code_quality.yaml

name: Code Quality

on:
  pull_request:
    types: [synchronize, opened, reopened]

jobs:
  docker-lint:
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Lint Dockerfiles
        run: |
          docker run --rm -i hadolint/hadolint < Dockerfile.keystone
          docker run --rm -i hadolint/hadolint < Dockerfile.nextjs

  unit-tests:
    runs-on: ubuntu-latest
    if: ${{ github.actor != 'dependabot[bot]' }}
    timeout-minutes: 10
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Create .env file
        run: |
          echo "DATABASE_URL=${{ secrets.DATABASE_URL }}" > veterans/.env
          echo "SESSION_SECRET=${{ secrets.SESSION_SECRET }}" >> veterans/.env

      - name: Build app image
        run: docker compose build

      - name: Run tests
        run: docker compose run --rm app-nextjs npm run test -- --coverage

      - name: Save coverage report
        uses: actions/upload-artifact@v4
        with:
          name: coverage-report
          path: veterans/coverage/lcov.info

  lint:
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Create .env file
        run: echo "DATABASE_URL=${{ secrets.DATABASE_URL }}" > veterans/.env

      - name: Build app image
        run: docker compose build

      - name: Run linters
        run: docker compose run --rm app-nextjs npm run lint

  e2e-tests:
    runs-on: ubuntu-latest
    if: ${{ github.actor != 'dependabot[bot]' }}
    timeout-minutes: 10
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Create .env file
        run: |
          echo "DATABASE_URL=${{ secrets.DATABASE_URL }}" > veterans/.env
          echo "POSTGRES_PASSWORD=${{ secrets.POSTGRES_PASSWORD }}" >> veterans/.env
          echo "SESSION_SECRET=${{ secrets.SESSION_SECRET }}" >> veterans/.env
          echo "IS_GITHUB_ACTION=${{ secrets.IS_GITHUB_ACTION }}" >> veterans/.env

      - name: Get latest run ID for playwright-snapshots
        id: get-latest-run
        run: |
          for i in {1..3}; do
            response=$(curl -sL --max-time 10 \
              -H "Authorization: Bearer ${{ secrets.GITHUB_TOKEN }}" \
              -H "Accept: application/vnd.github+json" \
              "https://api.github.com/repos/${{ github.repository }}/actions/artifacts")

            if [ $? -eq 0 ]; then
              latest=$(echo "$response" | \
                jq -r '[.artifacts[] | select(.name == "playwright-snapshots")] | sort_by(.created_at) | last')

              if [ "$latest" != "null" ]; then
                run_id=$(echo "$latest" | jq -r '.workflow_run.id')
                echo "latest_run_id=$run_id" >> $GITHUB_ENV
                echo "Found latest run ID: $run_id"
                break
              fi
            fi
            echo "Attempt $i failed, retrying..."
            sleep 5
          done

      - name: Download Playwright snapshots artifact
        uses: actions/download-artifact@v4
        with:
          name: playwright-snapshots
          path: e2e/nextjs-test/screenshot-test.spec.ts-snapshots
          merge-multiple: true
          github-token: ${{ secrets.GITHUB_TOKEN }}
          repository: ${{ github.repository }}
          run-id: ${{ env.latest_run_id }}

      - name: Verify downloaded snapshots
        run: ls -la e2e/nextjs-test/screenshot-test.spec.ts-snapshots

      - name: Docker starts services
        run: docker compose up -d --build

      - name: Install Playwright Browsers (app-keystone)
        run: docker compose exec app-keystone npx playwright install --with-deps

      - name: Show Keystone logs
        run: docker compose logs app-keystone

      - name: Run Playwright tests (app-keystone)
        run: |
          timeout 600s docker compose exec app-keystone sh -c "npm run test:e2e -- e2e/keystone-test" || echo "TESTS_FAILED=true" >> $GITHUB_ENV
        continue-on-error: true

      - name: Install Playwright Browsers (app-nextjs)
        run: docker compose exec app-nextjs npx playwright install --with-deps

      - name: Copy snapshots to Docker container
        run: |
          docker cp e2e/nextjs-test/screenshot-test.spec.ts-snapshots razom-app-nextjs-1:/usr/src/app/e2e/nextjs-test/

      - name: Run Playwright tests (app-nextjs)
        run: |
          timeout 600s docker compose exec app-nextjs sh -c "npm run test:e2e -- e2e/nextjs-test" || echo "TESTS_FAILED=true" >> $GITHUB_ENV
        continue-on-error: true

      - name: Upload snapshots as new artifact
        uses: actions/upload-artifact@v4
        if: always()
        with:
          name: playwright-report
          path: veterans/playwright-report/
          retention-days: 20

      - name: Fail workflow if tests failed
        if: ${{ env.TESTS_FAILED == 'true' }}
        run: exit 1

  sonarqube:
    runs-on: ubuntu-latest
    if: ${{ github.actor != 'dependabot[bot]' }}
    needs: unit-tests
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Download coverage report
        uses: actions/download-artifact@v4
        with:
          name: coverage-report

      - name: SonarQube Scan
        uses: sonarsource/sonarqube-scan-action@v5.0.0
        env:
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}

      - name: SonarQube Quality Gate check
        uses: sonarsource/sonarqube-quality-gate-action@v1.1.0
        timeout-minutes: 5
        env:
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}

  deploy-trigger:
    runs-on: ubuntu-latest
    needs: [docker-lint, unit-tests, lint, e2e-tests, sonarqube]
    if: success()
    steps:
      - name: Trigger deploy workflow
        run: |
          echo "Triggering deploy workflow..."
          curl -X POST \
            -H "Accept: application/vnd.github+json" \
            -H "Authorization: Bearer ${{ secrets.PAT_TOKEN }}" \
            -H "Content-Type: application/json" \
            "https://api.github.com/repos/${{ github.repository }}/actions/workflows/deploy.yaml/dispatches" \
            -d "{
              \"ref\": \"${{ github.head_ref || github.ref_name }}\",
              \"inputs\": {
                \"confirm\": true,
                \"deploy-env\": \"preview\"
              }
            }"