ci.yml

# =============================================================
# CI & Security Analysis
#
# Primary pipeline for code quality and security.
# Triggers on:
#   - Push to main (excluding docs/meta)
#   - Pull Requests to main
#
# Jobs are optimized to run only when relevant files change
# to save GitHub Actions minutes (Free Tier friendly).
# =============================================================

name: CI & Security Analysis ⚡️

on:
  push:
    branches: [main]
    paths-ignore:
      # Documentation
      - 'docs/**'
      - 'mkdocs.yml'
      - 'assets/**'
      # Markdown (community health & repo meta)
      - '*.md'
      - '.github/ISSUE_TEMPLATE/**'
      - '.github/PULL_REQUEST_TEMPLATE.md'
      - '.github/FUNDING.yml'
      - '.github/CODEOWNERS'
      # API client collections
      - 'bruno/**'
      # Editor & IDE configs
      - '.vscode/**'
      - '.editorconfig'
      # Environment examples & secrets config
      - '.env.example'
      - '.gitleaks.toml'
      # Dependency management (Renovate handles PRs; not build-relevant)
      - 'renovate.json'
      # Changelog & release tooling config
      - 'cliff.toml'
      # Git hooks config (local-only)
      - 'lefthook.yml'
  pull_request:
    branches: [main]

concurrency:
  # Ensure only one CI run per branch/PR at a time
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: read

env:
  NODE_VERSION: 24
  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true

jobs:
  # ─── CHANGE DETECTION ────────────────────────────────────────
  # Determines which jobs actually need to run based on changed files.
  changes:
    name: Detect Changes 🔍
    runs-on: ubuntu-latest
    outputs:
      src: ${{ steps.filter.outputs.src }}
      deps: ${{ steps.filter.outputs.deps }}
      lint: ${{ steps.filter.outputs.lint }}
      workflows: ${{ steps.filter.outputs.workflows }}
      docs: ${{ steps.filter.outputs.docs }}
    steps:
      - name: Harden Runner 🛡️
        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
        with:
          egress-policy: audit

      - name: Checkout 📥
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false

      - uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1
        id: filter
        with:
          filters: |
            src:
              - 'src/**'
              - 'test/**'
              - 'prisma/**'
              - 'vitest.config.ts'
            deps:
              - 'pnpm-lock.yaml'
              - 'package.json'
            lint:
              - 'eslint.config.mjs'
              - '.eslintignore'
              - 'tsconfig.json'
            workflows:
              - '.github/workflows/**'
              - '.github/actions/**'
            docs:
              - 'docs/**'
              - '*.md'

  # ─── QUALITY ASSURANCE ───────────────────────────────────────
  # Consolidated into one job to save runner overhead (VM startup + redundant pnpm install).
  # Tasks run in parallel within the runner to maximize CPU utilization.
  hygiene:
    name: Hygiene & Security 🧼🛡️
    needs: changes
    if: needs.changes.outputs.src == 'true' || needs.changes.outputs.lint == 'true' || needs.changes.outputs.deps == 'true' || needs.changes.outputs.workflows == 'true' || needs.changes.outputs.docs == 'true'
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - name: Harden Runner 🛡️
        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
        with:
          egress-policy: audit

      - name: Checkout 📥
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false

      - name: Install pnpm 📦
        uses: pnpm/action-setup@739bfe42ca9233c5e6aca07c1a25a9d34aca49b0 # v6.0.7

      - name: Setup Node.js 🟢
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: 'pnpm'

      - name: Install dependencies 🛠️
        timeout-minutes: 5
        run: pnpm install --frozen-lockfile --prefer-offline --ignore-scripts

      - name: Cache Prisma Client 💎
        id: cache-prisma
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: node_modules/.prisma
          key: ${{ runner.os }}-prisma-${{ hashFiles('prisma/schema.prisma') }}

      - name: Validate & Generate Prisma client 💎
        if: steps.cache-prisma.outputs.cache-hit != 'true'
        run: |
          npx prisma validate
          pnpm db:generate

      - name: Run Quality Checks ⚡️
        id: run_checks
        run: |
          echo "::group::Starting Parallel Checks"

          # Initialize error tracking
          mkdir -p .ci-status

          # 1. Build
          (pnpm build > .ci-status/build.log 2>&1 || echo "1" > .ci-status/build.fail) & pid_build=$!

          # 2. Unit Tests
          if [ -d "src" ] && find src -name "*.spec.ts" | grep -q "."; then
            (pnpm test:cov > .ci-status/test.log 2>&1 || echo "1" > .ci-status/test.fail) &
            echo "tests_ran=true" >> "$GITHUB_OUTPUT"
          else
            echo "tests_ran=false" >> "$GITHUB_OUTPUT"
          fi

          # 3. TS Lint
          (pnpm lint:ts > .ci-status/lint-ts.log 2>&1 || echo "1" > .ci-status/lint-ts.fail) &

          # 4. Format Check
          (pnpm format:check > .ci-status/format.log 2>&1 || echo "1" > .ci-status/format.fail) &

          # 5. MD Lint
          (pnpm lint:md > .ci-status/lint-md.log 2>&1 || echo "1" > .ci-status/lint-md.fail) &

          # 6. OSV Scanner
          curl -L https://github.com/google/osv-scanner/releases/download/v2.3.5/osv-scanner_linux_amd64 -o osv-scanner
          chmod +x osv-scanner
          (./osv-scanner --lockfile=pnpm-lock.yaml > .ci-status/osv.log 2>&1 || echo "1" > .ci-status/osv.fail) &



          echo "All checks started. Waiting for completion..."
          wait
          echo "::endgroup::"

          # Report Results
          EXIT_CODE=0

          for log in .ci-status/*.log; do
            job=$(basename "$log" .log)
            if [ -f ".ci-status/$job.fail" ]; then
              echo "::error::❌ $job failed"
              cat "$log"
              EXIT_CODE=1
            else
              echo "✅ $job passed"
            fi
          done

          exit $EXIT_CODE

      - name: Upload coverage to Codecov 📊
        if: steps.run_checks.outputs.tests_ran == 'true'
        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
        with:
          token: ${{ secrets.CODECOV_TOKEN }}
          files: ./coverage/lcov.info
          fail_ci_if_error: false

  secret_scan:
    name: Secret Scan 🔑
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
      - name: Harden Runner 🛡️
        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
        with:
          egress-policy: audit

      - name: Checkout 📥
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          fetch-depth: 0
          persist-credentials: false
      - name: Run Gitleaks 🕵️
        uses: gitleaks/gitleaks-action@e0c47f4f8be36e29cdc102c57e68cb5cbf0e8d1e # v3.0.0
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}