ci.yml

name: CI/CD Pipeline

on:
  push:
    branches: [main, develop]
    paths:
      - 'Cyrano/**'
      - 'Labs/Potemkin/**'
      - 'apps/lexfiat/**'
      - 'apps/arkiver/**'
      - 'docs/**'
      - '.github/workflows/ci.yml'
      - 'package.json'
      - 'package-lock.json'
  pull_request:
    branches: [main, develop]
    paths:
      - 'Cyrano/**'
      - 'Labs/Potemkin/**'
      - 'apps/lexfiat/**'
      - 'apps/arkiver/**'
      - 'docs/**'
      - '.github/workflows/ci.yml'
      - 'package.json'
      - 'package-lock.json'

permissions:
  contents: read

jobs:
  test:
    name: Run Tests
    runs-on: ubuntu-latest

    env:
      DATABASE_URL: ${{ secrets.DATABASE_URL }}

    defaults:
      run:
        working-directory: ./Cyrano

    steps:
      - uses: actions/checkout@v4

      - name: Debug environment
        run: |
          echo "Working directory: $(pwd)"
          echo "Node version: $(node -v)"
          echo "NPM version: $(npm -v)"
          echo "Directory contents:"
          ls -la

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '20'
          cache: 'npm'
          cache-dependency-path: Cyrano/package-lock.json

      - name: Validate lockfile platform compatibility
        run: python3 ${{ github.workspace }}/.github/scripts/validate-lockfile.py package-lock.json

      - name: Install dependencies
        run: npm ci

      - name: Clear Playwright cache
        run: rm -rf ~/.cache/ms-playwright/
        continue-on-error: true

      - name: Install Playwright browsers
        run: |
          npx playwright install --with-deps chromium || {
            echo "::error::Playwright browser installation failed"
            exit 1
          }

      - name: Run linter
        run: npm run lint
        continue-on-error: true

      - name: Type check
        run: npm run build

      - name: Run unit tests
        run: npm run test:unit
        continue-on-error: true
        env:
          DATABASE_URL: ${{ secrets.DATABASE_URL }}

      - name: Generate coverage report
        run: npm run test:unit -- --coverage || true
        env:
          DATABASE_URL: ${{ secrets.DATABASE_URL }}

      - name: Upload coverage to Codecov
        uses: codecov/codecov-action@v4
        with:
          file: ./Cyrano/coverage/lcov.info
          flags: unittests
          name: codecov-umbrella
          fail_ci_if_error: false
        continue-on-error: true

      - name: Upload test artifacts on failure
        if: failure()
        uses: actions/upload-artifact@v4
        with:
          name: test-artifacts
          path: |
            ./Cyrano/coverage/
            ./Cyrano/test-output.txt
          retention-days: 5
        continue-on-error: true

  quality-gates:
    name: Quality Gates
    runs-on: ubuntu-latest
    needs: test

    env:
      DATABASE_URL: ${{ secrets.DATABASE_URL }}

    defaults:
      run:
        working-directory: ./Cyrano

    steps:
      - uses: actions/checkout@v4

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '20'
          cache: 'npm'
          cache-dependency-path: Cyrano/package-lock.json

      - name: Validate lockfile platform compatibility
        run: python3 ${{ github.workspace }}/.github/scripts/validate-lockfile.py package-lock.json

      - name: Install dependencies
        run: npm ci

      - name: Run tests with coverage
        id: test-results
        run: |
          npm run test:coverage 2>&1 | tee test-output.txt || true
        env:
          DATABASE_URL: ${{ secrets.DATABASE_URL }}

      - name: Extract test results
        run: |
          # Extract test pass rate from vitest output
          # Vitest format: "Tests  N passed | M failed (T)"
          PASSED_TESTS=$(grep -oE '[0-9]+ passed' test-output.txt | grep -oE '[0-9]+' | head -1 || echo "0")
          FAILED_TESTS=$(grep -oE '[0-9]+ failed' test-output.txt | grep -oE '[0-9]+' | head -1 || echo "0")
          # Total = passed + failed (skipped tests are not counted against pass rate)
          TOTAL_TESTS=$(( PASSED_TESTS + FAILED_TESTS ))

          if [ "$TOTAL_TESTS" = "0" ]; then
            echo "⚠️  Could not extract test counts from output - skipping quality gate"
            cat test-output.txt
            exit 0
          fi

          # Calculate pass rate (using awk for better precision)
          PASS_RATE=$(awk "BEGIN {printf \"%.2f\", ($PASSED_TESTS * 100) / $TOTAL_TESTS}")
          PASS_RATE_INT=$(echo "$PASS_RATE" | cut -d. -f1)

          echo "Total tests (pass+fail): $TOTAL_TESTS"
          echo "Passed: $PASSED_TESTS"
          echo "Failed: $FAILED_TESTS"
          echo "Pass rate: $PASS_RATE%"

          # Check quality gates
          if [ "$PASS_RATE_INT" -lt 85 ]; then
            echo "❌ Quality gate failed: Pass rate $PASS_RATE% is below 85%"
            exit 1
          fi

          echo "✅ Quality gate passed: Pass rate $PASS_RATE% meets 85% requirement"

      - name: Check coverage
        run: |
          if [ -f coverage/coverage-summary.json ]; then
            COVERAGE=$(node -e "const cov = require('./coverage/coverage-summary.json'); console.log(cov.total.lines.pct || 0)")
            COVERAGE_INT=$(echo "$COVERAGE" | cut -d. -f1)
            echo "Code coverage: $COVERAGE%"
            if [ "$COVERAGE_INT" -lt 70 ]; then
              echo "❌ Quality gate failed: Coverage $COVERAGE% is below 70%"
              exit 1
            fi
            echo "✅ Quality gate passed: Coverage $COVERAGE% meets 70% requirement"
          else
            echo "⚠️ Coverage file not found, skipping coverage check"
          fi

  security-scan:
    name: Security Scan
    runs-on: ubuntu-latest
    permissions:
      contents: read
      security-events: write

    steps:
      - uses: actions/checkout@v4

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '20'

      - name: Install Snyk CLI
        run: npm install -g snyk
        continue-on-error: true

      - name: Snyk Code test
        run: snyk code test --sarif > snyk-code.sarif || true
        env:
          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
        continue-on-error: true

      - name: Upload Snyk results
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: snyk-code.sarif
        continue-on-error: true