ci.yml

name: CI

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

on:
  push:
    branches:
      - feature/**
      - bugfix/**
  pull_request:
    branches: [ develop, main ]
  schedule:
    - cron: '0 6 * * 1'  # Every Monday 06:00 UTC — OWASP weekly scan

permissions:
  contents: read
  pull-requests: write
  checks: write

jobs:
  assemble:
    name: Assemble
    runs-on: ubuntu-latest
    timeout-minutes: 20

    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-java@v4
        with:
          distribution: temurin
          java-version: 21

      - uses: gradle/actions/setup-gradle@v4
        with:
          cache-read-only: ${{ github.event_name != 'push' }}

      - name: Run assemble
        run: ./gradlew assemble --no-daemon

  test:
    name: Test
    if: github.event_name == 'push'
    runs-on: ubuntu-latest
    timeout-minutes: 20
    needs: assemble

    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-java@v4
        with:
          distribution: temurin
          java-version: 21

      - uses: gradle/actions/setup-gradle@v4
        with:
          cache-read-only: false

      - name: Run unit tests
        run: ./gradlew test jvmTest jsTest --no-daemon

      - name: Upload test reports
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: test-reports-push
          path: |
            "**/build/reports/tests/"
            "**/build/test-results/"

  coverage:
    name: Coverage & Verify
    if: github.event_name == 'pull_request'
    runs-on: ubuntu-latest
    timeout-minutes: 30
    needs: assemble

    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-java@v4
        with:
          distribution: temurin
          java-version: 21

      - uses: gradle/actions/setup-gradle@v4
        with:
          cache-read-only: true

      - name: Run coverage tasks (koverXmlReport + koverVerify)
        run: ./gradlew test jvmTest jsTest koverXmlReport koverVerify --no-daemon

      - name: Publish Test Report in PR
        if: always()
        uses: dorny/test-reporter@v1
        with:
          name: Kotlin Tests
          path: "**/build/test-results/**/*.xml"
          reporter: java-junit

      - name: Comment coverage on PR
        if: always()
        uses: madrapps/jacoco-report@v1.7.1
        with:
          paths: ${{ github.workspace }}/build/reports/kover/report.xml
          token: ${{ secrets.PERSONAL_ACCESS_TOKEN }}
          min-coverage-overall: 90
          min-coverage-changed-files: 80

      - name: Upload coverage artifacts
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: coverage-report
          path: |
            build/reports/kover/
            "**/build/test-results/"

  screenshot-test:
    name: Screenshot Tests
    if: github.event_name == 'pull_request'

    runs-on: macos-latest
    timeout-minutes: 30
    needs: assemble

    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-java@v4
        with:
          distribution: temurin
          java-version: 21

      - uses: gradle/actions/setup-gradle@v4
        with:
          cache-read-only: true

      - name: Detect web app changes
        id: changes
        uses: dorny/paths-filter@v3
        with:
          filters: |
            webapp:
              - 'app/webApp/**'

      - name: Setup Node.js
        if: steps.changes.outputs.webapp == 'true'
        uses: actions/setup-node@v4
        with:
          node-version: 24.16.0
          cache: npm

      - name: Install dependencies
        if: steps.changes.outputs.webapp == 'true'
        working-directory: app/webApp
        run: npm ci

      - name: Install Playwright browsers
        if: steps.changes.outputs.webapp == 'true'
        working-directory: app/webApp
        run: npx playwright install --with-deps

      - name: Run Playwright screenshot tests
        if: steps.changes.outputs.webapp == 'true'
        working-directory: app/webApp
        run: npx playwright test

      - name: Upload Playwright HTML Report
        if: always() && steps.changes.outputs.webapp == 'true'
        uses: actions/upload-artifact@v4
        with:
          name: playwright-report
          path: app/webApp/playwright-report/

      - name: Upload screenshot diffs
        if: failure() && steps.changes.outputs.webapp == 'true'
        uses: actions/upload-artifact@v4
        with:
          name: screenshot-diffs
          path: |
            app/webApp/test-results/
            app/webApp/src/webTest/ts/screenshot/**/*-diff.png

  benchmark:
    name: Run Benchmark
    if: github.event_name == 'pull_request'
    runs-on: ubuntu-latest
    timeout-minutes: 30
    needs: assemble

    permissions:
      contents: write
      pull-requests: write

    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-java@v4
        with:
          distribution: temurin
          java-version: 21

      - uses: gradle/actions/setup-gradle@v4
        with:
          cache-read-only: true

      - name: Run benchmarks (fast mode)
        run: ./gradlew fastBenchmark benchmarkMerge -PbenchmarkConfig=fast --no-daemon

      - name: Compare and comment
        uses: benchmark-action/github-action-benchmark@v1
        with:
          tool: 'jmh'
          output-file-path: build/reports/benchmarks/benchmark-results.json
          github-token: ${{ secrets.PERSONAL_ACCESS_TOKEN }}
          auto-push: true
          alert-threshold: '120%'
          comment-on-alert: true
          fail-on-alert: true
          gh-pages-branch: 'gh-pages'

  detekt:
    name: Detekt
    if: github.event_name == 'pull_request'
    runs-on: ubuntu-latest
    timeout-minutes: 20
    needs: assemble

    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-java@v4
        with:
          distribution: temurin
          java-version: 21

      - uses: gradle/actions/setup-gradle@v4
        with:
          cache-read-only: true

      - name: Run detekt
        run: ./gradlew detekt --no-daemon

      - name: Upload detekt reports
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: detekt-report
          path: "**/build/reports/detekt/"

  secret-scan:
    name: Secret Scan (Gitleaks)
    if: github.event_name == 'pull_request'
    runs-on: ubuntu-latest
    timeout-minutes: 5

    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - uses: gitleaks/gitleaks-action@v2
        env:
          GITHUB_TOKEN: ${{ secrets.PERSONAL_ACCESS_TOKEN }}

  dependency-check:
    name: OWASP Dependency Check
    # Run on PRs to main (security gate) and on weekly schedule
    if: >
      (github.event_name == 'pull_request' && github.base_ref == 'main') ||
      github.event_name == 'schedule'
    runs-on: ubuntu-latest
    timeout-minutes: 60

    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-java@v4
        with:
          distribution: temurin
          java-version: 21

      - uses: gradle/actions/setup-gradle@v4
        with:
          # Cache the NVD database between runs to speed up subsequent scans
          cache-read-only: false

      - name: Run OWASP Dependency Check
        run: ./gradlew dependencyCheckAggregate -PnvdApiKey=${{ secrets.NVD_API_KEY }} --no-daemon

      - name: Upload OWASP report
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: dependency-check-report
          path: build/reports/dependency-check-report/