ci.yml

name: CI

on:
  push:
    branches: [main, develop]
  pull_request:
    branches: [main, develop]
    types: [opened, synchronize, reopened, ready_for_review]

# Fork PRs use the same workflow; they run with read-only GITHUB_TOKEN and no repo secrets.
# If checks do not appear, a maintainer must approve workflow runs (Settings → Actions → Fork pull requests).
# We do not use pull_request_target with a full checkout of PR code here — that pattern can expose secrets to untrusted code.

concurrency:
  group: ci-${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
  cancel-in-progress: true

# Default permissions for all jobs - principle of least privilege
permissions:
  contents: read

jobs:
  lint-and-typecheck:
    name: Lint and Type Check
    runs-on: ubuntu-latest
    permissions:
      contents: read

    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version-file: '.nvmrc'
          cache: 'npm'

      - name: Install dependencies
        run: npm ci

      - name: Run linter
        run: npm run lint

      - name: Run type check
        run: npm run type-check

  security:
    name: Security Scanning
    runs-on: ubuntu-latest
    permissions:
      contents: read

    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version-file: '.nvmrc'
          cache: 'npm'

      - name: Install dependencies
        run: npm ci

      # Vulnerability scanning with npm audit
      - name: Run npm audit
        run: npm audit --audit-level=high

      # License compliance check (matches transitive licenses in production deps)
      - name: Check license compliance
        run: |
          npx license-checker --production --onlyAllow "MIT;MIT*;Apache-2.0;BSD-2-Clause;BSD-3-Clause;ISC;CC0-1.0;CC-BY-3.0;CC-BY-4.0;Unlicense;0BSD;BlueOak-1.0.0;GPL-3.0-only;GPL-3.0-or-later;Hippocratic-2.1;MPL-2.0;LGPL-3.0-or-later;(BSD-3-Clause OR GPL-2.0);MIT AND ISC" --summary

      # Secrets scanning with gitleaks
      - name: Run Gitleaks
        uses: gitleaks/gitleaks-action@v2
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          GITLEAKS_LICENSE: ${{ secrets.GITLEAKS_LICENSE }}

      # Generate SBOM (Software Bill of Materials)
      - name: Generate SBOM
        run: npx @cyclonedx/cyclonedx-npm --output-file sbom.json --output-format json

      - name: Upload SBOM artifact
        uses: actions/upload-artifact@v7
        with:
          name: sbom
          path: sbom.json
          retention-days: 30

  test:
    name: Test
    runs-on: ubuntu-latest
    permissions:
      contents: read

    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version-file: '.nvmrc'
          cache: 'npm'

      - name: Install dependencies
        run: npm ci

      - name: Run tests with coverage
        run: npm run test:coverage
        env:
          CI: true

      - name: Upload coverage reports
        uses: codecov/codecov-action@v6
        with:
          token: ${{ secrets.CODECOV_TOKEN }}
          files: ./coverage/lcov.info
          flags: unittests
          name: codecov-cursor-boston
          fail_ci_if_error: false
          verbose: true

      - name: Check coverage threshold
        run: |
          COVERAGE=$(cat coverage/coverage-summary.json | jq '.total.lines.pct')
          echo "Current coverage: $COVERAGE%"
          if (( $(echo "$COVERAGE < 50" | bc -l) )); then
            echo "::warning::Coverage is below 50% threshold"
          fi
        continue-on-error: true

  firestore-rules:
    name: Firestore rules tests
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Setup Java
        uses: actions/setup-java@v5
        with:
          distribution: 'temurin'
          java-version: '21'

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version-file: '.nvmrc'
          cache: 'npm'

      - name: Install dependencies
        run: npm ci

      - name: Run Firestore rules tests (emulator)
        run: npm run test:rules
        env:
          CI: true

  build:
    name: Build
    runs-on: ubuntu-latest
    needs: [lint-and-typecheck, test, firestore-rules, security]
    permissions:
      contents: read

    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version-file: '.nvmrc'
          cache: 'npm'

      - name: Install dependencies
        run: npm ci

      - name: Validate environment variables
        run: npm run validate-env
        env:
          # Use placeholder values for CI - actual values not needed for build validation
          NEXT_PUBLIC_FIREBASE_API_KEY: "test-api-key"
          NEXT_PUBLIC_FIREBASE_AUTH_DOMAIN: "test-project.firebaseapp.com"
          NEXT_PUBLIC_FIREBASE_PROJECT_ID: "test-project-id"
          NEXT_PUBLIC_FIREBASE_STORAGE_BUCKET: "test-project.appspot.com"
          NEXT_PUBLIC_FIREBASE_MESSAGING_SENDER_ID: "123456789"
          NEXT_PUBLIC_FIREBASE_APP_ID: "1:123456789:web:abcdef"
          NEXT_PUBLIC_FIREBASE_DATABASE_URL: "https://test-project.firebaseio.com"

      - name: Build application
        run: npm run build
        env:
          # Use placeholder values for CI build
          NEXT_PUBLIC_FIREBASE_API_KEY: "test-api-key"
          NEXT_PUBLIC_FIREBASE_AUTH_DOMAIN: "test-project.firebaseapp.com"
          NEXT_PUBLIC_FIREBASE_PROJECT_ID: "test-project-id"
          NEXT_PUBLIC_FIREBASE_STORAGE_BUCKET: "test-project.appspot.com"
          NEXT_PUBLIC_FIREBASE_MESSAGING_SENDER_ID: "123456789"
          NEXT_PUBLIC_FIREBASE_APP_ID: "1:123456789:web:abcdef"
          NEXT_PUBLIC_FIREBASE_DATABASE_URL: "https://test-project.firebaseio.com"

  docker:
    name: Docker Build
    runs-on: ubuntu-latest
    needs: [lint-and-typecheck, test, firestore-rules, security]
    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
    permissions:
      contents: read
      packages: write

    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v4

      - name: Build Docker image
        uses: docker/build-push-action@v7
        with:
          context: .
          file: docker/Dockerfile
          push: false
          tags: cursor-boston:${{ github.sha }}
          cache-from: type=gha
          cache-to: type=gha,mode=max
          build-args: |
            NEXT_PUBLIC_FIREBASE_API_KEY=build-placeholder
            NEXT_PUBLIC_FIREBASE_AUTH_DOMAIN=build-placeholder.firebaseapp.com
            NEXT_PUBLIC_FIREBASE_PROJECT_ID=build-placeholder
            NEXT_PUBLIC_FIREBASE_STORAGE_BUCKET=build-placeholder.appspot.com
            NEXT_PUBLIC_FIREBASE_MESSAGING_SENDER_ID=000000000000
            NEXT_PUBLIC_FIREBASE_APP_ID=1:000000000000:web:placeholder
            NEXT_PUBLIC_FIREBASE_DATABASE_URL=https://build-placeholder.firebaseio.com