elizaos--eliza/.github/workflows/ui-story-gate.yml

name: UI Story Gate

# Render EVERY Storybook story in headless Chromium and assert it is healthy.
# Hard-fails on a story that throws, renders blank, or raises an uncaught
# pageerror — no baseline needed. Console errors + serious/critical axe a11y
# violations are enforced against allowlist baselines
# (packages/ui/test/story-gate/baseline/*.json); empty baselines mean zero
# tolerance. See
# packages/ui/test/story-gate/README.md.

on:
  # Reusable entry for the scheduled exhaustive develop lane (#12342).
  workflow_call:
  pull_request:
    branches: [main]
    paths:
      - "packages/ui/**"
      - "packages/shared/**"
      - "plugins/**/src/**"
      - ".github/workflows/ui-story-gate.yml"
  push:
    branches: [main, develop]
    paths:
      - "packages/ui/**"
      - "packages/shared/**"
      - "plugins/**/src/**"
      - ".github/workflows/ui-story-gate.yml"

# CI fan-out fix: the PR-scoped concurrency from #14069 fell back to
# github.run_id on push, so every develop push got a unique group and
# nothing ever superseded. A 37-merge wave queued thousands of push runs
# and starved the self-hosted fleet. Fall back to github.ref (all develop
# pushes share a group) and cancel superseded runs on push too. PR behavior
# is unchanged (pull_request.number still wins the key); merge_group and
# schedule events are not in the cancel set, so the merge queue and nightly
# runs always complete.
concurrency:
  group: ui-story-gate-${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' || github.event_name == 'push' }}

permissions:
  contents: read

env:
  BUN_VERSION: "canary"
  NODE_VERSION: "24.15.0"

jobs:
  story-gate:
    runs-on: ${{ fromJSON(vars.HETZNER_FLEET_ONLINE == 'false' && '["ubuntu-24.04"]' || '["self-hosted","hetzner-robot"]') }}
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
        with:
          submodules: false

      - name: Setup Node.js
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e
        with:
          node-version: ${{ env.NODE_VERSION }}

      - name: Setup workspace dependencies
        uses: ./.github/actions/setup-bun-workspace
        with:
          bun-version: ${{ env.BUN_VERSION }}
          install-command: bun install
          install-native-deps: "false"
          skip-avatar-clone: "true"
          no-vision-deps: "true"

      # Source-static ratchet (#9943): fails fast — before the heavy catalog build
      # + browser install — if any story that had a `play` interaction test lost
      # it, or play-coverage fell below the committed floor.
      - name: Story `play`-coverage ratchet
        run: node packages/ui/test/story-gate/play-coverage-gate.mjs

      - name: Install Playwright Chromium
        run: bunx playwright install --with-deps chromium

      # The catalog build is self-contained — it resolves @elizaos/* to source and
      # stubs native bridges in .storybook/main.ts, so no gitignored plugin dist
      # is required on a clean checkout.
      - name: Build Storybook static catalog
        run: bun run --cwd packages/ui build-storybook --output-dir storybook-static --quiet

      - name: Run story gate
        run: node packages/ui/test/story-gate/run-story-gate.mjs --static-dir packages/ui/storybook-static --concurrency 4

      - name: Upload story-gate artifacts
        if: always()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
        with:
          name: story-gate-output
          path: packages/ui/test/story-gate/output
          retention-days: 14
          if-no-files-found: ignore