ci.yml

name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
  workflow_dispatch:

concurrency:
  group: ci-${{ github.ref }}
  cancel-in-progress: true

env:
  PYTHON_VERSION: "3.13"
  NODE_VERSION: "22"

jobs:
  backend-tests:
    name: Backend tests and coverage
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: backend
    steps:
      - uses: actions/checkout@v4

      - name: Install uv
        uses: astral-sh/setup-uv@v5
        with:
          version: "0.11.29"
          enable-cache: true
          cache-dependency-glob: backend/uv.lock

      - name: Set up Python
        run: uv python install ${{ env.PYTHON_VERSION }}

      - name: Install dependencies
        run: uv sync --frozen

      - name: Lint
        run: uv run ruff check .

      - name: Run the test suite under coverage
        run: uv run coverage run -m unittest discover -s tests -v

      - name: Enforce the coverage gate
        run: uv run coverage report

      - name: Publish the coverage report
        if: always()
        run: uv run coverage xml -o coverage.xml

      - uses: actions/upload-artifact@v4
        if: always()
        with:
          name: backend-coverage
          path: backend/coverage.xml
          retention-days: 7

  authorization-tests:
    name: Authorization and file-access boundaries
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: backend
    steps:
      - uses: actions/checkout@v4

      - name: Install uv
        uses: astral-sh/setup-uv@v5
        with:
          version: "0.11.29"
          enable-cache: true
          cache-dependency-glob: backend/uv.lock

      - name: Set up Python
        run: uv python install ${{ env.PYTHON_VERSION }}

      - name: Install dependencies
        run: uv sync --frozen

      - name: Role boundaries and tenant isolation
        run: uv run python -m unittest tests.test_authorization -v

      - name: Protected file and export access
        run: uv run python -m unittest tests.test_file_access -v

      - name: Secret handling
        run: uv run python -m unittest tests.test_config -v

  secret-scan:
    name: No committed secrets
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Reject fallback values for secret environment variables
        run: |
          if grep -rnE 'os\.getenv\(\s*"[^"]*(SECRET|PASSWORD)[^"]*"\s*,\s*"[^"]+"' \
               --include='*.py' --exclude-dir=.venv --exclude-dir=tests backend; then
            echo "::error::A secret has a hard-coded fallback. Read it from the environment and fail closed instead."
            exit 1
          fi

      - name: Reject committed environment files
        run: |
          if git ls-files --error-unmatch .env backend/.env frontend/.env 2>/dev/null; then
            echo "::error::An .env file is tracked in git."
            exit 1
          fi

  frontend:
    name: Frontend lint and build
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: frontend
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: npm
          cache-dependency-path: frontend/package-lock.json

      - name: Install dependencies
        run: npm ci

      - name: Lint
        run: npm run lint

      - name: Unit tests with the coverage gate
        run: npm run test:coverage

      - name: Build
        run: npm run build

      - name: Audit runtime dependencies
        run: npm audit --omit=dev --audit-level=high

      - uses: actions/upload-artifact@v4
        if: always()
        with:
          name: frontend-coverage
          path: frontend/coverage/lcov.info
          retention-days: 7

  shell:
    name: Shell scripts
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Validate syntax
        run: bash -n run.sh scripts/api-smoke.sh

      - name: ShellCheck
        run: shellcheck --severity=warning run.sh scripts/api-smoke.sh

  docker:
    name: Container image
    runs-on: ubuntu-latest
    needs: [backend-tests, frontend]
    steps:
      - uses: actions/checkout@v4

      - uses: docker/setup-buildx-action@v3

      - name: Build the image
        uses: docker/build-push-action@v6
        with:
          context: .
          push: false
          load: true
          tags: placement-portal:ci
          cache-from: type=gha
          cache-to: type=gha,mode=max

      - name: Boot the container and check the health endpoint
        env:
          APP_ENV: production
        run: |
          docker run -d --name portal \
            -e APP_ENV=production \
            -e FLASK_SECRET_KEY="$(python3 -c 'import secrets; print(secrets.token_urlsafe(32))')" \
            -e JWT_SECRET_KEY="$(python3 -c 'import secrets; print(secrets.token_urlsafe(32))')" \
            -p 5001:5001 placement-portal:ci
          for attempt in $(seq 1 30); do
            if curl -fsS http://localhost:5001/api/health | grep -q '"ok"'; then
              echo "Health check passed on attempt $attempt"
              exit 0
            fi
            sleep 2
          done
          echo "::error::The container never became healthy."
          docker logs portal
          exit 1

      - name: Container logs
        if: always()
        run: docker logs portal || true