ci.yml

# CI — runs on every pull request to develop or main.
#
# These jobs are the required status checks for PR merges.
# The "source-branch-check" job enforces that PRs to main can
# only come from the develop branch (native GitHub has no such rule).
#
# NOTE: Pin actions to commit SHAs before shipping to production
#       (CLAUDE.md requirement). Version tags are used here for readability.

name: CI

on:
  pull_request:
    branches: [develop, main]

permissions:
  contents: read

env:
  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"

jobs:
  # ---------------------------------------------------------------------------
  # Enforce: PRs to main must come from develop
  # ---------------------------------------------------------------------------
  source-branch:
    name: Source Branch Check
    if: github.base_ref == 'main'
    runs-on: ubuntu-latest
    steps:
      - name: Require develop → main
        env:
          HEAD_REF: ${{ github.head_ref }}
        run: |
          if [[ "$HEAD_REF" != "develop" ]]; then
            echo "::error::PRs to main must come from the develop branch (got: $HEAD_REF)"
            exit 1
          fi

  # ---------------------------------------------------------------------------
  # Lint, format, and test — run in parallel for frontend / backend
  # ---------------------------------------------------------------------------
  frontend-quality:
    name: Frontend — Lint & Test
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: "20"
          cache: npm
          cache-dependency-path: frontend/package-lock.json
      - run: npm ci
        working-directory: frontend
      - run: npm run lint
        working-directory: frontend
      - run: npm test -- --coverage --watchAll=false
        working-directory: frontend
        env:
          CI: true
      - uses: actions/upload-artifact@v4
        if: always()
        with:
          name: frontend-coverage
          path: frontend/coverage/
          retention-days: 1

  backend-quality:
    name: Backend — Lint & Test
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: "20"
          cache: npm
          cache-dependency-path: backend/package-lock.json
      - run: npm ci
        working-directory: backend
      - run: npm run lint
        working-directory: backend
      - run: npm test -- --coverage
        working-directory: backend
        env:
          CI: true
      - uses: actions/upload-artifact@v4
        if: always()
        with:
          name: backend-coverage
          path: backend/coverage/
          retention-days: 1

  # ---------------------------------------------------------------------------
  # Security scans — all independent, run in parallel
  # ---------------------------------------------------------------------------
  sast:
    name: SAST — Semgrep
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: semgrep/semgrep-action@v1
        with:
          config: "p/security-audit p/secrets p/typescript p/owasp-top-ten"
        # continue-on-error: true  ← uncomment to warn-only on first run

  secrets-scan:
    name: Secrets — Gitleaks
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0  # full history so git-log scan catches old commits
      - uses: gitleaks/gitleaks-action@v2
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  dep-scan:
    name: Dependencies — Trivy
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: aquasecurity/trivy-action@v0.36.0
        with:
          scan-type: fs
          scan-ref: .
          format: table
          exit-code: "1"
          ignore-unfixed: true
          severity: CRITICAL,HIGH
          skip-dirs: legacy

  iac-scan:
    name: IaC — Checkov & tfsec
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Checkov
        uses: bridgecrewio/checkov-action@v12
        with:
          directory: infra/
          soft_fail: true   # review findings; set to false once baseline is clean
      - name: Trivy IaC scan
        uses: aquasecurity/trivy-action@v0.36.0
        with:
          scan-type: config
          scan-ref: infra/
          format: table
          exit-code: "0"
          severity: CRITICAL,HIGH

  sbom:
    name: SBOM — Syft
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: anchore/sbom-action@v0
        with:
          format: cyclonedx-json
          artifact-name: bba-sbom-pr.cdx.json

  # ---------------------------------------------------------------------------
  # Code quality — requires coverage from both quality jobs
  # ---------------------------------------------------------------------------
  sonarcloud:
    name: Code Quality — SonarCloud
    needs: [frontend-quality, backend-quality]
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - uses: actions/download-artifact@v4
        with:
          name: frontend-coverage
          path: frontend/coverage
      - uses: actions/download-artifact@v4
        with:
          name: backend-coverage
          path: backend/coverage
      - uses: SonarSource/sonarcloud-github-action@v3
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}