ci.yml

name: CI

on:
  push:
    branches: [main, preview]
  pull_request:
    branches: [main, preview]

permissions:
  contents: read

jobs:
  verify:
    name: verify
    runs-on: ubuntu-latest
    timeout-minutes: 20
    steps:
      - name: Check out repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0

      - name: Set up Node.js
        if: ${{ hashFiles('package-lock.json') != '' }}
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: 24
          cache: npm

      - name: Install locked dependencies
        if: ${{ hashFiles('package-lock.json') != '' }}
        run: npm ci

      - name: Verify source and build
        if: ${{ hashFiles('package-lock.json') != '' }}
        run: npm run verify
        env:
          SECURITY_CHECK_HISTORY: "1"

      - name: Validate release metadata baseline
        if: ${{ hashFiles('package-lock.json') != '' }}
        run: npm run release:check

      - name: Audit dependencies
        if: ${{ hashFiles('package-lock.json') != '' }}
        run: npm audit --audit-level=high
      - name: Start local Supabase
        shell: bash
        run: |
          for attempt in 1 2 3; do
            if npx supabase start --output env > "$RUNNER_TEMP/supabase-start.env" 2> "$RUNNER_TEMP/supabase-start.log"; then
              echo "Local Supabase started."
              exit 0
            fi
            echo "Supabase start failed (attempt $attempt/3)."
            cat "$RUNNER_TEMP/supabase-start.log"
            if [ "$attempt" -lt 3 ]; then sleep 30; fi
          done
          exit 1
      - name: Configure local Supabase for E2E
        shell: bash
        run: |
          status="$(npx supabase status --output env 2>/dev/null)"
          api_url="$(printf '%s\n' "$status" | sed -n 's/^API_URL=//p' | tr -d '"')"
          db_url="$(printf '%s\n' "$status" | sed -n 's/^DB_URL=//p' | tr -d '"')"
          publishable_key="$(printf '%s\n' "$status" | sed -n 's/^ANON_KEY=//p' | tr -d '"')"
          test -n "$api_url"
          test -n "$db_url"
          test -n "$publishable_key"
          echo "VITE_SUPABASE_URL=$api_url" >> "$GITHUB_ENV"
          echo "SHADOW_MATE_TEST_DB_URL=$db_url" >> "$GITHUB_ENV"
          echo "VITE_SUPABASE_PUBLISHABLE_KEY=$publishable_key" >> "$GITHUB_ENV"
          echo "E2E_REAL_SUPABASE=1" >> "$GITHUB_ENV"
      - name: Run database tests
        run: npm run test:db
      - name: Lint database schema
        run: npx supabase db lint --local --schema public --level warning --fail-on error
      - name: Serve account deletion function
        shell: bash
        run: |
          npx supabase functions serve delete-account > "$RUNNER_TEMP/delete-account-function.log" 2>&1 &
          api_url="$(npx supabase status --output env 2>/dev/null | sed -n 's/^API_URL=//p' | tr -d '"')"
          test -n "$api_url"
          for attempt in {1..30}; do
            if curl --fail --silent --output /dev/null -X OPTIONS "$api_url/functions/v1/delete-account"; then
              exit 0
            fi
            sleep 1
          done
          cat "$RUNNER_TEMP/delete-account-function.log"
          exit 1
      - name: Test account deletion isolation guard
        run: npm run test:functions
      - name: Install Playwright browsers
        run: npx playwright install --with-deps chromium

      - name: Run E2E tests
        run: npm run test:e2e