ci.yml

name: CI

on:
  push:
    branches: [main, develop]
  pull_request:
    branches: [main, develop]

env:
  NODE_VERSION: '20'
  # Test environment variables for Supabase (prevents CI failures)
  VITE_SUPABASE_URL: 'https://test.supabase.co'
  VITE_SUPABASE_ANON_KEY: 'test-anon-key-for-ci'

jobs:
  # Fast quality checks (similar to pre-commit)
  quality:
    name: Code Quality
    runs-on: ubuntu-latest
    timeout-minutes: 10

    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: 'yarn'

      - name: Install dependencies
        run: yarn install --frozen-lockfile

      - name: Run ESLint
        run: yarn lint

      - name: Check TypeScript
        run: yarn type-check

      - name: Check Prettier formatting
        run: yarn prettier

      - name: Lint Markdown
        run: yarn lint:md

      - name: Validate ESLint rules
        run: yarn validate:rules

  # Comprehensive testing
  test:
    name: Tests
    runs-on: ubuntu-latest
    timeout-minutes: 15

    strategy:
      matrix:
        node-version: [20, 22]

    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Setup Node.js ${{ matrix.node-version }}
        uses: actions/setup-node@v4
        with:
          node-version: ${{ matrix.node-version }}
          cache: 'yarn'

      - name: Install dependencies
        run: yarn install --frozen-lockfile

      - name: Run all tests
        run: yarn test:coverage

      - name: Upload coverage to Codecov
        if: matrix.node-version == 20
        uses: codecov/codecov-action@v3
        with:
          file: ./coverage/lcov.info
          fail_ci_if_error: false

  # ESLint rules validation
  rules:
    name: ESLint Rules Validation
    runs-on: ubuntu-latest
    timeout-minutes: 5

    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: 'yarn'

      - name: Install dependencies
        run: yarn install --frozen-lockfile

      - name: Test ESLint rules
        run: yarn test:rules

      - name: Validate ESLint rules
        run: yarn validate:rules

      - name: Maintain rules status
        run: yarn maintain:rules

  # Build verification
  build:
    name: Build Verification
    runs-on: ubuntu-latest
    timeout-minutes: 10

    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: 'yarn'

      - name: Install dependencies
        run: yarn install --frozen-lockfile

      - name: Build project
        run: yarn build

      - name: Check build output
        run: |
          if [ ! -d "dist" ]; then
            echo "❌ Build failed: dist directory not found"
            exit 1
          fi
          echo "✅ Build successful: dist directory exists"

  # Security scanning
  security:
    name: Security Scan
    runs-on: ubuntu-latest
    timeout-minutes: 5

    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: 'yarn'

      - name: Install dependencies
        run: yarn install --frozen-lockfile

      - name: Run security audit
        run: yarn audit --groups dependencies

      - name: Check for known vulnerabilities
        run: |
          # Allow high/critical in devDependencies, but not in dependencies
          if yarn audit --level moderate --groups dependencies; then
            echo "✅ No moderate+ vulnerabilities in dependencies"
          else
            echo "❌ Security vulnerabilities found in dependencies"
            exit 1
          fi

  # All checks must pass for PR merge
  all-checks-pass:
    name: All Checks Pass
    runs-on: ubuntu-latest
    needs: [quality, test, rules, build, security]
    if: always()

    steps:
      - name: Check all jobs succeeded
        if: |
          needs.quality.result != 'success' ||
          needs.test.result != 'success' ||
          needs.rules.result != 'success' ||
          needs.build.result != 'success' ||
          needs.security.result != 'success'
        run: |
          echo "❌ One or more checks failed"
          exit 1

      - name: All checks passed
        run: echo "✅ All checks passed successfully!"