ci-pipeline.yml

name: CI

on:
  push:
    branches: [ '**' ]

env:
  PYTHON_VERSION: '3.13'
  NODE_VERSION: '18'

jobs:
  # Stage 1: Fast validation (runs first)
  validate-format:
    name: "🔍 Validate Branch & Commit Format"
    runs-on: ubuntu-latest
    outputs:
      skip_pipeline: ${{ steps.detect_semrel.outputs.skip_pipeline }}
    steps:
      - name: Checkout code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          fetch-depth: 0

      - name: Detect semantic-release generated commit
        id: detect_semrel
        shell: bash
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          msg="$(git log -1 --pretty=%B)"
          subject="$(echo "$msg" | head -n1 | tr -d '\r')"
          body="$(echo "$msg" | tail -n +2)"
          ident="$(git log -1 --pretty=format:%an\|%ae\|%cn\|%ce | tr '[:upper:]' '[:lower:]')"
          echo "Commit subject: $subject"
          SKIP_PIPELINE=false

          # Skip semantic-release bot commits to avoid CI loops
          if [[ "$subject" =~ ^[0-9]+\.[0-9]+\.[0-9]+([\-\+][0-9A-Za-z\.-]+)?$ ]] \
             && echo "$body" | grep -qi 'automatically generated by python-semantic-release' \
             && echo "$ident" | grep -q 'semantic-release'; then
            SKIP_PIPELINE=true
            echo "🤖 Detected semantic-release commit. Skipping the remainder of the pipeline."
          fi

          echo "skip_pipeline=$SKIP_PIPELINE" >> "$GITHUB_OUTPUT"

      - name: Set up Python
        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
        with:
          python-version: ${{ env.PYTHON_VERSION }}
        if: steps.detect_semrel.outputs.skip_pipeline != 'true'

      - name: Install dependencies
        run: |
          python -m pip install --upgrade pip
          pip install toml
        if: steps.detect_semrel.outputs.skip_pipeline != 'true'

      - name: Validate branch and commit format
        run: |
          echo "🔍 Starting validation based on semantic release configuration..."
          echo "📋 Checking pyproject.toml for allowed tags..."
          python .github/scripts/validate_format.py
        env:
          GITHUB_REF: ${{ github.ref }}
          GITHUB_EVENT_NAME: ${{ github.event_name }}
          GITHUB_HEAD_REF: ${{ github.head_ref }}
          GITHUB_BASE_REF: ${{ github.base_ref }}
          GITHUB_SHA: ${{ github.sha }}
        if: steps.detect_semrel.outputs.skip_pipeline != 'true'

      - name: Validation Success
        if: steps.detect_semrel.outputs.skip_pipeline != 'true' && success()
        run: |
          echo "✅ All validation checks passed!"
          echo "🎉 Branch name and commit messages follow the required format."

      - name: Skip Notice
        if: steps.detect_semrel.outputs.skip_pipeline == 'true'
        run: |
          echo "⏭️  Skipping full CI pipeline for semantic-release commit."

  # Stage 2: Code quality (parallel, after validation)
  lint-python:
    name: "🐍 Lint Python Code"
    runs-on: ubuntu-latest
    needs: validate-format
    if: needs.validate-format.outputs.skip_pipeline != 'true'
    steps:
      - name: Checkout code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

      - name: Set up Python
        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
        with:
          python-version: ${{ env.PYTHON_VERSION }}

      - name: Install dependencies
        run: |
          python -m pip install --upgrade pip
          pip install -e .[dev]

      - name: Run Python linting
        run: |
          echo "🔍 Checking Python code style..."
          echo "🐍 Running ruff check..."
          ruff check backend/
          echo "🐍 Running ruff format..."
          ruff format --check backend/ --diff

  lint-frontend:
    name: "⚛️ Lint Frontend Code"
    runs-on: ubuntu-latest
    needs: validate-format
    if: needs.validate-format.outputs.skip_pipeline != 'true'
    steps:
      - name: Checkout code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

      - name: Set up Node.js
        uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6
        with:
          node-version: ${{ env.NODE_VERSION }}

      - name: Install dependencies
        run: |
          cd frontend
          npm i

      - name: Run frontend linting
        run: |
          cd frontend
          echo "🔍 Checking frontend code style..."
          npm run lint

  # Stage 3: Testing (parallel, after linting)
  test-backend:
    name: "🧪 Backend Tests"
    runs-on: ubuntu-latest
    needs: [validate-format, lint-python]
    if: needs.validate-format.outputs.skip_pipeline != 'true'
    
    services:
      postgres:
        image: postgres:18@sha256:69e8582b781cb44fa4557b98ed586fe68361e320d9b12f9707494335634f4f3d
        env:
          POSTGRES_PASSWORD: testpass
          POSTGRES_DB: testdb
        options: >-
          --health-cmd pg_isready
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5
        ports:
          - 5432:5432

    steps:
      - name: Checkout code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

      - name: Set up Python
        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
        with:
          python-version: ${{ env.PYTHON_VERSION }}

      - name: Install dependencies
        run: |
          python -m pip install --upgrade pip
          pip install -e .[dev]

      - name: Run backend tests
        run: |
          echo "🧪 Running backend tests..."
          pytest
        env:
          DATABASE_URL: postgresql://postgres:testpass@localhost:5432/testdb

  test-frontend:
    name: "🧪 Frontend Tests"
    runs-on: ubuntu-latest
    needs: [validate-format, lint-frontend]
    if: needs.validate-format.outputs.skip_pipeline != 'true'
    steps:
      - name: Checkout code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

      - name: Set up Node.js
        uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6
        with:
          node-version: ${{ env.NODE_VERSION }}

      - name: Install dependencies
        run: |
          cd frontend
          npm i

      - name: Run frontend tests
        run: |
          cd frontend
          echo "🧪 Running frontend tests..."
          npx jest --coverage

  # Stage 4: Semantic Release (only on main branch, not tags)
  semantic-release:
    name: "🚀 Semantic Release"
    runs-on: ubuntu-latest
    needs: [validate-format, test-backend, test-frontend]
    outputs:
      image_tag: ${{ steps.semrel.outputs.image_tag }}
      skip_image_push: ${{ steps.semrel.outputs.skip_image_push }}
    if: |
      github.ref == 'refs/heads/main' &&
      github.event_name == 'push' &&
      !startsWith(github.ref, 'refs/tags/') &&
      needs.validate-format.outputs.skip_pipeline != 'true'
    permissions:
      contents: write
      id-token: write
    steps:
      - name: Checkout code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          fetch-depth: 0

      - name: Set up Python
        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
        with:
          python-version: ${{ env.PYTHON_VERSION }}

      - name: Install dependencies
        run: |
          python -m pip install --upgrade pip
          pip install -e .[dev]

      - name: Create GitHub App token
        id: app-token
        uses: actions/create-github-app-token@f8d387b68d61c58ab83c6c016672934102569859 # v3
        with:
          app-id: ${{ vars.SEMREL_GHA_APP_ID }}
          private-key: ${{ secrets.SEMREL_GHA_APP_KEY }}

      - name: Get GitHub App User ID
        id: get-user-id
        run: echo "user-id=$(gh api "/users/${{ steps.app-token.outputs.app-slug }}[bot]" --jq .id)" >> "$GITHUB_OUTPUT"
        env:
          GH_TOKEN: ${{ steps.app-token.outputs.token }}

      - name: Configure Git with App token
        run: |
          git config --global credential.helper store
          echo "https://x-access-token:${{ steps.app-token.outputs.token }}@github.com" > ~/.git-credentials
          git remote set-url origin https://x-access-token:${{ steps.app-token.outputs.token }}@github.com/bartekmp/osmosmjerka.git
          echo "Verifying app token access..."
          git ls-remote --heads origin main > /dev/null && echo "✓ Token authentication successful" || echo "✗ Token authentication failed"
          git config --global user.name '${{ steps.app-token.outputs.app-slug }}[bot]'
          git config --global user.email '${{ steps.get-user-id.outputs.user-id }}+${{ steps.app-token.outputs.app-slug }}[bot]@users.noreply.github.com'

      - name: Run semantic-release version
        id: semrel
        env:
          GH_TOKEN: ${{ steps.app-token.outputs.token }}
        run: |
          set +e
          python -m semantic_release version --push
          EXIT_CODE=$?
          set -e
          
          echo "Semantic-release exit code: $EXIT_CODE"
          SHORT_COMMIT=$(git rev-parse --short HEAD)
          
          if [ $EXIT_CODE -eq 0 ]; then
            echo "Branch: New version released successfully"
            VERSION=$(grep '^version' pyproject.toml | head -1 | awk -F '"' '{print $2}')
            echo "image_tag=${VERSION}" >> "$GITHUB_OUTPUT"
            echo "skip_image_push=false" >> "$GITHUB_OUTPUT"
            echo "::notice title=New Release::Version ${VERSION} released successfully"
            
            echo "Publishing release..."
            python -m semantic_release publish || {
              echo "::warning title=Publish Failed::Failed to publish release, but version was created"
            }
          elif [ $EXIT_CODE -eq 2 ]; then
            echo "Branch: No release necessary or already released"
            echo "image_tag=v999.0.0-dev" >> "$GITHUB_OUTPUT"
            echo "skip_image_push=true" >> "$GITHUB_OUTPUT"
            echo "::notice title=No Release::No new release necessary"
          else
            echo "Branch: Unexpected exit code $EXIT_CODE"
            echo "Setting build display name to #${GITHUB_RUN_NUMBER}-${SHORT_COMMIT}"
            echo "::error title=Semantic Release Failed::Semantic-release failed with exit code $EXIT_CODE"
            exit $EXIT_CODE
          fi

  # Stage 5: Docker Build (no push) — non-main branches only (PR verification)
  docker-build:
    name: "🐳 Docker Build (no push)"
    runs-on: ubuntu-latest
    needs: [validate-format, test-backend, test-frontend, semantic-release]
    if: |
      github.ref != 'refs/heads/main' &&
      !startsWith(github.ref, 'refs/tags/') &&
      needs.validate-format.outputs.skip_pipeline != 'true' &&
      always() && (needs.semantic-release.result == 'success' || needs.semantic-release.result == 'skipped')
    permissions:
      contents: read
    env:
      REGISTRY: ghcr.io
      IMAGE_NAME: osmosmjerka
    steps:
      - name: Checkout code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4

      - name: Compute dev image tag
        id: devtag
        shell: bash
        run: |
          set -euo pipefail
          
          # On main, use semantic-release version if available; otherwise compute dev tag
          if [[ "${{ github.ref }}" == "refs/heads/main" ]] && [[ -n "${{ needs.semantic-release.outputs.image_tag }}" ]]; then
            VERSION="${{ needs.semantic-release.outputs.image_tag }}"
            echo "dev_tag=${VERSION}" >> "$GITHUB_OUTPUT"
            echo "Using semantic-release version: ${VERSION}"
          else
            raw_ref="${GITHUB_HEAD_REF:-${GITHUB_REF_NAME}}"
            short_ref="${raw_ref##*/}"
            sanitized="$(echo "$short_ref" | tr '[:upper:]' '[:lower:]' | sed -E 's/[^a-z0-9._-]+/-/g; s/^-+//; s/-+$//; s/-{2,}/-/g')"
            sanitized="${sanitized:0:40}"
            if [[ -z "$sanitized" ]]; then
              sanitized="unknown"
            fi
            echo "dev_tag=v999.0.0-dev-${sanitized}" >> "$GITHUB_OUTPUT"
            echo "Using dev tag: v999.0.0-dev-${sanitized}"
          fi

      - name: Build (no push)
        uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294 # v7
        with:
          context: .
          push: false
          build-args: |
            VERSION=${{ steps.devtag.outputs.dev_tag }}
          labels: |
            build_id=${{ github.run_id }}
            version=${{ steps.devtag.outputs.dev_tag }}
          tags: |
            ${{ env.REGISTRY }}/${{ github.repository_owner }}/${{ env.IMAGE_NAME }}:${{ steps.devtag.outputs.dev_tag }}

  # Stage 6: Docker Build and Push (main only, when PR merged)
  docker-push:
    name: "🐳 Docker Build and Push (GHCR)"
    runs-on: ubuntu-latest
    needs: [validate-format, semantic-release]
    if: |
      github.ref == 'refs/heads/main' &&
      github.event_name == 'push' &&
      !startsWith(github.ref, 'refs/tags/') &&
      needs.validate-format.outputs.skip_pipeline != 'true' &&
      needs.semantic-release.outputs.skip_image_push != 'true'
    permissions:
      contents: read
      packages: write
    env:
      REGISTRY: ghcr.io
      IMAGE_NAME: osmosmjerka
    steps:
      - name: Checkout code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4

      - name: Log in to GHCR
        uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Build and push (version + latest)
        uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294 # v7
        with:
          context: .
          push: true
          build-args: |
            VERSION=${{ needs.semantic-release.outputs.image_tag }}
          labels: |
            build_id=${{ github.run_id }}
            version=${{ needs.semantic-release.outputs.image_tag }}
          tags: |
            ${{ env.REGISTRY }}/${{ github.repository_owner }}/${{ env.IMAGE_NAME }}:${{ needs.semantic-release.outputs.image_tag }}
            ${{ env.REGISTRY }}/${{ github.repository_owner }}/${{ env.IMAGE_NAME }}:latest

  # Stage 7: Final summary (always runs)
  pipeline-summary:
    name: "📊 Pipeline Summary"
    runs-on: ubuntu-latest
    needs: [validate-format, lint-python, lint-frontend, test-backend, test-frontend, semantic-release, docker-build, docker-push]
    if: always()

    steps:
      - name: Generate summary
        shell: bash
        run: |
          echo "📊 CI Pipeline Execution Summary"
          echo "================================="
          if [[ "${{ needs.validate-format.outputs.skip_pipeline }}" == "true" ]]; then
            echo "⏭️  Skipped pipeline (semantic-release commit or duplicate push run)."
            exit 0
          fi

          echo "🔍 Format Validation: ${{ needs.validate-format.result }}"
          echo "🐍 Python Linting: ${{ needs.lint-python.result }}"
          echo "⚛️ Frontend Linting: ${{ needs.lint-frontend.result }}"
          echo "🧪 Backend Tests: ${{ needs.test-backend.result }}"
          echo "🧪 Frontend Tests: ${{ needs.test-frontend.result }}"
          echo "🐳 Docker Build (no push): ${{ needs.docker-build.result }}"
          echo "🐳 Docker Build and Push (GHCR): ${{ needs.docker-push.result }}"

          if [[ "${{ github.ref }}" == "refs/heads/main" ]] && [[ "${{ github.event_name }}" == "push" ]]; then
            SEMREL_RESULT="${{ needs.semantic-release.result }}"
            if [[ -n "$SEMREL_RESULT" ]]; then
              echo "🚀 Semantic Release: $SEMREL_RESULT"
            fi

            SKIP_PUSH="${{ needs.semantic-release.outputs.skip_image_push || 'true' }}"
            if [[ "$SKIP_PUSH" == "true" ]]; then
              echo "🐳 Image push: skipped"
            else
              IMAGE_TAG="${{ needs.semantic-release.outputs.image_tag }}"
              echo "🐳 Image push: pushed ($IMAGE_TAG, latest)"
            fi
          else
            raw_ref="${GITHUB_HEAD_REF:-${GITHUB_REF_NAME}}"
            short_ref="${raw_ref##*/}"
            sanitized="$(echo "$short_ref" | tr '[:upper:]' '[:lower:]' | sed -E 's/[^a-z0-9._-]+/-/g; s/^-+//; s/-+$//; s/-{2,}/-/g')"
            sanitized="${sanitized:0:40}"
            if [[ -z "$sanitized" ]]; then
              sanitized="unknown"
            fi
            echo "🐳 Image tag: v999.0.0-dev-${sanitized}"
            echo "🐳 Image push: skipped (build-only on non-main branch)"
          fi

          CORE_SUCCESS=true
          for result in \
            "${{ needs.validate-format.result }}" \
            "${{ needs.lint-python.result }}" \
            "${{ needs.lint-frontend.result }}" \
            "${{ needs.test-backend.result }}" \
            "${{ needs.test-frontend.result }}" \
            "${{ needs.docker-build.result }}" \
            "${{ needs.semantic-release.result }}" \
            "${{ needs.docker-push.result }}"; do
            if [[ -n "$result" ]] && [[ "$result" != "success" ]] && [[ "$result" != "skipped" ]]; then
              CORE_SUCCESS=false
            fi
          done

          if [[ "$CORE_SUCCESS" == "true" ]]; then
            echo ""
            echo "🎉 All pipeline stages completed successfully!"
          else
            echo ""
            echo "❌ Some pipeline stages failed"
            exit 1
          fi