name: Bundle Budget

# Posts a sticky PR comment with per-route gzip sizes vs scripts/bundle-budgets.json.
# Non-blocking: exceeds-limit routes show a warning row but never fail the PR check.
# Spec: docs/improvement-plan/10-compliance-polish/bundle-budget.md
# Docs: docs/architecture/bundle-budgets.md

on:
  pull_request:
    paths:
      - "apps/web/**"
      - "packages/brand/**"
      - "packages/config/**"
      - "packages/entitlements/**"
      - "packages/form-widget/**"
      - "packages/foundation/**"
      - "packages/i18n/**"
      - "packages/plugin-runtime/**"
      - "packages/ui*/**"
      - "packages/url/**"
      - "packages/view-models/**"
      - "package.json"
      - "pnpm-lock.yaml"
      - "scripts/bundle-budgets.json"
      - "scripts/verify-bundle-size.mjs"
      - ".github/workflows/bundle-budget.yml"

permissions:
  contents: read
  pull-requests: write

jobs:
  measure:
    name: Measure & report bundle sizes
    runs-on: ubuntu-latest
    timeout-minutes: 30
    env:
      DATABASE_URL: postgresql://toolctrl:toolctrl@localhost:5432/toolctrl?schema=public
    steps:
      - name: Checkout PR head
        uses: actions/checkout@v4

      - name: Enable Corepack
        run: corepack enable

      - name: Prepare pnpm 10.33.0
        run: corepack prepare pnpm@10.33.0 --activate

      - name: Configure pnpm store
        run: pnpm config set store-dir .pnpm-store

      - name: Cache pnpm store
        uses: actions/cache@v4
        with:
          path: .pnpm-store
          key: ${{ runner.os }}-pnpm-${{ hashFiles('pnpm-lock.yaml') }}
          restore-keys: |
            ${{ runner.os }}-pnpm-

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Build web (PR head)
        run: pnpm --filter @toolctrl/web build

      - name: Verify aggregate bundle budgets
        run: pnpm run verify:bundle-size

      - name: Measure PR bundle sizes
        run: node scripts/verify-bundle-size.mjs --json > pr-bundle-report.json

      - name: Upload PR bundle report
        uses: actions/upload-artifact@v4
        with:
          name: bundle-report-pr-${{ github.event.pull_request.number }}
          path: pr-bundle-report.json
          retention-days: 14

      - name: Download main baseline (if available)
        id: baseline
        uses: dawidd6/action-download-artifact@v6
        with:
          name: bundle-baseline-main
          workflow: bundle-budget-baseline.yml
          branch: main
          path: baseline
          if_no_artifact_found: warn
        continue-on-error: true

      - name: Render PR comment markdown
        run: node scripts/render-bundle-budget-comment.mjs \
               --current pr-bundle-report.json \
               --baseline baseline/main-bundle-report.json \
               --out bundle-comment.md

      - name: Post sticky PR comment
        uses: marocchino/sticky-pull-request-comment@v2
        with:
          header: bundle-budget-report
          path: bundle-comment.md