ci.yml

name: CI

on:
  push:
    branches: [ main ]
  pull_request:
    branches: [ main ]
  workflow_dispatch:

# Default: safe for fork PRs
permissions:
  contents: read
  pull-requests: read
  security-events: write

jobs:
  changes:
    runs-on: ubuntu-latest
    outputs:
      backend: ${{ steps.filter.outputs.backend }}
      frontend: ${{ steps.filter.outputs.frontend }}
      extensions_backend: ${{ steps.filter.outputs.extensions_backend }}
      extensions_frontend: ${{ steps.filter.outputs.extensions_frontend }}
      migrations: ${{ steps.filter.outputs.migrations }}
      docker_m8flow: ${{ steps.filter.outputs.docker_m8flow }}
    steps:
      - uses: actions/checkout@v4
      - uses: dorny/paths-filter@v2
        id: filter
        with:
          filters: |
            backend:
              - 'spiffworkflow-backend/**'
            frontend:
              - 'spiffworkflow-frontend/**'
            extensions_backend:
              - 'extensions/m8flow-backend/**'
              - 'spiffworkflow-backend/**'
            extensions_frontend:
              - 'extensions/frontend/**'
            migrations:
              - 'spiffworkflow-backend/migrations/versions/*.py'
            docker_m8flow:
              - 'docker/**'
              - 'm8flow-connector-proxy/**'

  # -------------------------
  # Backend CI
  # -------------------------
  backend:
    needs: changes
    if: ${{ needs.changes.outputs.backend == 'true' }}
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: spiffworkflow-backend
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: '3.11'
      - name: Install uv
        run: pip install uv
      - name: Install dependencies
        run: uv sync --group dev
      - name: Lint with Ruff
        run: uv run ruff check .
      - name: Type check with MyPy
        run: uv run mypy .
      - name: Test with Pytest
        run: uv run pytest

  # -------------------------
  # Frontend CI
  # -------------------------
  frontend:
    needs: changes
    if: ${{ needs.changes.outputs.frontend == 'true' }}
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: spiffworkflow-frontend
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: '20'
          cache: 'npm'
          cache-dependency-path: spiffworkflow-frontend/package-lock.json
      - name: Install dependencies
        run: npm ci
      - name: Lint
        run: npm run lint
      - name: Test
        run: npm test

  # -------------------------
  # Extensions Backend CI
  # -------------------------
  extensions-backend:
    needs: changes
    if: ${{ needs.changes.outputs.extensions_backend == 'true' }}
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: spiffworkflow-backend
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: '3.11'
      - name: Install uv
        run: pip install uv
      - name: Install dependencies
        run: uv sync --group dev
      - name: Run Extension Tests
        run: |
          export PYTHONPATH=$PYTHONPATH:$(pwd):$(pwd)/src:$(pwd)/../extensions/m8flow-backend/src
          uv run pytest ../extensions/m8flow-backend/tests

  # -------------------------
  # Extensions Frontend CI
  # -------------------------
  extensions-frontend:
    needs: changes
    if: ${{ needs.changes.outputs.extensions_frontend == 'true' }}
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: extensions/frontend
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: '20'
          cache: 'npm'
          cache-dependency-path: extensions/frontend/package-lock.json
      - name: Install dependencies
        run: npm ci
      - name: Typecheck
        run: npm run typecheck
      - name: Test
        run: npm test

  # -------------------------
  # Security: CodeQL
  # -------------------------
  codeql:
    name: CodeQL Scan
    runs-on: ubuntu-latest
    if: ${{ github.event_name == 'pull_request' }}
    strategy:
      matrix:
        language: [ 'python', 'javascript' ]
    steps:
      - uses: actions/checkout@v4
      - uses: github/codeql-action/init@v3
        with:
          languages: ${{ matrix.language }}
      - name: Autobuild
        uses: github/codeql-action/autobuild@v3
      - uses: github/codeql-action/analyze@v3

  # -------------------------
  # Security: Trivy (filesystem scan)
  # -------------------------
  trivy:
    name: Trivy Security Scan
    runs-on: ubuntu-latest
    if: ${{ github.event_name == 'pull_request' }}
    steps:
      - uses: actions/checkout@v4
      - uses: aquasecurity/trivy-action@0.20.0
        with:
          scan-type: fs
          severity: CRITICAL,HIGH
          exit-code: 1
          ignore-unfixed: true
          skip-files: spiffworkflow-backend/src/spiffworkflow_backend/config/openid/rsa_keys.py

  # -------------------------
  # Migration Compatibility Check
  # -------------------------
  migration-check:
    name: Migration Compatibility Check
    needs: changes
    if: ${{ needs.changes.outputs.migrations == 'true' && github.event_name == 'pull_request' }}
    uses: ./.github/workflows/check-migrations.yml
    with:
      migrations_changed: true

  # -------------------------
  # Optional Docker Build Dry Run
  # -------------------------
  docker-dry-run:
    name: Docker Build Dry Run
    needs: changes
    runs-on: ubuntu-latest
    if: ${{ (needs.changes.outputs.backend == 'true' || needs.changes.outputs.frontend == 'true' || needs.changes.outputs.extensions_backend == 'true' || needs.changes.outputs.docker_m8flow == 'true') && github.event_name == 'pull_request' }}
    steps:
      - uses: actions/checkout@v4
      - uses: docker/setup-buildx-action@v3
      - name: Backend image build (no push)
        run: |
          docker buildx build \
            --file docker/m8flow.backend.Dockerfile \
            --tag backend:pr-test \
            --load \
            .
      - name: Frontend image build (no push)
        run: |
          docker buildx build \
            --file docker/m8flow.frontend.Dockerfile \
            --tag frontend:pr-test \
            --load \
            .
      - name: Keycloak image build (no push)
        run: |
          docker buildx build \
            --file docker/m8flow.keycloak.Dockerfile \
            --tag keycloak:pr-test \
            --load \
            .
      - name: Connector-proxy image build (no push)
        run: |
          docker buildx build \
            --file m8flow-connector-proxy/Dockerfile \
            --tag connector-proxy:pr-test \
            --load \
            m8flow-connector-proxy