ci.yml

name: CI

on:
  push:
    branches: [main, develop]
  pull_request:
    branches: [main, develop]
  workflow_dispatch:

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

env:
  CARGO_TERM_COLOR: always
  RUST_BACKTRACE: 1
  FORCE_COLOR: 1

jobs:
  # ============================================================================
  # Change Detection - Determine which services need to be tested
  # ============================================================================
  changes:
    name: Detect Changes
    runs-on: ubuntu-latest
    outputs:
      rust: ${{ steps.filter.outputs.rust }}
      go: ${{ steps.filter.outputs.go }}
      web: ${{ steps.filter.outputs.web }}
      elixir: ${{ steps.filter.outputs.elixir }}
      mcp: ${{ steps.filter.outputs.mcp }}
      workflows: ${{ steps.filter.outputs.workflows }}
    steps:
      - uses: actions/checkout@v4
      - uses: dorny/paths-filter@v3
        id: filter
        with:
          filters: |
            rust:
              - 'apps/core/**'
              - 'Cargo.lock'
            go:
              - 'apps/control-plane/**'
            web:
              - 'apps/web/**'
              - 'packages/ui/**'
              - 'package.json'
              - 'bun.lock'
            elixir:
              - 'apps/query-service/**'
            mcp:
              - 'apps/mcp-server-elixir/**'
            workflows:
              - '.github/workflows/**'

  # ============================================================================
  # Rust Quality Gates (Core Service)
  # ============================================================================
  rust-quality:
    name: Rust Quality Gates
    needs: changes
    if: needs.changes.outputs.rust == 'true' || needs.changes.outputs.workflows == 'true'
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: apps/core

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@stable
        with:
          toolchain: "1.82"
          components: rustfmt, clippy

      - name: Cache Rust dependencies
        uses: Swatinem/rust-cache@v2
        with:
          workspaces: "apps/core -> target"
          cache-on-failure: true

      - name: Install cargo-sort
        uses: taiki-e/install-action@v2
        with:
          tool: cargo-sort

      - name: Check formatting
        run: cargo fmt --check

      - name: Check Cargo.toml sorting
        run: cargo sort --check

      - name: Run Clippy
        run: cargo clippy --locked --all-targets --all-features -- -D warnings

      - name: Run tests
        run: cargo test --locked --lib --all-features

      - name: Build release
        run: cargo build --locked --lib --release

      - name: Check documentation
        run: cargo doc --no-deps --document-private-items
        env:
          RUSTDOCFLAGS: "-D warnings"

  rust-msrv:
    name: Rust MSRV Check
    needs: changes
    if: needs.changes.outputs.rust == 'true' || needs.changes.outputs.workflows == 'true'
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: apps/core

    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@1.75.0
      - uses: Swatinem/rust-cache@v2
        with:
          workspaces: "apps/core -> target"
      - run: cargo check --lib --locked

  # ============================================================================
  # Go Quality Gates (Control Plane)
  # ============================================================================
  go-quality:
    name: Go Quality Gates
    needs: changes
    if: needs.changes.outputs.go == 'true' || needs.changes.outputs.workflows == 'true'
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: apps/control-plane

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Set up Go
        uses: actions/setup-go@v5
        with:
          go-version: "1.22"
          cache-dependency-path: apps/control-plane/go.sum

      - name: Download dependencies
        run: go mod download

      - name: Verify dependencies
        run: go mod verify

      - name: Check formatting
        run: |
          if [ -n "$(gofmt -l .)" ]; then
            echo "Go code is not formatted:"
            gofmt -d .
            exit 1
          fi

      - name: Run go vet
        run: go vet ./...

      - name: Install staticcheck
        run: go install honnef.co/go/tools/cmd/staticcheck@latest

      - name: Run staticcheck
        run: staticcheck ./...

      - name: Install golangci-lint
        uses: golangci/golangci-lint-action@v6
        with:
          version: latest
          working-directory: apps/control-plane
          args: --timeout=5m

      - name: Run tests
        run: go test -v -race -coverprofile=coverage.out -covermode=atomic ./...

      - name: Upload coverage
        uses: codecov/codecov-action@v4
        if: github.event_name != 'pull_request'
        with:
          files: apps/control-plane/coverage.out
          flags: control-plane
          fail_ci_if_error: false

      - name: Build binary
        run: CGO_ENABLED=0 go build -ldflags="-s -w" -o control-plane .

  # ============================================================================
  # TypeScript/Node Quality Gates (Web + UI)
  # ============================================================================
  web-quality:
    name: Web Quality Gates
    needs: changes
    if: needs.changes.outputs.web == 'true' || needs.changes.outputs.workflows == 'true'
    runs-on: ubuntu-latest

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Set up Bun
        uses: oven-sh/setup-bun@v2
        with:
          bun-version: latest

      - name: Cache dependencies
        uses: actions/cache@v4
        with:
          path: ~/.bun/install/cache
          key: bun-${{ runner.os }}-${{ hashFiles('**/bun.lock') }}
          restore-keys: |
            bun-${{ runner.os }}-

      - name: Install dependencies
        run: bun install --frozen-lockfile

      - name: Run Biome lint
        run: bun run lint

      - name: Type check
        run: bun --cwd apps/web run type-check

      - name: Build packages
        run: bun run build --filter=@allsource/ui

      - name: Build web app
        run: bun --cwd apps/web run build

  # ============================================================================
  # Elixir Quality Gates (Query Service)
  # ============================================================================
  elixir-query-quality:
    name: Elixir Query Service Quality Gates
    needs: changes
    if: needs.changes.outputs.elixir == 'true' || needs.changes.outputs.workflows == 'true'
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: apps/query-service

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Set up Elixir
        uses: erlef/setup-beam@v1
        with:
          elixir-version: "1.17"
          otp-version: "27"

      - name: Cache deps
        uses: actions/cache@v4
        with:
          path: |
            apps/query-service/deps
            apps/query-service/_build
          key: elixir-query-${{ runner.os }}-${{ hashFiles('apps/query-service/mix.lock') }}
          restore-keys: |
            elixir-query-${{ runner.os }}-

      - name: Install dependencies
        run: mix deps.get

      - name: Check formatting
        run: mix format --check-formatted

      - name: Compile with warnings as errors
        run: mix compile --warnings-as-errors

      - name: Run Credo (static analysis)
        run: mix credo --strict || true

      - name: Run tests
        run: mix test

  # ============================================================================
  # Elixir Quality Gates (MCP Server)
  # ============================================================================
  elixir-mcp-quality:
    name: Elixir MCP Server Quality Gates
    needs: changes
    if: needs.changes.outputs.mcp == 'true' || needs.changes.outputs.workflows == 'true'
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: apps/mcp-server-elixir

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Set up Elixir
        uses: erlef/setup-beam@v1
        with:
          elixir-version: "1.17"
          otp-version: "27"

      - name: Cache deps
        uses: actions/cache@v4
        with:
          path: |
            apps/mcp-server-elixir/deps
            apps/mcp-server-elixir/_build
          key: elixir-mcp-${{ runner.os }}-${{ hashFiles('apps/mcp-server-elixir/mix.lock') }}
          restore-keys: |
            elixir-mcp-${{ runner.os }}-

      - name: Install dependencies
        run: mix deps.get

      - name: Check formatting
        run: mix format --check-formatted

      - name: Compile with warnings as errors
        run: mix compile --warnings-as-errors

      - name: Run Credo (static analysis)
        run: mix credo --strict || true

  # ============================================================================
  # Summary Gate - All Quality Checks Must Pass
  # ============================================================================
  quality-gate:
    name: Quality Gate
    runs-on: ubuntu-latest
    needs:
      - changes
      - rust-quality
      - rust-msrv
      - go-quality
      - web-quality
      - elixir-query-quality
      - elixir-mcp-quality
    if: always()
    steps:
      - name: Check quality gates
        run: |
          echo "## Quality Gate Summary" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY

          # Check each job result
          FAILED=false

          check_job() {
            local name=$1
            local result=$2
            local required=$3

            if [ "$required" == "false" ]; then
              echo "- ⏭️ **$name**: Skipped (no changes)" >> $GITHUB_STEP_SUMMARY
            elif [ "$result" == "success" ]; then
              echo "- ✅ **$name**: Passed" >> $GITHUB_STEP_SUMMARY
            elif [ "$result" == "skipped" ]; then
              echo "- ⏭️ **$name**: Skipped" >> $GITHUB_STEP_SUMMARY
            else
              echo "- ❌ **$name**: Failed" >> $GITHUB_STEP_SUMMARY
              FAILED=true
            fi
          }

          check_job "Rust Quality" "${{ needs.rust-quality.result }}" "${{ needs.changes.outputs.rust == 'true' || needs.changes.outputs.workflows == 'true' }}"
          check_job "Rust MSRV" "${{ needs.rust-msrv.result }}" "${{ needs.changes.outputs.rust == 'true' || needs.changes.outputs.workflows == 'true' }}"
          check_job "Go Quality" "${{ needs.go-quality.result }}" "${{ needs.changes.outputs.go == 'true' || needs.changes.outputs.workflows == 'true' }}"
          check_job "Web Quality" "${{ needs.web-quality.result }}" "${{ needs.changes.outputs.web == 'true' || needs.changes.outputs.workflows == 'true' }}"
          check_job "Elixir Query" "${{ needs.elixir-query-quality.result }}" "${{ needs.changes.outputs.elixir == 'true' || needs.changes.outputs.workflows == 'true' }}"
          check_job "Elixir MCP" "${{ needs.elixir-mcp-quality.result }}" "${{ needs.changes.outputs.mcp == 'true' || needs.changes.outputs.workflows == 'true' }}"

          echo "" >> $GITHUB_STEP_SUMMARY

          if [ "$FAILED" == "true" ]; then
            echo "### ❌ Quality Gate Failed" >> $GITHUB_STEP_SUMMARY
            exit 1
          else
            echo "### ✅ All Quality Gates Passed" >> $GITHUB_STEP_SUMMARY
          fi