
          --health-timeout 5s
          --health-retries 20
      redis:
        image: redis:7-alpine
        ports:
          - 6379:6379
        options: >-
          --health-cmd "redis-cli ping"
          --health-interval 5s
          --health-timeout 5s
          --health-retries 20
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0

      - name: Setup pnpm
        uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413
        with:
          version: 10.16.0

      - name: Setup Node
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: 24.22.1
          cache: pnpm

      - name: Install
        run: pnpm install --frozen-lockfile

      - name: Validate Doppler OIDC configuration
        if: matrix.provider == 'kora' && env.CI_IS_FORK_PULL_REQUEST != 'true'
        run: |
          if [ -z "${{ vars.DOPPLER_CI_IDENTITY_ID }}" ]; then
            echo "DOPPLER_CI_IDENTITY_ID must be configured as a repository variable for secret-aware CI jobs." >&2
            exit 1
          fi

      - name: Install Doppler CLI
        if: env.CI_HAS_DOPPLER_TOKEN == 'true'
        uses: dopplerhq/cli-action@4819d808ab99e5cde19a0637a16536a4038fad73 # v4.0.1

      - name: Doppler OIDC login
        if: env.CI_HAS_DOPPLER_TOKEN == 'true'
        run: |
          doppler logout --scope=. --yes >/dev/null 2>&1 || true
          scripts/doppler/oidc-login.sh "${{ vars.DOPPLER_CI_IDENTITY_ID }}"
          doppler me >/dev/null

      - name: Validate integration runtime secrets
        if: matrix.provider == 'kora' && env.CI_HAS_DOPPLER_TOKEN == 'true'
        run: |
          doppler run --config dev_ci -- bash <<'EOF'
          set -euo pipefail
          if [ -z "${KORA_DEVNET_URL:-}" ]; then
            echo "KORA_DEVNET_URL must be set in the dev_ci Doppler config for integration tests." >&2
            exit 1
          fi
          if [ -z "${PRIVY_APP_ID:-}" ] || [ -z "${PRIVY_APP_SECRET:-}" ]; then
            echo "PRIVY_APP_ID and PRIVY_APP_SECRET must be set in the dev_ci Doppler config for integration tests." >&2
            exit 1
          fi
          EOF

      - name: Surfpool integration tests
        if: matrix.provider == 'surfpool'
        env:
          DOPPLER_CONFIG: dev_ci
          DOPPLER_PRESERVE_ENV: TEST_DATABASE_URL,REDIS_URL,SOLANA_NETWORK,KORA_SURFPOOL_MODE
          SDP_INTEGRATION_CUSTODY_PROVIDER: ${{ matrix.custody_provider }}
        run: |
          read -r -a test_files <<< "${INTEGRATION_TEST_FILES}"
          if [ "${CI_HAS_DOPPLER_TOKEN}" = "true" ]; then
            scripts/doppler/run-with-config.sh pnpm kora:surfpool:integration -- "${test_files[@]}"
          elif [ "${CI_IS_FORK_PULL_REQUEST}" = "true" ]; then
            echo "::notice title=Fork-safe Surfpool integration skip::Forked pull requests cannot access managed Solana RPC secrets, so this Surfpool shard is skipped."
          else
            echo "Doppler OIDC authentication is required for Surfpool integration shards." >&2
            exit 1
          fi

      - name: Live Kora integration tests
        if: matrix.provider == 'kora' && env.CI_HAS_DOPPLER_TOKEN == 'true'
        env:
          DOPPLER_CONFIG: dev_ci
        run: |
          read -r -a test_files <<< "${INTEGRATION_TEST_FILES}"
          pnpm test:integration -- "${test_files[@]}"

      - name: Skip secret-backed integration tests for fork
        if: matrix.provider == 'kora' && env.CI_IS_FORK_PULL_REQUEST == 'true' && env.CI_HAS_DOPPLER_TOKEN != 'true'
        run: |
          echo "::notice title=Fork-safe integration skip::Forked pull requests cannot authenticate to Doppler via OIDC, so Kora/Privy-backed integration tests are skipped. Run this PR from an upstream branch before merge if secret-backed coverage is required."

  integration_tests:
    name: Integration Tests (Surfpool/Kora)
    runs-on: ubuntu-latest
    needs:
      - integration_tests_shard
    if: always()
    timeout-minutes: 5
    env:
      CI_HAS_DOPPLER_TOKEN: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
    steps:
      - name: Check integration test results
        env:
          INTEGRATION_SHARD_RESULT: ${{ needs.integration_tests_shard.result }}
        run: |
          if [ "${CI_IS_FORK_PULL_REQUEST}" = "true" ] && [ "${CI_HAS_DOPPLER_TOKEN}" != "true" ] && [ "${INTEGRATION_SHARD_RESULT}" = "success" ]; then
            echo "::notice title=Fork-safe integration skip::Forked pull requests cannot authenticate to Doppler via OIDC, so the secret-backed integration matrix was intentionally skipped."
            exit 0
          fi
          if [ "${CI_HAS_DOPPLER_TOKEN}" != "true" ]; then
            echo "Secret-backed integration shards did not run outside a fork pull request." >&2
            exit 1
          fi
          if [ "${INTEGRATION_SHARD_RESULT}" != "success" ]; then
            echo "One or more integration shards finished with ${INTEGRATION_SHARD_RESULT}." >&2
            exit 1
          fi
          echo "All integration shards passed."

  browser_e2e:
    name: ${{ matrix.name }}
    needs: unit_test_scope
    runs-on: ubuntu-latest
    permissions:
      contents: read
      id-token: write
    timeout-minutes: 45
    strategy:
      fail-fast: false
      matrix:
        include:
          - name: Dashboard E2E (Surfpool Local)
            test_script: test:e2e:dashboard
            artifact_suffix: dashboard-surfpool
          - name: Dashboard E2E (Transactions / Surfpool Local)
            test_script: test:e2e:dashboard-transactions
            artifact_suffix: dashboard-transactions-surfpool
          - name: Issuance E2E (basics)
            issuance_group: basics
            artifact_suffix: issuance-basics
          - name: Issuance E2E (authority and supply)
            issuance_group: authority-and-supply
            artifact_suffix: issuance-authority-and-supply
          - name: Issuance E2E (freeze controls)
            issuance_group: freeze-controls
            artifact_suffix: issuance-freeze-controls
          - name: Issuance E2E (pause controls)
            issuance_group: pause-controls
            artifact_suffix: issuance-pause-controls
          - name: Issuance E2E (allowlist)
            issuance_group: allowlist
            artifact_suffix: issuance-allowlist
          - name: Issuance E2E (new design)
            issuance_group: redesign
            new_design_issuance: "true"
            artifact_suffix: issuance-redesign
    env:
      E2E_AFFECTED: ${{ needs.unit_test_scope.outputs.e2e }}
      CI_HAS_DOPPLER_TOKEN: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
      DATABASE_URL: postgresql://sdp:sdp@127.0.0.1:5432/sdp
      REDIS_URL: redis://127.0.0.1:6379
      DOPPLER_PRESERVE_ENV: DATABASE_URL,REDIS_URL,SOLANA_NETWORK,NEXT_PUBLIC_SENTRY_DSN,SDP_API_BASE_URL,NEXT_PUBLIC_SDP_API_BASE_URL,PLAYWRIGHT_API_URL,PLAYWRIGHT_API_PORT,PLAYWRIGHT_BASE_URL,PLAYWRIGHT_NEXT_DIST_DIR,PLAYWRIGHT_USE_NEXT_START,ISSUANCE_ENABLED,SDP_FLAG_NEW_DESIGN_ISSUANCE,API_KEY_PEPPER
      # The API refuses to start without a pepper (HOO-2219). A fixed CI value is
      # enough: each run starts from an empty database and mints its own keys.
      API_KEY_PEPPER: ci-e2e-pepper-not-a-secret
      ISSUANCE_ENABLED: "true"
      # issuance.e2e.spec.ts drives the previous Issuance design, which production still serves
      # (NEW DESIGN is off there). A matrix entry sets new_design_issuance to run the new one.
      SDP_FLAG_NEW_DESIGN_ISSUANCE: ${{ matrix.new_design_issuance || 'false' }}
      SOLANA_NETWORK: devnet
      PLAYWRIGHT_API_URL: http://127.0.0.1:8787
      PLAYWRIGHT_API_PORT: "8787"
      PLAYWRIGHT_USE_NEXT_START: "1"
      PLAYWRIGHT_NEXT_DIST_DIR: .next-playwright
      NEXT_PUBLIC_DISABLE_SENTRY: "1"
      NEXT_PUBLIC_SENTRY_DSN: ""
      PLAYWRIGHT_DISABLE_SENTRY: "1"
    services:
      postgres:
        image: postgres:16-alpine
        env:
          POSTGRES_DB: sdp
          POSTGRES_USER: sdp
          POSTGRES_PASSWORD: sdp
        ports:
          - 5432:5432
        options: >-
          --health-cmd "pg_isready -U sdp -d sdp"
          --health-interval 5s
          --health-timeout 5s
          --health-retries 20
      redis:
        image: redis:7-alpine
        ports:
          - 6379:6379
        options: >-
          --health-cmd "redis-cli ping"
          --health-interval 5s
          --health-timeout 5s
          --health-retries 20
    steps:
      - name: Checkout
        if: env.E2E_AFFECTED == 'true'
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0

      - name: Setup pnpm
        if: env.E2E_AFFECTED == 'true'
        uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413
        with:
          version: 10.16.0

      - name: Setup Node
        if: env.E2E_AFFECTED == 'true'
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: 24.22.1
          cache: pnpm

      - name: Install
        if: env.E2E_AFFECTED == 'true'
        run: pnpm install --frozen-lockfile

      - name: Validate Doppler OIDC configuration
        if: env.E2E_AFFECTED == 'true' && env.CI_IS_FORK_PULL_REQUEST != 'true'
        run: |
          if [ -z "${{ vars.DOPPLER_CI_IDENTITY_ID }}" ]; then
            echo "DOPPLER_CI_IDENTITY_ID must be configured as a repository variable for secret-aware CI jobs." >&2
            exit 1
          fi

      - name: Install Doppler CLI
        if: env.E2E_AFFECTED == 'true' && env.CI_HAS_DOPPLER_TOKEN == 'true'
        uses: dopplerhq/cli-action@4819d808ab99e5cde19a0637a16536a4038fad73 # v4.0.1

      - name: Doppler OIDC login
        if: env.E2E_AFFECTED == 'true' && env.CI_HAS_DOPPLER_TOKEN == 'true'
        run: |
          doppler logout --scope=. --yes >/dev/null 2>&1 || true
          scripts/doppler/oidc-login.sh "${{ vars.DOPPLER_CI_IDENTITY_ID }}"
          doppler me >/dev/null

      - name: Validate browser e2e runtime secrets
        if: env.E2E_AFFECTED == 'true' && env.CI_HAS_DOPPLER_TOKEN == 'true'
        run: |
          doppler run --config dev_ci -- bash <<'EOF'
          set -euo pipefail
          if [ -z "${NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY:-}" ] || [ -z "${CLERK_SECRET_KEY:-}" ]; then
            echo "Clerk publishable and secret keys must be set in the dev_ci Doppler config for browser e2e." >&2
            exit 1
          fi
          if [ -z "${PRIVY_APP_ID:-}" ] || [ -z "${PRIVY_APP_SECRET:-}" ]; then
            echo "PRIVY_APP_ID and PRIVY_APP_SECRET must be set in the dev_ci Doppler config for browser e2e." >&2
            exit 1
          fi
          EOF

      - name: Derive Clerk issuer for local API
        if: env.E2E_AFFECTED == 'true' && env.CI_HAS_DOPPLER_TOKEN == 'true'
        run: |
          CLERK_HOST=$(doppler run --config dev_ci -- node - <<'NODE'
          const key = process.env.NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY || "";
          const encoded = key.split("_").slice(2).join("_");
          if (!encoded) {
            throw new Error("NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY is required for issuance e2e");
          }
          const normalized = encoded.replace(/-/g, "+").replace(/_/g, "/");
          const padded = normalized + "=".repeat((4 - (normalized.length % 4)) % 4);
          const decoded = Buffer.from(padded, "base64").toString("utf8").replace(/\$/g, "").trim();
          if (!decoded) {
            throw new Error("Unable to derive Clerk frontend host from publishable key");
          }
          process.stdout.write(decoded);
          NODE
          )
          echo "CLERK_ISSUER=https://${CLERK_HOST}" >> "$GITHUB_ENV"
          echo "CLERK_JWKS_URL=https://${CLERK_HOST}/.well-known/jwks.json" >> "$GITHUB_ENV"

      - name: Install Playwright browser
        if: env.E2E_AFFECTED == 'true' && env.CI_HAS_DOPPLER_TOKEN == 'true'
        run: pnpm --filter sdp-web exec playwright install chromium

      - name: Build web app for Playwright
        if: env.E2E_AFFECTED == 'true' && env.CI_HAS_DOPPLER_TOKEN == 'true'
        env:
          DOPPLER_CONFIG: dev_ci
          SDP_API_BASE_URL: ${{ env.PLAYWRIGHT_API_URL }}
          NEXT_PUBLIC_SDP_API_BASE_URL: ${{ env.PLAYWRIGHT_API_URL }}
          SOLANA_RPC_CI_PREFERRED_PROVIDER: quicknode
        run: scripts/doppler/run-with-config.sh node scripts/run-with-healthy-solana-rpc.mjs pnpm --filter sdp-web build

      - name: Run browser e2e suite
        if: env.E2E_AFFECTED == 'true' && env.CI_HAS_DOPPLER_TOKEN == 'true'
        env:
          DOPPLER_CONFIG: dev_ci
          SOLANA_RPC_CI_PREFERRED_PROVIDER: quicknode
        run: |
          if [ -n "${{ matrix.issuance_group }}" ]; then
            scripts/doppler/run-with-config.sh pnpm kora:surfpool:e2e:issuance ${{ matrix.issuance_group }}
          else
            scripts/doppler/run-with-config.sh pnpm kora:surfpool:run -- pnpm --filter sdp-web run ${{ matrix.test_script }}
          fi

      - name: Skip secret-backed browser e2e for fork
        if: env.E2E_AFFECTED == 'true' && env.CI_IS_FORK_PULL_REQUEST == 'true' && env.CI_HAS_DOPPLER_TOKEN != 'true'
        run: |
          echo "::notice title=Fork-safe browser e2e skip::Forked pull requests cannot authenticate to Doppler via OIDC, so Clerk/Privy-backed browser e2e is skipped. Run this PR from an upstream branch before merge if browser e2e coverage is required."

      - name: Upload Playwright artifacts
        if: always() && env.E2E_AFFECTED == 'true' && env.CI_HAS_DOPPLER_TOKEN == 'true'
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.0
        with:
          name: playwright-artifacts-${{ matrix.artifact_suffix }}
          path: |
            apps/sdp-web/playwright-report
            apps/sdp-web/test-results
          if-no-files-found: ignore

  issuance_e2e:
    name: Issuance E2E (Surfpool Shards)
    runs-on: ubuntu-latest
    needs: [unit_test_scope, browser_e2e]
    if: always() && needs.unit_test_scope.outputs.e2e == 'true'
    timeout-minutes: 5
    steps:
      # The issuance groups share the browser_e2e matrix with the two Dashboard E2E
      # jobs, so this reads the whole matrix's result. The jobs API is not a substitute:
      # it reported finished shards' conclusions as null for minutes after they settled.
      # The Dashboard E2E jobs are required checks themselves, so gating on them too
      # blocks nothing that was mergeable.
      - name: Require every browser E2E shard green
        env:
          SHARD_RESULT: ${{ needs.browser_e2e.result }}
        run: |
          if [ "${SHARD_RESULT}" != "success" ]; then
            echo "One or more browser E2E shards (issuance groups or Dashboard E2E) finished with ${SHARD_RESULT}." >&2
            exit 1
          fi
          echo "All issuance e2e groups and Dashboard E2E jobs passed."