ci.yml

name: CI
run-name: ${{ github.event.pull_request.title || github.event.head_commit.message }} ${{ (github.event_name == 'workflow_dispatch' && github.ref_name) || '' }} ${{ github.event_name == 'merge_group' && 'merge queue' || '' }}

concurrency:
  group: ci-${{ github.head_ref || github.run_id }}
  cancel-in-progress: true

on:
  push:
    branches: [develop, stage, main, 'release/**']
  pull_request:
    branches: [develop, stage, main, 'release/**']
  merge_group:
    types: [checks_requested]
  schedule:
    - cron: '17 4 * * 1' # Weekly Monday 4:17 UTC
  workflow_dispatch:

permissions:
  contents: read

env:
  GH_TOKEN: ${{ github.token }}
  VCPKG_NUGET_USER: ${{ github.repository_owner }}
  NUGET_FEED_URL: https://nuget.pkg.github.com/${{ github.repository_owner }}/index.json
  VCPKG_BINARY_SOURCES: clear;nuget,https://nuget.pkg.github.com/${{ github.repository_owner }}/index.json,readwrite

# ---------------------------------------------------------------------------
#  Build
# ---------------------------------------------------------------------------
jobs:
  init:
    name: Initialize
    uses: ./.github/workflows/_init.yaml

  # Skip build entirely for docs-only PRs (no code changed).
  # For all code changes, builder handles engine download-vs-compile
  # internally via hash comparison with nightly builds.
  changes:
    name: Detect changes
    runs-on: ubuntu-latest
    if: github.event_name == 'pull_request'
    permissions:
      contents: read
      pull-requests: read
    outputs:
      code: ${{ steps.filter.outputs.code }}
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
      - uses: dorny/paths-filter@d1c1ffe0248fe513906c8e24db8ea791d46f8590 # v3
        id: filter
        with:
          filters: |
            code:
              - 'packages/**'
              - 'nodes/**'
              - 'apps/**'
              - 'scripts/**'
              - 'builder'
              - 'builder.cmd'
              - '.github/workflows/**'
              - 'package.json'

  # ---------------------------------------------------------------------------
  #  Helm lint + schema validation (only on PRs touching deploy/helm/**)
  # ---------------------------------------------------------------------------
  helm-changes:
    name: Detect Helm changes
    runs-on: ubuntu-latest
    if: github.event_name == 'pull_request'
    permissions:
      contents: read
      pull-requests: read
    outputs:
      helm: ${{ steps.filter.outputs.helm }}
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
      - uses: dorny/paths-filter@d1c1ffe0248fe513906c8e24db8ea791d46f8590 # v3
        id: filter
        with:
          filters: |
            helm:
              - 'deploy/helm/**'

  helm-lint:
    name: Helm lint & kubeconform
    needs: helm-changes
    runs-on: ubuntu-latest
    timeout-minutes: 10
    if: needs.helm-changes.outputs.helm == 'true'
    steps:
      - name: Checkout
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4

      - name: Install Helm
        uses: azure/setup-helm@1a275c3b69536ee54be43f2070a358922e12c8d4 # v4

      - name: Install kubeconform
        run: |
          curl -sSL https://github.com/yannh/kubeconform/releases/download/v0.6.7/kubeconform-linux-amd64.tar.gz \
            | tar -xz -C /usr/local/bin kubeconform

      - name: Helm lint
        run: helm lint deploy/helm/rocketride

      - name: Helm template | kubeconform
        run: |
          helm template rocketride deploy/helm/rocketride \
            --values deploy/helm/rocketride/tests/values_test.yaml \
            | kubeconform -strict -summary -kubernetes-version 1.29.0

  build:
    name: Build
    needs: [init, changes]
    if: >-
      always() &&
      needs.init.result == 'success' &&
      github.event_name != 'schedule' &&
      (github.event_name != 'pull_request' || needs.changes.outputs.code == 'true')
    uses: ./.github/workflows/_build.yaml
    permissions:
      contents: read
      packages: write
    with:
      full_version: ${{ needs.init.outputs.full_server_version }}
      build_hash: ${{ needs.init.outputs.build_hash }}
      build_stamp: ${{ needs.init.outputs.build_stamp }}
    secrets: inherit

  # ---------------------------------------------------------------------------
  #  Build passthrough — when build is skipped (docs-only PRs), report success
  #  under the same check names so branch protection required checks pass.
  # ---------------------------------------------------------------------------
  build-skip:
    name: Build / ${{ matrix.label }}
    needs: [init, changes]
    if: >-
      always() &&
      needs.init.result == 'success' &&
      github.event_name == 'pull_request' &&
      needs.changes.outputs.code != 'true'
    runs-on: ubuntu-latest
    strategy:
      matrix:
        include:
          - label: Ubuntu 22.04
          - label: Windows Server 2022
          - label: macOS (ARM64)
    steps:
      - run: echo "Build skipped — no code changes detected"

  # CodeQL: replaced by GitHub's "Default setup" — managed in repo Settings →
  # Code security. Scans Python, JavaScript/TypeScript (and C/C++ via
  # GitHub-managed autobuild). Findings surface in the Security tab.

  # ---------------------------------------------------------------------------
  #  Container scan — non-PR only (push/schedule/etc.).
  #
  #  ⚠ DO NOT add to develop/main required-status-checks (same caveat as
  #  CodeQL above). Skipped on PR runs → would block merges. Trivy SARIF
  #  uploads to the Security tab on every push to develop/main, so findings
  #  remain visible without gating PR merges.
  # ---------------------------------------------------------------------------
  container-scan:
    name: Container scan / ${{ matrix.dockerfile }}
    if: github.event_name != 'pull_request'
    runs-on: ubuntu-latest
    timeout-minutes: 15
    permissions:
      contents: read
      security-events: write
    strategy:
      fail-fast: false
      matrix:
        dockerfile:
          - Dockerfile.engine
    steps:
      - name: Checkout
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4

      - name: Install Trivy
        run: |
          sudo apt-get install -y wget apt-transport-https gnupg
          wget -qO - https://aquasecurity.github.io/trivy-repo/deb/public.key | gpg --dearmor | sudo tee /usr/share/keyrings/trivy.gpg > /dev/null
          echo "deb [signed-by=/usr/share/keyrings/trivy.gpg] https://aquasecurity.github.io/trivy-repo/deb generic main" | sudo tee /etc/apt/sources.list.d/trivy.list
          sudo apt-get update
          sudo apt-get install -y trivy

      - name: Run Trivy (filesystem scan)
        run: |
          trivy fs docker/${{ matrix.dockerfile }} \
            --format sarif \
            --output trivy-${{ matrix.dockerfile }}.sarif \
            --severity CRITICAL,HIGH \
            --ignore-unfixed

      - name: Upload Trivy SARIF
        uses: github/codeql-action/upload-sarif@03e4368ac7daa2bd82b3e85262f3bf87ee112f57 # v3
        if: always()
        with:
          sarif_file: 'trivy-${{ matrix.dockerfile }}.sarif'
          category: 'trivy-${{ matrix.dockerfile }}'

  # ---------------------------------------------------------------------------
  #  Ruff — Python lint + format check. Mirrors the local lefthook hook so
  #  contributors who bypass lefthook (--no-verify) still get caught in CI.
  # ---------------------------------------------------------------------------
  ruff-check:
    name: Ruff
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
      - uses: astral-sh/ruff-action@4919ec5cf1f49eff0871dbcea0da843445b837e6 # v3
      - run: ruff check
      - run: ruff format --check

  # ---------------------------------------------------------------------------
  #  gitleaks — secret scan. Installs the binary directly because the upstream
  #  gitleaks-action v2 requires a paid GITLEAKS_LICENSE for org-owned repos;
  #  the binary itself is MIT-licensed and free. Mirrors the local lefthook hook.
  # ---------------------------------------------------------------------------
  gitleaks:
    name: gitleaks
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
        with:
          fetch-depth: 0
      - name: Install gitleaks
        env:
          GITLEAKS_VERSION: 8.30.1
        run: |
          curl -fsSL "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz" \
            | sudo tar -xz -C /usr/local/bin gitleaks
          gitleaks version
      - name: Run gitleaks
        run: |
          BASE="${{ github.event.pull_request.base.sha || github.event.before }}"
          gitleaks detect --config .gitleaks.toml --verbose --redact --log-opts="${BASE}..HEAD"

  # ---------------------------------------------------------------------------
  #  Gatekeeper — the ONLY job to mark as "Required" in branch protection.
  #  Aggregates all CI results so skipped builds don't block PRs.
  # ---------------------------------------------------------------------------
  ci-ok:
    name: CI OK
    needs: [init, changes, build, helm-changes, helm-lint, ruff-check, gitleaks]
    if: always()
    runs-on: ubuntu-latest
    steps:
      - name: Verify results
        run: |
          if [[ "${{ contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled') }}" == "true" ]]; then
            echo "❌ One or more CI jobs failed or were cancelled."
            echo "Results: init=${{ needs.init.result }}, changes=${{ needs.changes.result }}, build=${{ needs.build.result }}, helm-changes=${{ needs.helm-changes.result }}, helm-lint=${{ needs.helm-lint.result }}, ruff-check=${{ needs['ruff-check'].result }}, gitleaks=${{ needs.gitleaks.result }}"
            exit 1
          fi
          echo "✅ All CI checks passed (or were correctly skipped)."
          echo "Results: init=${{ needs.init.result }}, changes=${{ needs.changes.result }}, build=${{ needs.build.result }}, helm-changes=${{ needs.helm-changes.result }}, helm-lint=${{ needs.helm-lint.result }}, ruff-check=${{ needs['ruff-check'].result }}, gitleaks=${{ needs.gitleaks.result }}"

  # ---------------------------------------------------------------------------
  #  Discord — update PR embed with final check counts after CI completes.
  # ---------------------------------------------------------------------------
  discord-notify:
    needs: [ci-ok]
    if: always() && github.event_name == 'pull_request'
    uses: ./.github/workflows/discord-pr.yml
    permissions:
      contents: read
      pull-requests: write
      issues: write
      checks: read
    secrets: inherit