ci.yml

name: CI - Build, Test & Lint

on:
  push:
    branches: [ main, develop ]
  pull_request:
    branches: [ main, develop ]

# Optimize: Cancel in-progress runs for the same PR
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  # Job 1: Fast checks (lint, type-check)
  quality-checks:
    name: Code Quality
    runs-on: ubuntu-latest
    timeout-minutes: 20

    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        with:
          fetch-depth: 0 # For better caching

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '20'
          cache: 'npm'

      - name: Install dependencies
        run: npm ci
        env:
          NODE_ENV: development

      - name: Type Check
        run: npm run type-check
        continue-on-error: false

      - name: Lint Check
        run: npm run lint
        continue-on-error: false

  # Job 2: Build verification
  build:
    name: Build Packages
    runs-on: ubuntu-latest
    timeout-minutes: 20
    needs: quality-checks

    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '20'
          cache: 'npm'

      - name: Install dependencies
        run: npm ci

      - name: Build all packages
        run: npm run build

      - name: Cache build artifacts
        uses: actions/cache@v4
        with:
          path: |
            packages/*/dist
            node_modules
          key: build-${{ runner.os }}-${{ github.sha }}
          restore-keys: |
            build-${{ runner.os }}-

  # Job 3: Test with coverage
  test:
    name: Test Suite
    runs-on: ubuntu-latest
    timeout-minutes: 20
    needs: build

    strategy:
      matrix:
        package:
          - 'defi-protocols'
          # Add more packages as needed
          # - 'stellar-sdk'
          # - 'automation'

    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '20'
          cache: 'npm'

      - name: Install dependencies
        run: npm ci

      - name: Run tests with coverage
        working-directory: packages/core/${{ matrix.package }}
        run: npm run test:coverage
        env:
          NODE_ENV: test

      - name: Upload coverage to Codecov
        uses: codecov/codecov-action@v4
        with:
          files: ./packages/core/${{ matrix.package }}/coverage/lcov.info
          flags: ${{ matrix.package }}
          name: ${{ matrix.package }}-coverage
        continue-on-error: true

      - name: Coverage threshold check
        working-directory: packages/core/${{ matrix.package }}
        run: |
          SUMMARY="coverage/coverage-summary.json"
          if [ ! -f "$SUMMARY" ]; then
            echo "❌ $SUMMARY missing — ensure Jest uses coverageReporters including json-summary"
            exit 1
          fi
          COVERAGE=$(jq -r '.total.lines.pct' "$SUMMARY")
          echo "Coverage: $COVERAGE%"
          node -e "
            const c = parseFloat(process.argv[1]);
            if (Number.isNaN(c)) { console.error('Invalid coverage value'); process.exit(1); }
            if (c < 90) { console.error('Coverage is below 90%'); process.exit(1); }
          " "$COVERAGE"
          echo "✅ Coverage is above 90%"

  # Job 4: Security audit
  security:
    name: Security Audit
    runs-on: ubuntu-latest
    timeout-minutes: 20

    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '20'
          cache: 'npm'

      - name: Install dependencies
        run: npm ci

      - name: Run npm audit
        run: npm audit --audit-level=moderate
        continue-on-error: true

      - name: Check for critical vulnerabilities only
        run: |
          AUDIT_RESULT=$(npm audit --audit-level=critical --json)
          CRITICAL_VULN=$(echo $AUDIT_RESULT | jq '.metadata.vulnerabilities.critical // 0')

          if [ "$CRITICAL_VULN" -gt 0 ]; then
            echo "❌ Found critical vulnerabilities"
            npm audit --audit-level=critical
            exit 1
          fi

          # Show summary of other vulnerabilities for transparency
          HIGH_VULN=$(echo $AUDIT_RESULT | jq '.metadata.vulnerabilities.high // 0')
          MODERATE_VULN=$(echo $AUDIT_RESULT | jq '.metadata.vulnerabilities.moderate // 0')
          echo "✅ No critical vulnerabilities found"
          echo "ℹ️  Other vulnerabilities present: $HIGH_VULN high, $MODERATE_VULN moderate (accepted for workspace tools)"

  # Job 5: All checks passed
  all-checks-passed:
    name: All Checks Passed ✅
    runs-on: ubuntu-latest
    needs: [quality-checks, build, test, security]
    if: always()

    steps:
      - name: Check if all jobs succeeded
        run: |
          if [ "${{ needs.quality-checks.result }}" != "success" ] || \
             [ "${{ needs.build.result }}" != "success" ] || \
             [ "${{ needs.test.result }}" != "success" ] || \
             [ "${{ needs.security.result }}" != "success" ]; then
            echo "❌ Some checks failed"
            exit 1
          fi
          echo "✅ All checks passed successfully!"