ci.yml

name: CI

on:
  push:
    branches:
      - main
  pull_request:
    branches:
      - main
  workflow_dispatch:

jobs:
  backend:
    name: Backend Tests
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: backend
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version-file: .nvmrc
          cache: npm
          cache-dependency-path: backend/package-lock.json

      - name: Install backend dependencies
        run: npm ci

      - name: Audit backend dependencies (production, high severity)
        run: npm audit --omit=dev --audit-level=high

      - name: Lint backend
        run: npm run lint

      - name: Check backend formatting
        run: npm run format:check

      # --coverage enforces the coverage thresholds declared in package.json
      # (a ratchet set just below current levels); plain `npm test` stays fast locally.
      - name: Run backend tests (with coverage thresholds)
        run: npm test -- --coverage

      # Uploads even if the test step above failed (a coverage drop is exactly
      # the kind of run worth seeing on Codecov), but not if the job was cancelled.
      - name: Upload backend coverage to Codecov
        if: ${{ !cancelled() }}
        uses: codecov/codecov-action@v5
        with:
          token: ${{ secrets.CODECOV_TOKEN }}
          directory: backend/coverage
          flags: backend
          fail_ci_if_error: false

  frontend:
    name: Frontend Lint, Tests and Build
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: frontend
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version-file: .nvmrc
          cache: npm
          cache-dependency-path: frontend/package-lock.json

      - name: Install frontend dependencies
        run: npm ci

      # High-severity gate with a SCOPED allowlist (scripts/audit-gate.mjs)
      # instead of a blanket audit-level drop: each waived advisory carries its
      # justification and an expiry date, and the gate fails when an entry
      # expires or becomes stale — so a "temporary" exception can never
      # silently become permanent, and any NEW high/critical advisory still
      # fails the build. Currently waived: GHSA-qwww-vcr4-c8h2 (react-router
      # RSC-mode CSRF bypass — app uses classic BrowserRouter, not affected;
      # entry expires 2026-09-30).
      - name: Audit frontend dependencies (production, high severity, allowlisted)
        run: node scripts/audit-gate.mjs

      - name: Lint frontend
        run: npm run lint

      - name: Check frontend formatting
        run: npm run format:check

      # --coverage enforces the coverage thresholds declared in vite.config.js
      # (a ratchet set just below current levels); plain `npm test` stays fast locally.
      - name: Run frontend tests (with coverage thresholds)
        run: npm test -- --coverage

      # Uploads even if the test step above failed (a coverage drop is exactly
      # the kind of run worth seeing on Codecov), but not if the job was cancelled.
      - name: Upload frontend coverage to Codecov
        if: ${{ !cancelled() }}
        uses: codecov/codecov-action@v5
        with:
          token: ${{ secrets.CODECOV_TOKEN }}
          directory: frontend/coverage
          flags: frontend
          fail_ci_if_error: false

      - name: Build frontend
        run: npm run build

  e2e:
    name: End-to-end Tests (Playwright)
    runs-on: ubuntu-latest
    services:
      mysql:
        image: mysql:8
        env:
          MYSQL_ALLOW_EMPTY_PASSWORD: 'true'
          MYSQL_DATABASE: frameset_db
        ports:
          - 3306:3306
        options: >-
          --health-cmd="mysqladmin ping"
          --health-interval=10s
          --health-timeout=5s
          --health-retries=5
    env:
      DB_HOST: 127.0.0.1
      DB_USER: root
      DB_PASSWORD: ''
      DB_NAME: frameset_db
      JWT_SECRET: ci-only-jwt-secret-not-used-anywhere-else
      JWT_REFRESH_SECRET: ci-only-refresh-secret-not-used-anywhere-else
      TOTP_ENCRYPTION_KEY: 20f766230f5b4740f5b620d2dde09488b110435c13395edb10e1fdcd5ddf2098
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version-file: .nvmrc
          cache: npm
          cache-dependency-path: |
            backend/package-lock.json
            frontend/package-lock.json
            e2e/package-lock.json

      - name: Install backend dependencies
        working-directory: backend
        run: npm ci

      - name: Install frontend dependencies
        working-directory: frontend
        run: npm ci

      - name: Install e2e dependencies
        working-directory: e2e
        run: npm ci

      - name: Check e2e formatting
        working-directory: e2e
        run: npm run format:check

      - name: Install Playwright's Chromium
        working-directory: e2e
        run: npx playwright install --with-deps chromium

      - name: Run database migrations
        working-directory: backend
        run: npm run migrate

      - name: Run end-to-end tests
        working-directory: e2e
        run: npm test

      - name: Upload Playwright report
        if: failure()
        uses: actions/upload-artifact@v4
        with:
          name: playwright-report
          path: e2e/playwright-report/
          retention-days: 7