ci.yml

name: CI

on:
  push:
    branches: ["**"]
  pull_request:

env:
  RUSTFLAGS: -D warnings
  CARGO_INCREMENTAL: 0
  LLVM_PROFILE_FILE: target/coverage/cheese-%p-%m.profraw

jobs:
  backend-e2e:
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: backend
    steps:
      - uses: actions/checkout@v4

      - uses: pnpm/action-setup@v4
        with:
          version: 10

      - uses: actions/setup-node@v4
        with:
          node-version: 20
          cache: pnpm
          cache-dependency-path: backend/pnpm-lock.yaml

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Run E2E tests
        run: pnpm test:e2e
        env:
          NODE_ENV: test

  ci:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Install Rust
        uses: dtolnay/rust-toolchain@stable
        with:
          targets: wasm32v1-none

      - name: Install cargo-tarpaulin
        uses: taiki-e/install-action@v2
        with:
          tool: cargo-tarpaulin

      - name: Install Rust wasm target
        run: rustup target add wasm32v1-none

      - name: cargo test
        run: cargo test

      - name: Generate coverage report
        run: |
          mkdir -p target/coverage
          cargo tarpaulin \
            --workspace \
            --out Xml \
            --output-dir target/coverage \
            --exclude-files "*/tests/*" \
            --verbose \
            --fail-under 85

      - name: Upload coverage to Codecov
        uses: codecov/codecov-action@v4
        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
        with:
          files: target/coverage/cobertura.xml
          flags: rust
          name: cheese-contracts
          fail_ci_if_error: false
        env:
          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}

      - name: wasm build
        run: cargo wasm-build

      - name: Upload WASM artifacts
        uses: actions/upload-artifact@v4
        with:
          name: wasm-contracts
          path: |
            contracts/paylink/target/wasm32v1-none/release/paylink.wasm
            contracts/cheese_pay/target/wasm32v1-none/release/cheese_pay.wasm
          retention-days: 30

  backend-migration-safety:
    runs-on: ubuntu-latest
    services:
      postgres:
        image: postgres:16
        env:
          POSTGRES_USER: postgres
          POSTGRES_PASSWORD: postgres
          POSTGRES_DB: cheesepay
        ports:
          - 5432:5432
        options: >-
          --health-cmd "pg_isready -U postgres -d cheesepay"
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5
    defaults:
      run:
        working-directory: backend
    env:
      DB_HOST: localhost
      DB_PORT: 5432
      DB_USER: postgres
      DB_PASS: postgres
      DB_NAME: cheesepay
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-node@v4
        with:
          node-version: 22

      - uses: pnpm/action-setup@v4
        with:
          version: 10.30.2

      - name: Install backend dependencies
        run: pnpm install --frozen-lockfile

      - name: Migration safety check
        run: pnpm migration:check

      - name: Migration rollback check
        run: pnpm migration:rollback:check

  backend-migration-uncommitted:
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: backend
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-node@v4
        with:
          node-version: 22

      - uses: pnpm/action-setup@v4
        with:
          version: 10.30.2

      - name: Install backend dependencies
        run: pnpm install --frozen-lockfile

      - name: Check for uncommitted migration files
        run: pnpm migration:uncommitted:check

  backend-sql-injection-check:
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: backend
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-node@v4
        with:
          node-version: 22

      - uses: pnpm/action-setup@v4
        with:
          version: 10.30.2

      - name: Install backend dependencies
        run: pnpm install --frozen-lockfile

      - name: ESLint security check
        run: pnpm eslint "{src,apps,libs,test}/**/*.ts" --max-warnings=0

      - name: Scan for raw SQL string concatenation
        # Fails if any production source file uses .query() with a template
        # literal or string concatenation — the only allowed form is
        # .query(sql, params) where sql is a plain string literal with no
        # interpolation, or QueryBuilder calls.
        run: |
          echo "Scanning for forbidden raw SQL patterns..."

          # Pattern 1: .query(`  — template literal passed to .query()
          if grep -rn --include="*.ts" \
               --exclude-dir=node_modules \
               --exclude="*.spec.ts" \
               --exclude="*.e2e-spec.ts" \
               --exclude="*.integration-spec.ts" \
               --exclude-dir=test \
               '\.query(`' src/; then
            echo "ERROR: Raw SQL template literals found. Use QueryBuilder with bound parameters."
            exit 1
          fi

          # Pattern 2: .query(  followed by string + variable concatenation
          if grep -rn --include="*.ts" \
               --exclude-dir=node_modules \
               --exclude="*.spec.ts" \
               --exclude="*.e2e-spec.ts" \
               --exclude="*.integration-spec.ts" \
               --exclude-dir=test \
               -P '\.query\([^)]*\+' src/; then
            echo "ERROR: Raw SQL string concatenation found. Use QueryBuilder with bound parameters."
            exit 1
          fi

          echo "No forbidden raw SQL patterns detected."

  backend-test:
    runs-on: ubuntu-latest
    services:
      postgres:
        image: postgres:16
        env:
          POSTGRES_USER: postgres
          POSTGRES_PASSWORD: postgres
          POSTGRES_DB: cheesepay
        ports:
          - 5432:5432
        options: >-
          --health-cmd "pg_isready -U postgres -d cheesepay"
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5
    defaults:
      run:
        working-directory: backend
    env:
      DB_HOST: localhost
      DB_PORT: 5432
      DB_USER: postgres
      DB_PASS: postgres
      DB_NAME: cheesepay
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-node@v4
        with:
          node-version: 22

      - uses: pnpm/action-setup@v4
        with:
          version: 10.30.2

      - name: Install backend dependencies
        run: pnpm install --frozen-lockfile

      - name: Run tests with coverage
        run: pnpm test:cov

      - name: Upload coverage to Codecov
        uses: codecov/codecov-action@v4
        with:
          files: coverage/lcov.info
          flags: backend
          name: backend
          fail_ci_if_error: true
        env:
          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}