code-quality.yml

name: Code Quality

on:
  push:
    branches: [ master, main, develop ]
  pull_request:
    branches: [ master, main ]

jobs:
  code-checks:
    runs-on: ubuntu-latest
    
    steps:
      - name: Checkout repository
        uses: actions/checkout@v6

      - name: Check code quality
        run: |
          # Check for common code issues
          echo "Checking for TODO/FIXME comments..."
          grep -r "TODO\|FIXME" src/ || echo "No TODO/FIXME found"
          
          echo "Checking for console.log statements..."
          grep -r "console\.log" src/ || echo "No console.log found"
          
          echo "Checking for hardcoded secrets..."
          grep -ri "password\|secret\|key.*=" src/ | grep -v "\.md" || echo "No potential secrets found"

  security:
    runs-on: ubuntu-latest
    
    steps:
      - name: Checkout repository
        uses: actions/checkout@v6

      - name: Run security audit
        run: |
          # Check for security vulnerabilities in dependencies
          if command -v npm &> /dev/null; then
            npm audit --audit-level moderate || echo "npm audit completed with findings"
          fi
          
          # Check for common security issues
          echo "Checking for eval() usage..."
          grep -r "eval(" src/ || echo "No eval() usage found"
          
          echo "Checking for SQL injection patterns..."
          grep -ri "query.*+\|query.*concat" src/ || echo "No SQL injection patterns found"

  documentation:
    runs-on: ubuntu-latest
    
    steps:
      - name: Checkout repository
        uses: actions/checkout@v6

      - name: Check documentation
        run: |
          echo "Checking for README files..."
          find . -name "README.md" -type f
          
          echo "Checking for missing documentation..."
          find src -name "*.js" -type f | while read file; do
            if ! grep -q "^\s*\*\|^\/\*\|^\/\/" "$file"; then
              echo "Missing documentation: $file"
            fi
          done

  dependencies:
    runs-on: ubuntu-latest
    
    steps:
      - name: Checkout repository
        uses: actions/checkout@v6

      - name: Setup Bun
        uses: oven-sh/setup-bun@v2
        with:
          bun-version: latest

      - name: Check dependency health
        run: |
          echo "Checking package.json..."
          if [ -f package.json ]; then
            echo "✅ package.json exists"
            cat package.json | head -20
          else
            echo "❌ package.json missing"
          fi
          
          echo "Installing dependencies..."
          bun install
          
          echo "Checking for outdated dependencies..."
          bun outdated || echo "Dependency check completed"