ci.yml

name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

concurrency:
  group: ci-${{ github.ref }}
  cancel-in-progress: true

jobs:
  # ---- Build Runtime (Node 20 + 22) ----
  build-runtime:
    name: CI / Build (Runtime)
    runs-on: ubuntu-latest

    strategy:
      matrix:
        node-version: [20, 22]

    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-node@v4
        with:
          node-version: ${{ matrix.node-version }}
          cache: npm

      - name: Install root dependencies
        run: npm ci

      - name: Install WebUI dependencies
        run: cd web && npm ci

      - name: Build SDK workspace
        run: npm run build -w packages/sdk

      - name: Build full project
        run: npm run build

      - name: CLI smoke test
        run: node dist/cli/index.js --help

      - name: Upload build artifacts
        if: matrix.node-version == 20
        uses: actions/upload-artifact@v4
        with:
          name: dist-ci-${{ github.sha }}
          path: dist/
          retention-days: 7

  # ---- Build SDK with DTS ----
  build-sdk:
    name: CI / Build (SDK with DTS)
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-node@v4
        with:
          node-version: 20
          cache: npm

      - name: Install root dependencies
        run: npm ci

      - name: Build SDK with type declarations
        run: npm run build -w packages/sdk

      - name: Verify DTS output
        run: |
          if [ ! -f "packages/sdk/dist/index.d.ts" ]; then
            echo "Error: TypeScript declarations not generated"
            exit 1
          fi
          echo "DTS generated successfully: packages/sdk/dist/index.d.ts"

  # ---- Lint (pull_request only) ----
  lint:
    name: CI / Lint
    runs-on: ubuntu-latest
    if: github.event_name == 'pull_request'

    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-node@v4
        with:
          node-version: 20
          cache: npm

      - name: Install root dependencies
        run: npm ci

      - name: Build SDK (required for lint)
        run: npm run build -w packages/sdk

      - name: Lint
        run: npm run lint

      - name: Format check
        run: npm run format:check

  # ---- Tests (pull_request only) ----
  test:
    name: CI / Test
    runs-on: ubuntu-latest
    if: github.event_name == 'pull_request'

    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-node@v4
        with:
          node-version: 20
          cache: npm

      - name: Install root dependencies
        run: npm ci

      - name: Build SDK workspace
        run: npm run build -w packages/sdk

      - name: Test with coverage
        run: npm run test:coverage

      - name: Upload coverage report
        uses: actions/upload-artifact@v4
        with:
          name: coverage-${{ github.sha }}
          path: coverage/
          retention-days: 7

      - name: Coverage summary
        run: |
          echo "## Test Coverage" >> "$GITHUB_STEP_SUMMARY"
          echo "" >> "$GITHUB_STEP_SUMMARY"
          echo '```' >> "$GITHUB_STEP_SUMMARY"
          cat coverage/coverage-summary.json | node -e "
            const d = JSON.parse(require('fs').readFileSync('/dev/stdin','utf8')).total;
            console.log('Statements : ' + d.statements.pct + '%');
            console.log('Branches   : ' + d.branches.pct + '%');
            console.log('Functions  : ' + d.functions.pct + '%');
            console.log('Lines      : ' + d.lines.pct + '%');
          " || cat coverage/coverage-summary.json
          echo '```' >> "$GITHUB_STEP_SUMMARY"

  # ---- TypeScript check (pull_request only) ----
  typecheck:
    name: CI / TypeScript
    runs-on: ubuntu-latest
    if: github.event_name == 'pull_request'

    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-node@v4
        with:
          node-version: 20
          cache: npm

      - name: Install root dependencies
        run: npm ci

      - name: Build SDK (required for typecheck)
        run: npm run build -w packages/sdk

      - name: Type check
        run: npm run typecheck

  # ---- Security audit ----
  security:
    name: Security audit
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-node@v4
        with:
          node-version: 20
          cache: npm

      - name: Install root dependencies
        run: npm ci

      - name: Security audit
        run: npm run audit:ci

  # ---- Push-only quality checks (lint + typecheck + tests on main) ----
  push-quality:
    name: CI / Quality (push)
    runs-on: ubuntu-latest
    if: github.event_name == 'push'

    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-node@v4
        with:
          node-version: 20
          cache: npm

      - name: Install root dependencies
        run: npm ci

      - name: Build SDK workspace
        run: npm run build -w packages/sdk

      - name: Type check
        run: npm run typecheck

      - name: Lint
        run: npm run lint

      - name: Test with coverage
        run: npm run test:coverage

  # ---- Deploy to Vercel (pull_request only) ----
  deploy-vercel:
    name: Deploy to Vercel
    runs-on: ubuntu-latest
    needs: [build-runtime, typecheck]
    if: github.event_name == 'pull_request'
    environment:
      name: pr-preview
      url: ${{ steps.deploy.outputs.preview-url }}

    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-node@v4
        with:
          node-version: 20
          cache: npm

      - name: Download build artifacts
        uses: actions/download-artifact@v4
        with:
          name: dist-ci-${{ github.sha }}
          path: dist/

      - name: Install WebUI dependencies
        run: cd web && npm ci

      - name: Build WebUI
        run: cd web && npm run build

      - name: Deploy to Vercel
        id: deploy
        uses: amondnet/vercel-action@v25
        with:
          vercel-token: ${{ secrets.VERCEL_TOKEN }}
          vercel-org-id: ${{ secrets.VERCEL_ORG_ID }}
          vercel-project-id: ${{ secrets.VERCEL_PROJECT_ID }}
          working-directory: ./web
          scope: ${{ secrets.VERCEL_ORG_ID }}
        continue-on-error: true

      - name: Skip note (no Vercel secrets)
        if: steps.deploy.outcome == 'skipped' || steps.deploy.outcome == 'failure'
        run: echo "Vercel deploy skipped — VERCEL_TOKEN / VERCEL_ORG_ID / VERCEL_PROJECT_ID secrets not configured"