path-based-testing.yml

name: Path-based Testing

on:
  pull_request:
    branches: [main, develop]
  push:
    branches: [main, develop]

concurrency:
  group: path-testing-${{ github.head_ref || github.run_id }}
  cancel-in-progress: true

jobs:
  # Detect which paths have changed
  detect-changes:
    name: Detect Changes
    runs-on: ubuntu-latest
    outputs:
      api: ${{ steps.changes.outputs.api }}
      app: ${{ steps.changes.outputs.app }}
      infra: ${{ steps.changes.outputs.infra }}
      opa: ${{ steps.changes.outputs.opa }}
      k8s: ${{ steps.changes.outputs.k8s }}
      docs: ${{ steps.changes.outputs.docs }}
      root: ${{ steps.changes.outputs.root }}
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Check for changes
        uses: dorny/paths-filter@v2
        id: changes
        with:
          filters: |
            api:
              - 'projects/consumer-accounts-internal-api/**'
            app:
              - 'projects/consumer-accounts-internal-app/**'
            infra:
              - 'infra/**'
            opa:
              - 'infra/opa/**'
            k8s:
              - 'infra/k8s/**'
            docs:
              - '**/*.md'
              - 'docs/**'
            root:
              - 'package.json'
              - 'bun.lock'
              - 'tsconfig.json'
              - '.github/**'

  # API-specific tests
  test-api:
    name: Test API
    runs-on: ubuntu-latest
    needs: detect-changes
    if: needs.detect-changes.outputs.api == 'true' || needs.detect-changes.outputs.root == 'true'

    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Setup Environment
        uses: ./.github/actions/setup-environment

      - name: Setup Test Services
        uses: ./.github/actions/setup-services
        with:
          setup-opa: "true"

      - name: Load OPA test data
        run: |
          cd infra/opa
          # Load user data into OPA
          curl -X PUT http://localhost:8181/v1/data/users \
            -H "Content-Type: application/json" \
            -d "$(jq '.users' data/users.json)"

          curl -X PUT http://localhost:8181/v1/data/user_accounts \
            -H "Content-Type: application/json" \
            -d "$(jq '.user_accounts' data/users.json)"

          curl -X PUT http://localhost:8181/v1/data/roles \
            -H "Content-Type: application/json" \
            -d "$(jq '.roles' data/users.json)"

          curl -X PUT http://localhost:8181/v1/data/departments \
            -H "Content-Type: application/json" \
            -d "$(jq '.departments' data/users.json)"

          echo "✅ OPA test data loaded"

      - name: Type check API
        working-directory: ./projects/consumer-accounts-internal-api
        run: bun run tsc --noEmit

      - name: Run Biome checks on API
        working-directory: ./projects/consumer-accounts-internal-api
        run: |
          # Run Biome check on API-specific files
          bunx biome check src/ tests/

      - name: Run API unit tests
        working-directory: ./projects/consumer-accounts-internal-api
        run: bun run test:coverage
        env:
          NODE_ENV: test
          DATABASE_URL: postgresql://postgres:postgres@localhost:5432/ea_financial_test
          REDIS_URL: redis://localhost:6379

      # TODO: Re-enable integration tests once issues are resolved
      # - name: Run API integration tests
      #   working-directory: ./projects/consumer-accounts-internal-api
      #   run: bun run test:offline
      #   env:
      #     NODE_ENV: test

      - name: Build API
        working-directory: ./projects/consumer-accounts-internal-api
        run: bun run build

      - name: Upload API coverage
        uses: codecov/codecov-action@v3
        with:
          file: ./projects/consumer-accounts-internal-api/coverage/lcov.info
          flags: api
          name: api-coverage

  # App-specific tests
  test-app:
    name: Test App
    runs-on: ubuntu-latest
    needs: detect-changes
    if: needs.detect-changes.outputs.app == 'true' || needs.detect-changes.outputs.root == 'true'
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Setup Environment
        uses: ./.github/actions/setup-environment

      - name: Type check App
        working-directory: ./projects/consumer-accounts-internal-app
        run: bun run typecheck

      - name: Run Biome checks on App
        working-directory: ./projects/consumer-accounts-internal-app
        run: |
          # Run Biome check on app-specific files
          bunx biome check src/

      - name: Build App
        working-directory: ./projects/consumer-accounts-internal-app
        run: bun run build

      - name: Test App build artifacts
        working-directory: ./projects/consumer-accounts-internal-app
        run: |
          if [ ! -d "dist" ]; then
            echo "Build failed - dist directory not found"
            exit 1
          fi
          if [ ! -f "dist/index.html" ]; then
            echo "Build failed - index.html not found"
            exit 1
          fi
          echo "App build artifacts validated successfully"

  # Infrastructure tests
  test-infrastructure:
    name: Test Infrastructure
    runs-on: ubuntu-latest
    needs: detect-changes
    if: needs.detect-changes.outputs.infra == 'true' || needs.detect-changes.outputs.k8s == 'true'
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Setup kubeconform
        run: |
          curl -L https://github.com/yannh/kubeconform/releases/latest/download/kubeconform-linux-amd64.tar.gz | tar xz
          sudo mv kubeconform /usr/local/bin/
          kubeconform -v

      - name: Setup Helm
        uses: azure/setup-helm@v3
        with:
          version: "3.12.0"

      - name: Validate Kubernetes manifests
        run: |
          cd infra/k8s
          # Validate all YAML files with kubeconform
          find . -name "*.yaml" -o -name "*.yml" | xargs kubeconform -summary -output json

      - name: Lint Helm charts
        run: |
          cd infra/k8s
          if [ -d "helm-chart" ]; then
            helm lint helm-chart/
          fi

      - name: Test Docker Compose
        run: |
          cd infra
          if [ -f "docker-compose.dev.yml" ]; then
            docker compose -f docker-compose.dev.yml config
          fi

  # OPA policy tests
  test-opa-policies:
    name: Test OPA Policies
    runs-on: ubuntu-latest
    needs: detect-changes
    if: needs.detect-changes.outputs.opa == 'true' || needs.detect-changes.outputs.api == 'true'
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Setup Environment
        uses: ./.github/actions/setup-environment
      - name: Install OPA CLI
        run: |
          curl -L -o opa https://github.com/open-policy-agent/opa/releases/latest/download/opa_linux_amd64_static
          chmod +x opa
          sudo mv opa /usr/local/bin/

      - name: Validate OPA policies
        run: |
          cd infra/opa
          opa fmt --diff policies/
          opa test policies/

      - name: Install dependencies
        run: bun install --frozen-lockfile

      - name: Start OPA server with policies
        run: |
          cd infra/opa
          # Start OPA server with policies in background
          opa run --server --addr localhost:8181 policies/ &
          OPA_PID=$!
          echo "OPA PID: $OPA_PID"

          # Wait for OPA to be healthy
          timeout 30 bash -c 'until curl -s http://localhost:8181/health > /dev/null; do sleep 1; done' || (echo "OPA failed to start" && exit 1)
          echo "OPA server started successfully"

          # Load user data into OPA (load each section separately)
          curl -X PUT http://localhost:8181/v1/data/users \
            -H "Content-Type: application/json" \
            -d "$(jq '.users' data/users.json)"

          curl -X PUT http://localhost:8181/v1/data/user_accounts \
            -H "Content-Type: application/json" \
            -d "$(jq '.user_accounts' data/users.json)"

          curl -X PUT http://localhost:8181/v1/data/roles \
            -H "Content-Type: application/json" \
            -d "$(jq '.roles' data/users.json)"

          curl -X PUT http://localhost:8181/v1/data/departments \
            -H "Content-Type: application/json" \
            -d "$(jq '.departments' data/users.json)"

          echo "OPA data loaded successfully"

      - name: Run API server in background
        working-directory: ./projects/consumer-accounts-internal-api
        run: |
          bun run start &
          API_PID=$!
          echo "API PID: $API_PID"

          # Wait for API to be healthy
          timeout 30 bash -c 'until curl -s http://localhost:3001/health > /dev/null; do sleep 1; done' || (echo "API failed to start" && exit 1)
          echo "API server started successfully"
        env:
          NODE_ENV: test
          OPA_URL: http://localhost:8181

      - name: Verify services are ready
        run: |
          echo "Checking OPA health..."
          curl -v http://localhost:8181/health || echo "OPA health check failed"

          echo "Checking API health..."
          curl -v http://localhost:3001/health || echo "API health check failed"

          echo "Checking OPA data..."
          curl -s http://localhost:8181/v1/data/users | jq '.' || echo "OPA data check failed"

      - name: Run OPA integration tests
        working-directory: ./projects/consumer-accounts-internal-api
        run: bun run test:opa

  # Container builds for changed components
  build-containers:
    name: Build Containers
    runs-on: ubuntu-latest
    needs: detect-changes
    if: |
      needs.detect-changes.outputs.api == 'true' ||
      needs.detect-changes.outputs.app == 'true' ||
      needs.detect-changes.outputs.root == 'true'
    strategy:
      matrix:
        include:
          - component: api
            condition: ${{ needs.detect-changes.outputs.api == 'true' || needs.detect-changes.outputs.root == 'true' }}
            context: .
            dockerfile: ./projects/consumer-accounts-internal-api/Dockerfile
          - component: app
            condition: ${{ needs.detect-changes.outputs.app == 'true' || needs.detect-changes.outputs.root == 'true' }}
            context: .
            dockerfile: ./projects/consumer-accounts-internal-app/Dockerfile
    steps:
      - name: Checkout code
        if: matrix.condition
        uses: actions/checkout@v4

      - name: Set up Docker Buildx
        if: matrix.condition
        uses: docker/setup-buildx-action@v3

      - name: Debug - Verify repository structure
        if: matrix.condition
        run: |
          echo "=== Building ${{ matrix.component }} ==="
          echo "Context: ${{ matrix.context }}"
          echo "Dockerfile: ${{ matrix.dockerfile }}"
          echo ""
          echo "=== Current directory ==="
          pwd
          echo ""
          echo "=== Root directory contents ==="
          ls -la
          echo ""
          echo "=== Projects directory ==="
          ls -la projects/ || echo "projects/ directory not found!"
          echo ""
          echo "=== ${{ matrix.component }} project ==="
          ls -la projects/consumer-accounts-internal-${{ matrix.component }}/ || echo "${{ matrix.component }} directory not found!"

      - name: Build container image
        if: matrix.condition
        uses: docker/build-push-action@v5
        with:
          context: ${{ matrix.context }}
          file: ${{ matrix.dockerfile }}
          tags: ea-financial/${{ matrix.component }}:test-${{ github.sha }}
          push: false
          load: true
          cache-from: type=gha,scope=${{ matrix.component }}
          cache-to: type=gha,mode=max,scope=${{ matrix.component }}

      - name: Test container startup
        if: matrix.condition
        run: |
          # Test that the container can start successfully
          echo "Starting ${{ matrix.component }} container..."
          CONTAINER_ID=$(docker run -d --name test-${{ matrix.component }} \
            ea-financial/${{ matrix.component }}:test-${{ github.sha }})
          echo "Container ID: $CONTAINER_ID"

          # Wait a moment for container to initialize
          sleep 5

          # Check if container is still running (didn't crash)
          CONTAINER_STATUS=$(docker inspect --format='{{.State.Status}}' $CONTAINER_ID)
          if [ "$CONTAINER_STATUS" = "running" ]; then
            echo "✅ ${{ matrix.component }} container started successfully"
            docker stop test-${{ matrix.component }}
            docker rm test-${{ matrix.component }}
          else
            echo "❌ ${{ matrix.component }} container failed to start (status: $CONTAINER_STATUS)"
            echo "Container logs:"
            docker logs test-${{ matrix.component }} 2>&1 || echo "Could not retrieve logs"
            echo "Container status details:"
            docker inspect $CONTAINER_ID | jq '.[0].State' || true
            docker rm test-${{ matrix.component }} 2>/dev/null || true
            exit 1
          fi

  # Documentation checks
  check-documentation:
    name: Check Documentation
    runs-on: ubuntu-latest
    needs: detect-changes
    if: needs.detect-changes.outputs.docs == 'true'
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Setup Environment
        uses: ./.github/actions/setup-environment
      - name: Install markdown linter
        run: bun install -g markdownlint-cli

      - name: Lint markdown files
        run: bunx markdownlint **/*.md --ignore node_modules

      - name: Check for broken links
        run: |
          bunx markdown-link-check README.md
          find . -name "*.md" -not -path "./node_modules/*" -not -name "README.md" | head -5 | xargs -I {} bunx markdown-link-check {}

      - name: Validate README structure
        run: |
          if [ ! -f "README.md" ]; then
            echo "Missing root README.md"
            exit 1
          fi

          if [ ! -f "projects/consumer-accounts-internal-api/README.md" ]; then
            echo "Missing API README.md"
            exit 1
          fi

          if [ ! -f "projects/consumer-accounts-internal-app/README.md" ]; then
            echo "Missing App README.md"
            exit 1
          fi

  # Security scan for changed components
  security-scan-changes:
    name: Security Scan Changes
    runs-on: ubuntu-latest
    needs: detect-changes
    if: |
      needs.detect-changes.outputs.api == 'true' ||
      needs.detect-changes.outputs.app == 'true' ||
      needs.detect-changes.outputs.root == 'true'
    permissions:
      contents: read
      security-events: write
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Run Trivy filesystem scan
        uses: aquasecurity/trivy-action@v0.35.0
        with:
          scan-type: "fs"
          scan-ref: "."
          format: "sarif"
          output: "trivy-results.sarif"
          severity: "CRITICAL,HIGH"

      - name: Upload Trivy scan results
        uses: github/codeql-action/upload-sarif@v3
        if: always()
        with:
          sarif_file: "trivy-results.sarif"

      - name: Check for sensitive files
        run: |
          echo "Checking for accidentally committed sensitive files..."
          if find . -name "*.pem" -o -name "*.key" -o -name "*.p12" -o -name "*.jks" | grep -v node_modules; then
            echo "❌ Potential sensitive files found!"
            exit 1
          fi
          echo "✅ No sensitive files detected"

  # Performance impact analysis
  performance-impact:
    name: Performance Impact Analysis
    runs-on: ubuntu-latest
    needs: [detect-changes, test-api]
    if: needs.detect-changes.outputs.api == 'true' && needs.test-api.result == 'success'
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Setup Environment
        uses: ./.github/actions/setup-environment

      - name: Start API server
        working-directory: ./projects/consumer-accounts-internal-api
        run: |
          bun run start &
          sleep 10
        env:
          NODE_ENV: test

      - name: Install Artillery
        run: bun install -g artillery@latest

      - name: Run lightweight performance test
        run: |
          cat > quick-perf-test.yml << 'EOF'
          config:
            target: 'http://localhost:3001'
            phases:
              - duration: 30
                arrivalRate: 5
          scenarios:
            - name: "Quick health check"
              flow:
                - get:
                    url: "/health"
          EOF

          artillery run quick-perf-test.yml --output perf-results.json

      - name: Analyze performance results
        run: |
          artillery report perf-results.json --output perf-report.html

          # Extract key metrics and comment on PR if significant changes
          echo "Performance test completed. Check artifacts for detailed report."

      - name: Upload performance report
        uses: actions/upload-artifact@v4
        with:
          name: performance-impact-${{ github.sha }}
          path: perf-report.html

  # Summary job
  path-based-testing-summary:
    name: Path-based Testing Summary
    runs-on: ubuntu-latest
    needs:
      [
        detect-changes,
        test-api,
        test-app,
        test-infrastructure,
        test-opa-policies,
        build-containers,
        check-documentation,
        security-scan-changes,
        performance-impact,
      ]
    if: always()
    steps:
      - name: Generate summary
        run: |
          echo "## Path-based Testing Summary" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "### Changes Detected:" >> $GITHUB_STEP_SUMMARY
          echo "- API: ${{ needs.detect-changes.outputs.api }}" >> $GITHUB_STEP_SUMMARY
          echo "- App: ${{ needs.detect-changes.outputs.app }}" >> $GITHUB_STEP_SUMMARY
          echo "- Infrastructure: ${{ needs.detect-changes.outputs.infra }}" >> $GITHUB_STEP_SUMMARY
          echo "- OPA Policies: ${{ needs.detect-changes.outputs.opa }}" >> $GITHUB_STEP_SUMMARY
          echo "- K8s: ${{ needs.detect-changes.outputs.k8s }}" >> $GITHUB_STEP_SUMMARY
          echo "- Documentation: ${{ needs.detect-changes.outputs.docs }}" >> $GITHUB_STEP_SUMMARY
          echo "- Root files: ${{ needs.detect-changes.outputs.root }}" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "### Test Results:" >> $GITHUB_STEP_SUMMARY
          echo "- API Tests: ${{ needs.test-api.result || 'skipped' }}" >> $GITHUB_STEP_SUMMARY
          echo "- App Tests: ${{ needs.test-app.result || 'skipped' }}" >> $GITHUB_STEP_SUMMARY
          echo "- Infrastructure Tests: ${{ needs.test-infrastructure.result || 'skipped' }}" >> $GITHUB_STEP_SUMMARY
          echo "- OPA Policy Tests: ${{ needs.test-opa-policies.result || 'skipped' }}" >> $GITHUB_STEP_SUMMARY
          echo "- Container Builds: ${{ needs.build-containers.result || 'skipped' }}" >> $GITHUB_STEP_SUMMARY
          echo "- Documentation Checks: ${{ needs.check-documentation.result || 'skipped' }}" >> $GITHUB_STEP_SUMMARY
          echo "- Security Scan: ${{ needs.security-scan-changes.result || 'skipped' }}" >> $GITHUB_STEP_SUMMARY
          echo "- Performance Impact: ${{ needs.performance-impact.result || 'skipped' }}" >> $GITHUB_STEP_SUMMARY

      - name: Check critical failures
        run: |
          if [[ "${{ needs.test-api.result }}" == "failure" ||
                "${{ needs.test-app.result }}" == "failure" ||
                "${{ needs.security-scan-changes.result }}" == "failure" ]]; then
            echo "❌ Critical tests failed!"
            exit 1
          else
            echo "✅ All critical path-based tests passed or were skipped appropriately"
          fi