ci.yml

# .github/workflows/ci.yml
#
# GalaxyQuest — Main CI/CD Pipeline
#
# Runs on every push to main and on every pull request targeting main.
#
# Jobs:
#   lint-php         — PHP linting with custom architecture rules
#   lint-js          — ESLint with Galaxy architecture rules
#   phpunit          — PHPUnit unit tests (PHP 8.2 + MySQL 8.4 service)
#   vitest           — Vitest JavaScript unit tests
#   playwright-smoke — Playwright end-to-end smoke test (full Docker stack)
#   docker-build     — Build & push versioned Docker image to GHCR (main only)

name: CI/CD Pipeline

on:
  push:
    branches:
      - main
      - master
  pull_request:
    branches:
      - main
      - master

# Default: restrict all jobs to read-only access; individual jobs that need
# extra permissions (e.g. docker-build → packages: write) override this.
permissions:
  contents: read

jobs:
  # ── PHP Architecture Linting ────────────────────────────────────────────────
  lint-php:
    name: PHP Architecture Validation
    runs-on: ubuntu-latest
    permissions:
      contents: read

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Set up PHP 8.2
        uses: shivammathur/setup-php@v2
        with:
          php-version: '8.2'
          extensions: pdo, pdo_sqlite
          coverage: none

      - name: Install PHP CodeSniffer
        run: composer require --dev squizlabs/php_codesniffer --prefer-dist --no-interaction

      - name: Validate PHP architecture with custom ruleset
        run: vendor/bin/phpcs --standard=ruleset.xml src/ tests/ --exclude=tests/bootstrap.php
        continue-on-error: true

  # ── JavaScript Architecture Linting ─────────────────────────────────────────
  lint-js:
    name: JavaScript Architecture Validation
    runs-on: ubuntu-latest
    permissions:
      contents: read

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Set up Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '20'
          cache: 'npm'

      - name: Install dependencies
        run: npm ci

      - name: Validate JavaScript architecture with custom ESLint config
        run: npx eslint js/features/galaxy/ --config .eslintrc.galaxy.js --format=stylish || echo "Note: ESLint validation completed (warnings/errors logged)"

  # ── PHP Unit Tests ──────────────────────────────────────────────────────────
  phpunit:
    name: PHPUnit Tests
    runs-on: ubuntu-latest
    permissions:
      contents: read

    services:
      mysql:
        image: mysql:8.4
        env:
          MYSQL_DATABASE: galaxyquest
          MYSQL_USER: galaxyquest_user
          MYSQL_PASSWORD: galaxyquest_dev
          MYSQL_ROOT_PASSWORD: root
        ports:
          - 3306:3306
        options: >-
          --health-cmd="mysqladmin ping -h localhost -proot"
          --health-interval=5s
          --health-timeout=5s
          --health-retries=20

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Set up PHP 8.2
        uses: shivammathur/setup-php@v2
        with:
          php-version: '8.2'
          extensions: pdo_mysql, gd
          coverage: none

      - name: Install Composer dependencies
        run: composer install --no-interaction --prefer-dist --no-progress

      - name: Initialise database schema and migrations
        run: |
          mysql -h 127.0.0.1 -u galaxyquest_user -pgalaxquest_dev galaxyquest \
            < sql/schema.sql
          # Apply all incremental migration files in alphabetical order so
          # that new migrations are picked up automatically.
          for f in sql/migrate_*.sql; do
            [ -e "$f" ] || continue
            echo "Applying $f …"
            mysql -h 127.0.0.1 -u galaxyquest_user -pgalaxquest_dev galaxyquest < "$f"
          done

      - name: Run PHPUnit
        env:
          DB_HOST: 127.0.0.1
          DB_PORT: 3306
          DB_NAME: galaxyquest
          DB_USER: galaxyquest_user
          DB_PASS: galaxyquest_dev
        run: vendor/bin/phpunit --no-coverage

  # ── JavaScript Unit Tests ───────────────────────────────────────────────────
  vitest:
    name: Vitest Unit Tests
    runs-on: ubuntu-latest
    permissions:
      contents: read

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Set up Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '20'
          cache: 'npm'

      - name: Install dependencies
        run: npm ci

      - name: Run Vitest
        run: npx vitest run --reporter=verbose

  # ── End-to-End Smoke Test ───────────────────────────────────────────────────
  playwright-smoke:
    name: Playwright E2E Smoke Test
    runs-on: ubuntu-latest
    permissions:
      contents: read

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Set up Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '20'
          cache: 'npm'

      - name: Install dependencies
        run: npm ci

      - name: Install Playwright Chromium browser
        run: npx playwright install chromium --with-deps

      - name: Start application stack (web + db + tts)
        run: docker compose up -d --wait
        timeout-minutes: 10

      - name: Seed E2E test user
        run: |
          docker compose exec -T web php scripts/ensure_default_e2e_user.php \
            --username=default_user \
            --password=User!23456 \
            --email=default_user@local.test

      - name: Run view-flow smoke test
        env:
          GQ_BASE_URL: http://localhost:8080
        run: |
          npx playwright test tests/e2e/view-flow.spec.js \
            --reporter=list \
            --project=chromium

      - name: Upload Playwright report on failure
        if: failure()
        uses: actions/upload-artifact@v4
        with:
          name: playwright-smoke-report
          path: playwright-report/
          retention-days: 7

  docker-build:
    name: Build & Publish Docker Image
    runs-on: ubuntu-latest
    # Only publish images for pushes to main (not PRs)
    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
    needs: [phpunit, vitest]

    permissions:
      contents: read
      packages: write

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Log in to GitHub Container Registry
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Extract Docker metadata
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: ghcr.io/${{ github.repository }}
          tags: |
            type=sha,prefix=sha-
            type=ref,event=branch
            type=raw,value=latest,enable={{is_default_branch}}

      - name: Build and push Docker image
        uses: docker/build-push-action@v6
        with:
          context: .
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}