better-auth/.github/workflows/ci.yml

name: CI

on:
  pull_request:
    types:
      - opened
      - synchronize
  push:
    branches:
      - main
      - next
  merge_group:

permissions: {}

env:
  TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}
  TURBO_TEAM: ${{ vars.TURBO_TEAM || github.repository_owner }}
  BETTER_AUTH_TELEMETRY_ENDPOINT: ${{ vars.BETTER_AUTH_TELEMETRY_ENDPOINT }}

jobs:
  lint:
    runs-on: ${{ (github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == 'better-auth/better-auth' || github.event_name != 'pull_request' && github.repository == 'better-auth/better-auth') && 'starsling-ubuntu-26.04' || 'ubuntu-24.04' }}
    permissions:
      contents: read
    concurrency:
      group: ${{ github.workflow }}-lint-${{ github.event.pull_request.number || github.event.merge_group.head_ref || github.ref }}
      cancel-in-progress: ${{ github.event_name == 'pull_request' }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
          persist-credentials: false

      - name: Cache turbo build setup
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: .turbo
          key: ${{ runner.os }}-turbo-${{ github.sha }}
          restore-keys: |
            ${{ runner.os }}-turbo-

      - uses: better-auth/shared-workflows/.github/actions/setup-pnpm@08e5520e7a829b03bee1152913682b67d2ba44b1

      - name: Reject stale release merge groups
        if: github.event_name == 'merge_group'
        env:
          BASE_SHA: ${{ github.event.merge_group.base_sha }}
        run: |
          BASE_VERSION=$(git show "${BASE_SHA}:packages/better-auth/package.json" | jq -r '.version')
          HEAD_VERSION=$(jq -r '.version' packages/better-auth/package.json)
          if [ "$BASE_VERSION" != "$HEAD_VERSION" ]; then
            pnpm --filter @better-auth/release-tooling release-notes \
              check-changesets --branch "$GITHUB_SHA"
          fi

      - name: Build
        env:
          TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}
          TURBO_TEAM: ${{ vars.TURBO_TEAM || github.repository_owner }}
        run: pnpm build

      - name: Lint
        run: pnpm biome ci --error-on-warnings

      - name: Lint Dependencies
        env:
          TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}
          TURBO_TEAM: ${{ vars.TURBO_TEAM || github.repository_owner }}
        run: pnpm lint:dependencies

      - name: Lint Packages
        env:
          TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}
          TURBO_TEAM: ${{ vars.TURBO_TEAM || github.repository_owner }}
        run: pnpm lint:packages

      - name: Lint Spell
        env:
          TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}
          TURBO_TEAM: ${{ vars.TURBO_TEAM || github.repository_owner }}
        run: pnpm lint:spell

      - name: Lint Format
        run: pnpm format:check

      - name: Lint Types
        env:
          TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}
          TURBO_TEAM: ${{ vars.TURBO_TEAM || github.repository_owner }}
        run: pnpm lint:types

  typecheck:
    runs-on: ${{ (github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == 'better-auth/better-auth' || github.event_name != 'pull_request' && github.repository == 'better-auth/better-auth') && 'starsling-ubuntu-26.04' || 'ubuntu-24.04' }}
    permissions:
      contents: read
    concurrency:
      group: ${{ github.workflow }}-typecheck-${{ github.event.pull_request.number || github.event.merge_group.head_ref || github.ref }}
      cancel-in-progress: ${{ github.event_name == 'pull_request' }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
          persist-credentials: false

      - name: Cache turbo build setup
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: .turbo
          key: ${{ runner.os }}-turbo-${{ github.sha }}
          restore-keys: |
            ${{ runner.os }}-turbo-

      - uses: better-auth/shared-workflows/.github/actions/setup-pnpm@08e5520e7a829b03bee1152913682b67d2ba44b1

      - name: Typecheck
        run: pnpm typecheck

      - name: Build package declarations
        run: pnpm build

      - name: Typecheck workspace consumers
        run: pnpm typecheck:consumers

      - name: Typecheck dist declarations
        run: pnpm typecheck:dist

  test:
    runs-on: ${{ (github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == 'better-auth/better-auth' || github.event_name != 'pull_request' && github.repository == 'better-auth/better-auth') && 'starsling-ubuntu-26.04' || 'ubuntu-24.04' }}
    permissions:
      contents: read
    timeout-minutes: 30
    concurrency:
      group: ${{ github.workflow }}-test-${{ matrix.node-version }}-${{ github.event.pull_request.number || github.event.merge_group.head_ref || github.ref }}
      cancel-in-progress: ${{ github.event_name == 'pull_request' }}
    strategy:
      fail-fast: false
      matrix:
        node-version: [22.x, 24.x]
    env:
      COMPOSE_SERVICES: postgres postgres-kysely mongodb
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
          persist-credentials: false

      - name: Cache turbo build setup
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: .turbo
          key: ${{ runner.os }}-turbo-${{ github.sha }}
          restore-keys: |
            ${{ runner.os }}-turbo-

      - uses: better-auth/shared-workflows/.github/actions/setup-pnpm@08e5520e7a829b03bee1152913682b67d2ba44b1
        with:
          node-version: ${{ matrix.node-version }}

      - name: Test release tooling
        if: matrix.node-version == '24.x'
        run: pnpm --filter @better-auth/release-tooling test

      - name: Rebuild native bindings for matrix node
        run: pnpm -r rebuild better-sqlite3

      - name: Reset Docker Containers
        run: docker compose down --volumes --remove-orphans

      - name: Start Docker Containers
        run: |
          read -r -a compose_services <<< "$COMPOSE_SERVICES"
          docker compose up -d --wait --wait-timeout 60 "${compose_services[@]}"

      - name: Test
        run: pnpm coverage

      - name: Docker Compose Diagnostics
        if: failure() && hashFiles('docker-compose.yml') != ''
        run: |
          read -r -a compose_services <<< "$COMPOSE_SERVICES"
          docker compose ps --all || true
          docker compose logs --no-color "${compose_services[@]}" || true

      - name: Stop Docker Containers
        if: always() && hashFiles('docker-compose.yml') != ''
        run: docker compose down --volumes --remove-orphans

  ci:
    runs-on: ubuntu-latest
    needs: [lint, typecheck, test]
    if: always()
    steps:
      - uses: re-actors/alls-green@b5b5b37504aa4183270bd3d855c52a67f212be35 # v1.3.0
        with:
          jobs: ${{ toJSON(needs) }}