ci.yml

name: CI

on:
  push:
    branches: [ main, develop ]
  pull_request:
    branches: [ main, develop ]

env:
  PHP_VERSION: '8.1'
  REGISTRY: ghcr.io
  IMAGE_NAME: ${{ github.repository }}

jobs:
  test:
    name: Test
    runs-on: ubuntu-latest
    
    services:
      mysql:
        image: mysql:8.0
        env:
          MYSQL_ROOT_PASSWORD: root
          MYSQL_DATABASE: rechain_dao_test
        options: >-
          --health-cmd="mysqladmin ping"
          --health-interval=10s
          --health-timeout=5s
          --health-retries=3
        ports:
          - 3306:3306
      
      redis:
        image: redis:7-alpine
        options: >-
          --health-cmd="redis-cli ping"
          --health-interval=10s
          --health-timeout=5s
          --health-retries=3
        ports:
          - 6379:6379

    steps:
    - name: Checkout code
      uses: actions/checkout@v6

    - name: Setup PHP
      uses: shivammathur/setup-php@v2
      with:
        php-version: ${{ env.PHP_VERSION }}
        extensions: mbstring, xml, curl, json, pdo, pdo_mysql, redis
        coverage: xdebug

    - name: Install Composer dependencies
      run: composer install --prefer-dist --no-progress --no-interaction

    - name: Lint PHP code
      run: composer run lint

    - name: Static analysis
      run: composer run analyze

    - name: Run PHPUnit tests
      run: composer run test
      env:
        DB_HOST: localhost
        DB_PORT: 3306
        DB_NAME: rechain_dao_test
        DB_USER: root
        DB_PASSWORD: root
        REDIS_HOST: localhost
        REDIS_PORT: 6379

    - name: Run PHPUnit integration tests
      run: composer run test:integration
      env:
        DB_HOST: localhost
        DB_PORT: 3306
        DB_NAME: rechain_dao_test
        DB_USER: root
        DB_PASSWORD: root
        REDIS_HOST: localhost
        REDIS_PORT: 6379

    - name: Upload coverage
      uses: codecov/codecov-action@v5
      with:
        file: ./coverage.xml

  build:
    name: Build
    runs-on: ubuntu-latest
    needs: test
    if: github.event_name == 'push'

    steps:
    - name: Checkout code
      uses: actions/checkout@v6

    - name: Setup PHP
      uses: shivammathur/setup-php@v2
      with:
        php-version: ${{ env.PHP_VERSION }}
        extensions: mbstring, xml, curl, json, pdo, pdo_mysql, redis

    - name: Install Composer dependencies
      run: composer install --prefer-dist --no-progress --no-interaction --no-dev

    - name: Prepare production build
      run: |
        # Remove development files and optimize autoloader
        composer dump-autoload --optimize --no-dev
        # Remove unnecessary files for production
        rm -rf tests/ vendor/bin/ .github/ docs/

    - name: Create artifacts
      run: |
        mkdir -p artifacts
        cp -r src/ artifacts/
        cp -r templates/ artifacts/
        cp -r public/ artifacts/
        cp composer.json artifacts/
        cp composer.lock artifacts/
        tar -czf artifacts.tar.gz artifacts/

    - name: Upload artifacts
      uses: actions/upload-artifact@v6
      with:
        name: build-artifacts
        path: artifacts.tar.gz

  docker:
    name: Docker
    runs-on: ubuntu-latest
    needs: test
    if: github.event_name == 'push'

    steps:
    - name: Checkout code
      uses: actions/checkout@v6

    - name: Setup Docker Buildx
      uses: docker/setup-buildx-action@v3

    - name: Login to registry
      uses: docker/login-action@v3
      with:
        registry: ${{ env.REGISTRY }}
        username: ${{ github.actor }}
        password: ${{ secrets.GITHUB_TOKEN }}

    - name: Extract metadata
      id: meta
      uses: docker/metadata-action@v5
      with:
        images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
        tags: |
          type=ref,event=branch
          type=ref,event=pr
          type=sha,prefix={{branch}}-
          type=raw,value=latest,enable={{is_default_branch}}

    - name: Build and push Docker image
      uses: docker/build-push-action@v6
      with:
        context: .
        push: true
        tags: ${{ steps.meta.outputs.tags }}
        labels: ${{ steps.meta.outputs.labels }}
        cache-from: type=gha
        cache-to: type=gha,mode=max

  security:
    name: Security
    runs-on: ubuntu-latest
    needs: test

    steps:
    - name: Checkout code
      uses: actions/checkout@v6

    - name: Setup PHP
      uses: shivammathur/setup-php@v2
      with:
        php-version: ${{ env.PHP_VERSION }}
        extensions: mbstring, xml, curl, json, pdo, pdo_mysql, redis

    - name: Install Composer dependencies
      run: composer install --prefer-dist --no-progress --no-interaction

    - name: Security audit
      run: composer audit --format=plain

    - name: Dependency review
      uses: actions/dependency-review-action@v4
      if: github.event_name == 'pull_request'

    - name: Code scanning
      uses: github/super-linter@v7
      env:
        DEFAULT_BRANCH: main
        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}