ci.yml

name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

jobs:
  # ===========================================
  # Build and Test
  # ===========================================
  build-and-test:
    runs-on: ubuntu-latest

    strategy:
      matrix:
        node-version: [18, 20, 22]

    steps:
      - name: Checkout code
        uses: actions/checkout@v6

      - name: Setup Node.js ${{ matrix.node-version }}
        uses: actions/setup-node@v6
        with:
          node-version: ${{ matrix.node-version }}
          cache: 'npm'

      - name: Install dependencies
        run: npm ci

      - name: Build
        run: npm run build

      - name: Run tests
        run: npm test

      - name: Run tests with coverage
        if: matrix.node-version == 20
        run: npm run test:coverage

      - name: Validate coverage thresholds
        if: matrix.node-version == 20
        run: |
          # Extract coverage percentages from lcov report
          LINES_COV=$(grep -A 3 'Lines' coverage/lcov-report/index.html | grep -oP '\d+\.\d+%' | head -1 | tr -d '%')
          BRANCH_COV=$(grep -A 3 'Branches' coverage/lcov-report/index.html | grep -oP '\d+\.\d+%' | head -1 | tr -d '%')

          echo "Lines coverage: ${LINES_COV}%"
          echo "Branch coverage: ${BRANCH_COV}%"

          # Check minimum thresholds (lines: 70%, branches: 60%)
          if (( $(echo "$LINES_COV < 70" | bc -l) )); then
            echo "ERROR: Lines coverage ${LINES_COV}% is below threshold of 70%"
            exit 1
          fi

          if (( $(echo "$BRANCH_COV < 60" | bc -l) )); then
            echo "ERROR: Branch coverage ${BRANCH_COV}% is below threshold of 60%"
            exit 1
          fi

          echo "Coverage thresholds met!"

      - name: Upload coverage to Codecov
        if: matrix.node-version == 20
        uses: codecov/codecov-action@v5
        with:
          token: ${{ secrets.CODECOV_TOKEN }}
          files: ./coverage/lcov.info
          fail_ci_if_error: true

  # ===========================================
  # Lint and Format
  # ===========================================
  lint:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v6

      - name: Setup Node.js
        uses: actions/setup-node@v6
        with:
          node-version: 20
          cache: 'npm'

      - name: Install dependencies
        run: npm ci

      - name: Run Biome check
        run: npm run check

      - name: Type check
        run: npx tsc --noEmit

  # ===========================================
  # Architecture Validation
  # ===========================================
  validate-architecture:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v6

      - name: Setup Node.js
        uses: actions/setup-node@v6
        with:
          node-version: 20
          cache: 'npm'

      - name: Install dependencies
        run: npm ci

      - name: Build
        run: npm run build

      - name: Validate architecture with dependency-cruiser
        run: npm run validate:arch

  # ===========================================
  # Profile Validation
  # ===========================================
  validate-profiles:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v6

      - name: Setup Node.js
        uses: actions/setup-node@v6
        with:
          node-version: 20
          cache: 'npm'

      - name: Install dependencies
        run: npm ci

      - name: Build
        run: npm run build

      - name: Validate all profiles load correctly
        run: |
          node -e "
            import('./dist/profiles.js').then(async ({ listProfiles }) => {
              const profiles = await listProfiles();
              console.log('Loaded profiles:', profiles.map(p => p.id));
              if (profiles.length === 0) {
                process.exit(1);
              }
              console.log('All profiles validated successfully!');
            }).catch(err => {
              console.error('Profile validation failed:', err);
              process.exit(1);
            });
          "

  # ===========================================
  # Security Scanning
  # ===========================================
  security:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v6

      - name: Setup Node.js
        uses: actions/setup-node@v6
        with:
          node-version: 20
          cache: 'npm'

      - name: Install dependencies
        run: npm ci

      - name: Run npm audit
        run: npm audit --audit-level=high

      - name: Run Snyk security scan
        uses: snyk/actions/node@master
        env:
          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
        with:
          args: --severity-threshold=high