ci.yml

name: CI

on:
  push:
    branches:
      - ci
      - main
  pull_request:
    types: [opened, synchronize, reopened]

permissions:
  contents: read
  actions: read

jobs:
  lint-and-build:
    name: Lint, Typecheck and Build
    runs-on: ubuntu-latest

    steps:
      - name: Checkout code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

      - name: Setup Bun
        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
        with:
          bun-version: "1.3.9"

      - name: Install dependencies
        run: bun install --frozen-lockfile

      - name: Run ESLint
        run: bun run lint

      - name: Run TypeScript type check
        run: bun run typecheck

      - name: Build project
        run: bun run build
        env:
          NEXT_TELEMETRY_DISABLED: 1
          JWT_SECRET: test-secret-for-ci-build-only-32ch
          ADMIN_EMAIL: admin@libredb.org
          ADMIN_PASSWORD: test-admin
          USER_EMAIL: user@libredb.org
          USER_PASSWORD: test-user

  test:
    name: Unit & Integration Tests
    runs-on: ubuntu-latest

    steps:
      - name: Checkout code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

      - name: Setup Bun
        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
        with:
          bun-version: "1.3.9"

      - name: Install dependencies
        run: bun install --frozen-lockfile

      - name: Run merged test coverage (core + components)
        run: bun run test:coverage
        env:
          JWT_SECRET: test-secret-for-ci-build-only-32ch
          ADMIN_EMAIL: admin@libredb.org
          ADMIN_PASSWORD: test-admin
          USER_EMAIL: user@libredb.org
          USER_PASSWORD: test-user

      - name: Upload coverage artifact
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        with:
          name: coverage
          path: coverage/lcov.info

  e2e:
    name: E2E Tests
    needs: [lint-and-build]
    runs-on: ubuntu-latest

    steps:
      - name: Checkout code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

      - name: Setup Bun
        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
        with:
          bun-version: "1.3.9"

      - name: Install dependencies
        run: bun install --frozen-lockfile

      - name: Install Playwright browsers
        run: bunx playwright install --with-deps chromium

      - name: Run E2E tests
        run: bunx playwright test
        env:
          JWT_SECRET: test-secret-for-ci-build-only-32ch
          ADMIN_EMAIL: admin@libredb.org
          ADMIN_PASSWORD: test-admin
          USER_EMAIL: user@libredb.org
          USER_PASSWORD: test-user

      - name: Upload Playwright report
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        if: always()
        with:
          name: playwright-report
          path: playwright-report/

  helm-lint:
    name: Helm Chart Lint
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

      - name: Set up Helm
        uses: azure/setup-helm@1a275c3b69536ee54be43f2070a358922e12c8d4 # v4
        with:
          version: v3.16.0

      - name: Add Bitnami repo
        run: helm repo add bitnami https://charts.bitnami.com/bitnami

      - name: Build chart dependencies
        run: helm dependency build charts/libredb-studio

      - name: Lint Helm chart
        run: helm lint charts/libredb-studio --strict

      - name: Verify appVersion is valid
        run: |
          APP_VERSION=$(node -e "console.log(require('./package.json').version)")
          CHART_APP_VERSION=$(grep '^appVersion:' charts/libredb-studio/Chart.yaml | awk '{print $2}' | tr -d '"')
          echo "package.json=$APP_VERSION, Chart appVersion=$CHART_APP_VERSION"
          if [ "$(printf '%s\n' "$CHART_APP_VERSION" "$APP_VERSION" | sort -V | head -1)" != "$CHART_APP_VERSION" ]; then
            echo "ERROR: Chart appVersion ($CHART_APP_VERSION) is ahead of package.json ($APP_VERSION)"
            exit 1
          fi
          if [ "$APP_VERSION" != "$CHART_APP_VERSION" ]; then
            echo "INFO: Chart appVersion ($CHART_APP_VERSION) is behind package.json ($APP_VERSION). Update Chart.yaml appVersion on next chart release."
          else
            echo "OK: versions in sync"
          fi

  sonarcloud:
    name: SonarCloud Analysis
    needs: [test]
    if: github.event.pull_request.head.repo.full_name == github.repository || github.event_name == 'push'
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          fetch-depth: 0

      - name: Download coverage artifact
        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
        with:
          name: coverage
          path: coverage

      - name: Verify coverage file
        run: |
          echo "=== Coverage file check ==="
          ls -la coverage/
          echo "=== First 5 SF lines ==="
          grep "^SF:" coverage/lcov.info | head -5
          echo "=== Record count ==="
          grep -c "^SF:" coverage/lcov.info
          echo "=== Sample record ==="
          head -20 coverage/lcov.info

      - name: SonarCloud Scan
        uses: SonarSource/sonarqube-scan-action@fd88b7d7ccbaefd23d8f36f73b59db7a3d246602 # v6
        with:
          args: >
            -Dsonar.verbose=true
        env:
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}