ci.yml

name: CI - Tests and Linting

on:
  pull_request:
    branches: [main, develop]
  push:
    branches: [main, develop]

jobs:
  lint-and-test:
    runs-on: ubuntu-latest

    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version-file: '.nvmrc'

      - name: Install dependencies
        run: npm ci --ignore-scripts

      - name: Run approved dependency scripts
        run: npm run install:approved

      - name: Verify install-script policy
        run: node --test scripts/supply-chain/install-approved.test.mjs

      - name: Check documentation contracts
        run: node --test scripts/documentation/contracts.test.mjs

      - name: Check Docker image contracts
        run: node --test scripts/deployment/docker-images.test.mjs

      - name: Run ESLint
        run: npm run lint

      - name: Run TypeScript type check - Backend
        run: npx tsc --noEmit
        working-directory: ./backend

      - name: Run TypeScript type check - Frontend
        run: npx tsc --noEmit
        working-directory: ./frontend

      - name: Check Svelte components
        run: npm run check:components

      - name: Run unit tests
        run: npm test -- --silent

      - name: Build backend
        run: node --test scripts/compilation/backend.test.mjs

      - name: Verify built-server shutdown signals
        run: node scripts/deployment/process-smoke.mjs

      - name: Build frontend
        run: npm run build:frontend

  postgres-suite:
    # The migration, transaction and upgrade tests that only run when a real
    # PostgreSQL server is reachable. Without this job they are skipped
    # everywhere except a maintainer's laptop (finding I10).
    runs-on: ubuntu-latest
    services:
      postgres:
        image: postgres:15
        env:
          POSTGRES_USER: pabawi
          POSTGRES_PASSWORD: pabawi
          POSTGRES_DB: pabawi
        ports: ['5432:5432']
        options: >-
          --health-cmd "pg_isready -U pabawi"
          --health-interval 5s
          --health-timeout 5s
          --health-retries 20
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version-file: '.nvmrc'
      - run: npm ci --ignore-scripts
      - run: npm run install:approved
      - name: Run the backend suite against PostgreSQL
        run: npx vitest run --silent
        working-directory: ./backend
        env:
          TEST_DATABASE_URL: postgres://pabawi:pabawi@localhost:5432/pabawi

  e2e:
    # The assembled app, served as it ships, against the hermetic SSH fixture.
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version-file: '.nvmrc'
      - run: npm ci --ignore-scripts
      - run: npm run install:approved
      - run: npx playwright install --with-deps chromium
      - run: npm run test:e2e
      - uses: actions/upload-artifact@v4
        if: failure()
        with:
          name: playwright-report
          path: playwright-report/

  ldap-acceptance:
    runs-on: ubuntu-latest
    timeout-minutes: 30
    strategy:
      fail-fast: false
      matrix:
        postgres: ['15', '17']
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version-file: '.nvmrc'
      - run: npm ci --ignore-scripts
      - run: npm run install:approved
      - name: Verify acceptance orchestration contracts
        run: node --test scripts/acceptance/*.test.mjs
      - name: Typecheck opt-in AD fixtures without directory access
        run: ./node_modules/.bin/tsc --project test/fixtures/ldap/tsconfig.ad.json
        working-directory: ./backend
      - name: Install fixture scanner
        run: |
          sudo apt-get update
          sudo apt-get install -y clamav
          sudo systemctl stop clamav-freshclam || true
          sudo freshclam
      - name: Install dedicated browser
        run: npx playwright install --with-deps chromium
      - name: Prepare PostgreSQL image
        run: docker pull postgres:${{ matrix.postgres }}
      - name: Run live LDAP and recovery matrix plus dedicated browser contracts
        run: >-
          npm run test:ldap -- --focused --browser --build-fixture
          --postgres-image postgres:${{ matrix.postgres }} --postgres-major ${{ matrix.postgres }}
          --output-root '${{ runner.temp }}/ldap-evidence'
      - name: Retain synthetic LDAP acceptance evidence
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: ldap-acceptance-postgres-${{ matrix.postgres }}
          retention-days: 14
          if-no-files-found: error
          # Only the synthetic runner output, never container filesystems or AD evidence.
          path: |
            ${{ runner.temp }}/ldap-evidence/**
            !${{ runner.temp }}/ldap-evidence/**/*.key
            !${{ runner.temp }}/ldap-evidence/**/fixture-downloads/**
            !${{ runner.temp }}/ldap-evidence/**/ca.pem

  secret-scan:
    # The pre-commit hook excludes docs, tests and e2e fixtures. This job scans
    # them too, so a credential committed under an excluded path is still
    # caught before merge (finding I10).
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: '3.12'
      - run: pip install detect-secrets==1.5.0
      - name: Scan the tracked tree against the reviewed baseline
        run: bash scripts/quality/secret-scan.sh

  dependency-audit:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version-file: '.nvmrc'
      - name: Audit the reviewed lockfile
        run: npm audit --json --audit-level=high --omit=dev > npm-audit.json
      - uses: actions/upload-artifact@v4
        if: always()
        with:
          name: npm-audit
          path: npm-audit.json

  docker-build-test:
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        include:
          - variant: bookworm-core
            file: Dockerfile
            target: core
            profile: core
          - variant: bookworm-batteries
            file: Dockerfile
            target: batteries
            profile: batteries
          - variant: alpine
            file: Dockerfile.alpine
            target: ""
            profile: bolt
          - variant: ubuntu
            file: Dockerfile.ubuntu
            target: ""
            profile: bolt
    steps:
      - uses: actions/checkout@v4
      - uses: docker/setup-buildx-action@v3
      - name: Build and verify shipped image
        run: |
          target=()
          if [ -n "${{ matrix.target }}" ]; then target=(--target "${{ matrix.target }}"); fi
          docker build --no-cache "${target[@]}" -f "${{ matrix.file }}" -t pabawi:test .
          bash scripts/supply-chain/image-smoke.sh pabawi:test "${{ matrix.profile }}"
          mkdir -p artifacts
          docker run --rm -i --entrypoint node pabawi:test < scripts/supply-chain/dependency-graph.cjs > artifacts/dependencies.json
          docker build --no-cache --target backend-deps -f "${{ matrix.file }}" -t pabawi:deps-repeat .
          docker run --rm -i --entrypoint node pabawi:deps-repeat < scripts/supply-chain/dependency-graph.cjs > artifacts/dependencies-repeat.json
          cmp artifacts/dependencies.json artifacts/dependencies-repeat.json
          if [ "${{ matrix.variant }}" = ubuntu ]; then
            docker run --rm --entrypoint ruby pabawi:test /opt/bolt/test-winrm-rubyzip.rb
            docker run --rm -i --entrypoint ruby pabawi:test < docker/bolt/dependency-graph.rb > artifacts/ruby-dependencies.json
            docker build --no-cache --target bolt-builder -f "${{ matrix.file }}" -t pabawi:ruby-repeat .
            docker run --rm -i --entrypoint ruby pabawi:ruby-repeat < docker/bolt/dependency-graph.rb > artifacts/ruby-dependencies-repeat.json
            cmp artifacts/ruby-dependencies.json artifacts/ruby-dependencies-repeat.json
          fi
      - name: Scan shipped image and generate SBOM
        continue-on-error: true
        run: bash scripts/supply-chain/scan-image.sh pabawi:test artifacts
      - name: Retain image evidence
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: image-evidence-${{ matrix.variant }}
          path: artifacts/*.json