ci.yml

name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

jobs:
  audit:
    runs-on: ubuntu-latest
    timeout-minutes: 15

    services:
      postgres:
        image: postgres:16
        env:
          POSTGRES_USER: postgres
          POSTGRES_PASSWORD: postgres
          POSTGRES_DB: interviewlab_test
        ports:
          - 5432:5432
        options: >-
          --health-cmd pg_isready
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5

    env:
      JWT_SECRET: ci-only-do-not-use-in-prod-abcdef1234567890
      DATABASE_URL: postgresql://postgres:postgres@localhost:5432/interviewlab_test
      # Auth/API rate limits are tuned tight for production; the live-server
      # integration suite below makes far more requests per minute than a
      # real user would, so we relax the limits for this job only.
      AUTH_LOGIN_RATE_LIMIT_MAX: '1000'
      AUTH_REGISTER_RATE_LIMIT_MAX: '1000'
      API_RATE_LIMIT_MAX: '100000'
      AUTH_RATE_LIMIT_MAX: '1000'

    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - uses: oven-sh/setup-bun@v1
        with:
          bun-version: "1.3.4"

      - name: Install dependencies
        run: bun install --frozen-lockfile

      - name: TypeScript check
        run: bunx tsc --noEmit

      - name: ESLint
        run: bun run lint

      - name: Push database schema
        run: bun run db:push

      - name: Seed database
        run: bun run db:seed

      - name: Unit tests
        run: CI=true bun run test

      - name: Build
        run: bun run build

      - name: Start server
        run: |
          nohup bun run start -- -p 3000 &
          echo $! > server.pid
          for i in $(seq 1 30); do
            if curl -fsS http://localhost:3000 >/dev/null 2>&1; then
              echo "Server is up"
              exit 0
            fi
            sleep 1
          done
          echo "Server failed to start" >&2
          exit 1

      - name: Integration tests (live server)
        run: CI=true TEST_BASE_URL=http://localhost:3000 bun run test -- __tests__/api/auth.test.ts __tests__/api/resources.test.ts __tests__/api/questions-interview-ai.test.ts __tests__/api/user-paths.test.ts

      - name: Stop server
        if: always()
        run: kill "$(cat server.pid)" 2>/dev/null || true

      - name: Secret scan (gitleaks)
        uses: gitleaks/gitleaks-action@v2
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}