ci.yml

name: CI

on:
  push:
    branches: [ main, develop ]
  pull_request:
    branches: [ main, develop ]

env:
  GO_VERSION: '1.24.4'

# Security: Define minimal permissions at workflow level
permissions:
  contents: read

# CI Strategy:
# - Uses enhanced Makefile targets that adapt behavior based on CI environment
# - Testing follows pyramid approach: many unit tests, some integration tests
# - All jobs use consistent caching with Go version in cache key
# - Dependencies are downloaded once per job and cached across workflow runs
# - Jobs are parallelized where possible but coordinated to maximize cache hits
# - Build job waits for all quality checks (test, lint, security) to complete

jobs:
  unit-test:
    name: Unit Tests
    runs-on: ubuntu-latest
    
    steps:
    - name: Checkout code
      uses: actions/checkout@v4

    - name: Set up Go
      uses: actions/setup-go@v5
      with:
        go-version: ${{ env.GO_VERSION }}
        cache: true

    - name: Verify dependencies
      run: go mod verify

    - name: Run unit tests with coverage
      env:
        CI: true
        JWT_SECRET_KEY: test-secret-key-for-integration
      run: make test

    - name: Upload coverage to Codecov
      uses: codecov/codecov-action@v5
      with:
        files: ./coverage.out
        flags: unittests
        name: codecov-umbrella
        fail_ci_if_error: false

  lint:
    name: Lint
    runs-on: ubuntu-latest
    
    steps:
    - name: Checkout code
      uses: actions/checkout@v4

    - name: Set up Go
      uses: actions/setup-go@v5
      with:
        go-version: ${{ env.GO_VERSION }}
        cache: true

    - name: Install development tools
      run: make install-tools

    - name: Run linting with format check
      env:
        CI: true
      run: make lint

  security:
    name: Security Scan
    runs-on: ubuntu-latest
    permissions:
      contents: read
      security-events: write  # Required for SARIF upload
    
    steps:
    - name: Checkout code
      uses: actions/checkout@v4

    - name: Set up Go
      uses: actions/setup-go@v5
      with:
        go-version: ${{ env.GO_VERSION }}
        cache: true

    - name: Install development tools
      run: make install-tools

    - name: Run security scan
      env:
        CI: true
      run: make security

    - name: Upload SARIF file
      uses: github/codeql-action/upload-sarif@v3
      with:
        sarif_file: gosec.sarif

  build:
    name: Build
    runs-on: ubuntu-latest
    needs: [unit-test, lint, security]
    
    steps:
    - name: Checkout code
      uses: actions/checkout@v4

    - name: Set up Go
      uses: actions/setup-go@v5
      with:
        go-version: ${{ env.GO_VERSION }}
        cache: true

    - name: Build API server
      run: make build

    - name: Test build executable
      run: ./bin/voidrunner-api --help || echo "Binary built successfully"

  integration-test:
    name: Integration Tests
    runs-on: ubuntu-latest
    needs: [unit-test]
    
    services:
      postgres:
        image: postgres:17
        env:
          POSTGRES_PASSWORD: testpassword
          POSTGRES_USER: testuser
          POSTGRES_DB: voidrunner_test
        options: >-
          --health-cmd pg_isready
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5
        ports:
          - 5432:5432
      
      docker:
        image: docker:27-dind
        env:
          DOCKER_TLS_CERTDIR: /certs
        options: >-
          --privileged
          --health-cmd "docker info"
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5
        ports:
          - 2376:2376

      redis:
        image: redis:7-alpine
        options: >-
          --health-cmd "redis-cli ping"
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5
        ports:
          - 6379:6379

    steps:
    - name: Checkout code
      uses: actions/checkout@v4

    - name: Set up Go
      uses: actions/setup-go@v5
      with:
        go-version: ${{ env.GO_VERSION }}
        cache: true

    - name: Run database migrations
      env:
        DB_HOST: localhost
        DB_PORT: 5432
        DB_USER: testuser
        DB_PASSWORD: testpassword
        DB_NAME: voidrunner_test
        DB_SSL_MODE: disable
      run: make migrate-up

    - name: Run integration tests
      env:
        CI: true
        TEST_DB_HOST: localhost
        TEST_DB_PORT: 5432
        TEST_DB_USER: testuser
        TEST_DB_PASSWORD: testpassword
        TEST_DB_NAME: voidrunner_test
        TEST_DB_SSLMODE: disable
        JWT_SECRET_KEY: test-secret-key-for-integration
        DOCKER_HOST: tcp://localhost:2376
        DOCKER_TLS_VERIFY: 0
        REDIS_HOST: localhost
        REDIS_PORT: 6379
        REDIS_PASSWORD: ""
        REDIS_DATABASE: 0
        LOG_STREAM_ENABLED: true
        LOG_BUFFER_SIZE: 50
        LOG_MAX_CONCURRENT_STREAMS: 5
        LOG_BATCH_INSERT_SIZE: 5
        LOG_BATCH_INSERT_INTERVAL: 1s
      run: make test-integration

  docs:
    name: Documentation
    runs-on: ubuntu-latest
    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
    permissions:
      contents: write   # Required for pushing to gh-pages branch
      pages: write      # Required for GitHub Pages deployment
      id-token: write   # Required for GitHub Pages deployment
    
    steps:
    - name: Checkout code
      uses: actions/checkout@v4

    - name: Set up Go
      uses: actions/setup-go@v5
      with:
        go-version: ${{ env.GO_VERSION }}
        cache: true

    - name: Install development tools
      run: make install-tools

    - name: Generate API documentation
      run: make docs

    - name: Deploy documentation to GitHub Pages
      if: success()
      uses: peaceiris/actions-gh-pages@v4
      with:
        github_token: ${{ secrets.GITHUB_TOKEN }}
        publish_dir: ./docs
        destination_dir: api-docs

  dependency-review:
    name: Dependency Review
    runs-on: ubuntu-latest
    if: github.event_name == 'pull_request'
    
    steps:
    - name: Checkout code
      uses: actions/checkout@v4
      
    - name: Dependency Review
      uses: actions/dependency-review-action@v4
      with:
        fail-on-severity: moderate

  performance:
    name: Performance Tests
    runs-on: ubuntu-latest
    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
    permissions:
      contents: write   # Required for pushing benchmark data to gh-pages
      actions: write    # Required for benchmark action auto-push
      pull-requests: write  # Required for benchmark action comments
    
    steps:
    - name: Checkout code
      uses: actions/checkout@v4

    - name: Set up Go
      uses: actions/setup-go@v5
      with:
        go-version: ${{ env.GO_VERSION }}
        cache: true

    - name: Run benchmark tests
      run: make bench | tee benchmark.txt

    - name: Store benchmark result
      uses: benchmark-action/github-action-benchmark@v1
      if: success()
      with:
        tool: 'go'
        output-file-path: benchmark.txt
        github-token: ${{ secrets.GITHUB_TOKEN }}
        auto-push: true
        comment-on-alert: true
        alert-threshold: '200%'
        fail-on-alert: true