ci.yml

name: CI

on:
  push:
    branches: [ main, develop ]
  pull_request:
    branches: [ main, develop ]
    types: [ opened, synchronize, reopened ]

jobs:
  test:
    name: Test Suite
    runs-on: ubuntu-latest

    services:
      postgres:
        image: postgres:16
        env:
          POSTGRES_USER: test
          POSTGRES_PASSWORD: test
          POSTGRES_DB: meshmonitor_test
        ports:
          - 5433:5432
        options: >-
          --health-cmd pg_isready
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5

    strategy:
      matrix:
        node-version: [20.x, 22.x, 24.x, 25.x]

    steps:
      - name: Checkout code
        uses: actions/checkout@v6
        with:
          submodules: recursive  # Initialize protobufs submodule for tests

      - name: Setup Node.js ${{ matrix.node-version }}
        uses: actions/setup-node@v6
        with:
          node-version: ${{ matrix.node-version }}
          cache: 'npm'

      - name: Cache dependencies
        uses: actions/cache@v5
        with:
          path: ~/.npm
          key: ${{ runner.os }}-node-${{ matrix.node-version }}-${{ hashFiles('**/package-lock.json') }}
          restore-keys: |
            ${{ runner.os }}-node-${{ matrix.node-version }}-
            ${{ runner.os }}-node-

      - name: Install dependencies
        run: npm install --legacy-peer-deps

      - name: Run linter
        run: npm run lint
        continue-on-error: true  # Don't fail on lint errors for now

      - name: Run type checking
        run: npm run typecheck

      - name: Run tests
        run: npm run test:run -- --exclude="**/server.test.ts"

      - name: Generate coverage report
        if: matrix.node-version == '24.x'  # Only generate coverage on one version
        run: npm run test:coverage -- --exclude="**/server.test.ts"

      - name: Upload coverage to Codecov
        if: matrix.node-version == '24.x'
        uses: codecov/codecov-action@v5
        with:
          files: ./coverage/coverage-final.json
          flags: unittests
          name: codecov-umbrella
          fail_ci_if_error: false  # Don't fail if codecov is down

  build:
    name: Build Check
    runs-on: ubuntu-latest
    needs: test

    steps:
      - name: Checkout code
        uses: actions/checkout@v6
        with:
          submodules: recursive  # Initialize protobufs submodule

      - name: Setup Node.js
        uses: actions/setup-node@v6
        with:
          node-version: '24.x'
          cache: 'npm'

      - name: Install dependencies
        run: npm install --legacy-peer-deps

      - name: Build frontend
        run: npm run build

      - name: Build server
        run: npm run build:server

      - name: Check build artifacts
        run: |
          echo "Checking frontend build..."
          ls -la dist/
          echo "Checking server build..."
          ls -la dist/server/

  docker:
    name: Docker Build
    runs-on: ubuntu-latest
    needs: test

    steps:
      - name: Checkout code
        uses: actions/checkout@v6
        with:
          submodules: recursive

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v4

      - name: Build Docker image
        uses: docker/build-push-action@v7
        with:
          context: .
          push: false
          load: true
          tags: meshmonitor:test
          cache-from: type=gha
          cache-to: type=gha,mode=max

      - name: Test Docker image
        run: |
          docker run --rm meshmonitor:test node --version
          docker run --rm meshmonitor:test ls -la /app/

  security:
    name: Security Scan
    runs-on: ubuntu-latest
    if: github.event_name == 'pull_request'

    steps:
      - name: Checkout code
        uses: actions/checkout@v6

      - name: Install Trivy
        run: |
          sudo apt-get install -y wget apt-transport-https gnupg lsb-release
          wget -qO - https://aquasecurity.github.io/trivy-repo/deb/public.key | gpg --dearmor | sudo tee /usr/share/keyrings/trivy.gpg > /dev/null
          echo "deb [signed-by=/usr/share/keyrings/trivy.gpg] https://aquasecurity.github.io/trivy-repo/deb $(lsb_release -sc) main" | sudo tee /etc/apt/sources.list.d/trivy.list
          sudo apt-get update
          sudo apt-get install -y trivy

      - name: Run Trivy vulnerability scanner
        run: trivy fs --scanners vuln --format sarif --output trivy-results.sarif --severity HIGH,CRITICAL .

      - name: Upload Trivy results to GitHub Security
        uses: github/codeql-action/upload-sarif@v4
        if: always()
        with:
          sarif_file: 'trivy-results.sarif'

      - name: Dependency audit
        run: npm audit --audit-level=moderate
        continue-on-error: true  # Don't fail on audit issues for now

  clamav:
    name: ClamAV Scan
    runs-on: ubuntu-latest
    if: github.event_name == 'pull_request'

    steps:
      - name: Checkout code
        uses: actions/checkout@v6

      - name: Install & update ClamAV
        run: |
          set -e
          sudo apt-get update
          sudo apt-get install -y clamav clamav-freshclam
          sudo systemctl stop clamav-freshclam || true
          sudo freshclam --verbose

      - name: Setup Node.js
        uses: actions/setup-node@v6
        with:
          node-version: 22.x
          cache: 'npm'

      - name: Install dependencies
        run: npm install --legacy-peer-deps

      - name: Verify ClamAV detects EICAR signature
        run: |
          set -euo pipefail
          printf 'X5O!P%%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*' > eicar.com
          status=0
          clamscan eicar.com > eicar.log 2>&1 || status=$?
          cat eicar.log
          if [ "$status" -ne 1 ]; then
            echo "ClamAV failed to detect EICAR test signature" >&2
            exit 1
          fi
          rm -f eicar.com eicar.log

      - name: Scan source tree
        run: |
          set -euo pipefail
          clamscan -ri --exclude-dir='^\.git$' . | tee clamav.log
          if grep -qE 'Infected files: [1-9][0-9]*' clamav.log; then
            echo "ClamAV found infected files!" >&2
            grep 'FOUND' clamav.log >&2
            exit 1
          fi

      - name: Upload scan results
        if: always()
        uses: actions/upload-artifact@v7
        with:
          name: clamav-scan-results
          path: clamav.log

  pr-comment:
    name: PR Comment
    runs-on: ubuntu-latest
    needs: [test, build, docker]
    if: github.event_name == 'pull_request'

    steps:
      - name: Comment on PR
        uses: actions/github-script@v8
        continue-on-error: true  # Don't fail if we can't comment
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          script: |
            const issue_number = context.payload.pull_request.number;
            const { owner, repo } = context.repo;

            const comment = `## ✅ CI Checks Passed

            All tests and builds completed successfully!

            - **Tests**: All unit tests passing
            - **Type Check**: No TypeScript errors
            - **Build**: Frontend and server built successfully
            - **Docker**: Image builds successfully

            Ready for review! 🚀`;

            // Check if we already commented
            const comments = await github.rest.issues.listComments({
              owner,
              repo,
              issue_number,
            });

            const botComment = comments.data.find(comment =>
              comment.user.type === 'Bot' &&
              comment.body.includes('CI Checks')
            );

            if (botComment) {
              // Update existing comment
              await github.rest.issues.updateComment({
                owner,
                repo,
                comment_id: botComment.id,
                body: comment
              });
            } else {
              // Create new comment
              await github.rest.issues.createComment({
                owner,
                repo,
                issue_number,
                body: comment
              });
            }