ci.yml

name: CI

on:
  push:
    branches: [main, master]
  pull_request:
    branches: [main, master]
  workflow_dispatch:

# Cancel in-progress runs when a new workflow with the same group name is triggered
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: read
  pull-requests: write

jobs:
  lint-and-format:
    name: Lint & Format Check
    runs-on: ubuntu-latest
    strategy:
      matrix:
        node-version: [22.x, latest]
    
    steps:
      - name: Checkout code
        uses: actions/checkout@v6

      - name: Setup pnpm
        uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4.0.0
        with:
          version: 10

      - name: Setup Node.js ${{ matrix.node-version }}
        uses: actions/setup-node@v6
        with:
          node-version: ${{ matrix.node-version }}
          cache: 'pnpm'

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Lint
        run: |
          # Enforce zero warnings policy
          pnpm lint:check 2>&1 | tee lint-output.txt
          if grep -qE "✖.*problem" lint-output.txt; then
            echo "Error: Linting issues detected. Run 'pnpm lint:fix' to resolve."
            exit 1
          fi

      - name: Run Prettier
        run: pnpm format:check

      - name: TypeScript type check
        run: pnpm build

  security-audit:
    name: Security Audit
    runs-on: ubuntu-latest
    
    steps:
      - name: Checkout code
        uses: actions/checkout@v6

      - name: Setup pnpm
        uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4.0.0
        with:
          version: 10

      - name: Setup Node.js
        uses: actions/setup-node@v6
        with:
          node-version: 22.x
          cache: 'pnpm'

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Run security audit
        run: pnpm audit --audit-level=high
        continue-on-error: false

  test:
    name: Test
    runs-on: ubuntu-latest
    strategy:
      matrix:
        node-version: [22.x, latest]
    
    steps:
      - name: Checkout code
        uses: actions/checkout@v6

      - name: Setup pnpm
        uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4.0.0
        with:
          version: 10

      - name: Setup Node.js ${{ matrix.node-version }}
        uses: actions/setup-node@v6
        with:
          node-version: ${{ matrix.node-version }}
          cache: 'pnpm'

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Run tests
        run: pnpm test

      - name: Test with coverage
        run: pnpm test:coverage
        # Coverage thresholds enforced by jest.config.ts

      - name: Upload coverage artifacts
        if: matrix.node-version == '22.x'
        uses: actions/upload-artifact@v6
        with:
          name: coverage-report
          path: coverage/
          retention-days: 7
        continue-on-error: true

  build:
    name: Build & Validate
    runs-on: ubuntu-latest
    strategy:
      matrix:
        node-version: [22.x, latest]
    
    steps:
      - name: Checkout code
        uses: actions/checkout@v6

      - name: Setup pnpm
        uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4.0.0
        with:
          version: 10

      - name: Setup Node.js ${{ matrix.node-version }}
        uses: actions/setup-node@v6
        with:
          node-version: ${{ matrix.node-version }}
          cache: 'pnpm'

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Build project
        run: pnpm build

      - name: Verify dist directory exists
        run: |
          if [ ! -d "dist" ]; then
            echo "Error: dist directory not created"
            exit 1
          fi

      - name: Verify CLI binary exists
        run: |
          if [ ! -f "dist/cli.js" ]; then
            echo "Error: CLI binary not found"
            exit 1
          fi

      - name: Verify typechain artifacts
        run: |
          if [ ! -d "src/typechain" ]; then
            echo "Error: typechain directory not found"
            exit 1
          fi

      - name: Upload build artifacts
        if: matrix.node-version == '22.x'
        uses: actions/upload-artifact@v6
        with:
          name: dist
          path: dist/
          retention-days: 7

  # Summary job that depends on all other jobs
  ci-success:
    name: CI Success
    runs-on: ubuntu-latest
    needs: [lint-and-format, security-audit, test, build]
    if: always()
    
    steps:
      - name: Check job results
        run: |
          if [[ "${{ needs.lint-and-format.result }}" != "success" ]]; then
            echo "Lint and format check failed"
            exit 1
          fi
          if [[ "${{ needs.security-audit.result }}" != "success" ]]; then
            echo "Security audit failed"
            exit 1
          fi
          if [[ "${{ needs.test.result }}" != "success" ]]; then
            echo "Tests failed"
            exit 1
          fi
          if [[ "${{ needs.build.result }}" != "success" ]]; then
            echo "Build failed"
            exit 1
          fi
          echo "All CI checks passed successfully!"