ci.yml

name: CI

on:
  push:
    branches: ["**"]
  pull_request:

jobs:
  build:
    runs-on: ubuntu-latest
    env:
      # Prisma client generation needs no live DB; build must not run migrations in CI.
      DATABASE_URL: "postgresql://user:pass@localhost:5432/db"
    steps:
      - uses: actions/checkout@v7
      - uses: actions/setup-node@v7
        with:
          node-version: 20
          cache: npm
      - run: npm ci
      - name: Prisma generate
        run: npx prisma generate
      - name: Typecheck
        run: npx tsc --noEmit
      - name: Lint
        run: npm run lint
      - name: Doc links (exact case, as GitHub resolves them)
        run: node scripts/check-doc-links.mjs .
      - name: Unit tests + coverage
        run: npm run test:coverage
      - name: MCP bundle freshness (shipped artifact matches source)
        # Sprint Fearless P3: the npm-published bundle is committed, so it can
        # silently drift from mcp-server.ts (0.3.0 shipped months of missing
        # source this way — caught in #106). Rebuild and require a clean diff.
        run: |
          npm run build:mcp
          git add -N packages/
          git diff --exit-code packages/
      - name: Dependency audit (high+)
        run: npm audit --audit-level=high
        continue-on-error: true

  db-tests:
    # DB-backed regression net (budget-leak concurrency + end-to-end data-plane
    # flow, and RLS isolation when that lands). Runs against an ephemeral Postgres
    # service on EVERY push/PR — no external secret required, so these guarantees
    # always gate.
    runs-on: ubuntu-latest
    services:
      postgres:
        image: postgres:16
        env:
          POSTGRES_PASSWORD: postgres
          POSTGRES_DB: sanction
        ports: ["5432:5432"]
        options: >-
          --health-cmd "pg_isready -U postgres"
          --health-interval 5s
          --health-timeout 5s
          --health-retries 10
    env:
      DATABASE_URL: "postgresql://postgres:postgres@localhost:5432/sanction"
      # Deterministic non-production secrets; the DB tests need these to encrypt
      # seed credentials and sign execution JWTs.
      SANCTION_CREDENTIAL_ENCRYPTION_KEY: "Y2ktdGVzdC1lbmNyeXB0aW9uLWtleS1ub3QtcHJvZA=="
      SANCTION_SIGNING_SECRET: "Y2ktdGVzdC1zaWduaW5nLXNlY3JldC1ub3QtcHJvZA=="
    steps:
      - uses: actions/checkout@v7
      - uses: actions/setup-node@v7
        with:
          node-version: 20
          cache: npm
      - run: npm ci
      - name: Prisma generate
        run: npx prisma generate
      - name: Apply migrations
        run: npx prisma migrate deploy
      - name: DB tests (concurrency + e2e data plane)
        run: npm run test:db