ci.yml

name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: read
  # required by go-ci.yml's gosec SARIF upload
  security-events: write

jobs:
  # ─── Go Build & Test ────────────────────────────────────────────────
  # test, lint, verify and security now come from the shared workflow. It
  # probes for Makefile targets per step and falls back to the plain go
  # commands these jobs used to run inline.
  ci:
    uses: xraph/workflows/.github/workflows/go-ci.yml@1fb7007e92faefba7fa820084412d853d552aad6 # v1
    with:
      # Deliberately a bare minor. The matrix job name embeds this string and the
      # branch ruleset requires "ci / Test (ubuntu-latest, go1.26)", so pinning a
      # patch here renames the job and that check can never report. The shared
      # workflow sets check-latest, so this still resolves to the newest patch.
      go-versions: '["1.26"]'
      os: '["ubuntu-latest"]'

  # ─── Store Conformance (Postgres + Mongo) ───────────────────────────
  # Runs the cross-backend store conformance suite against real Postgres
  # (testcontainers) and MongoDB (single-node replica set, so app/org cascade
  # transactions work). The -run filter below is what stops this job also
  # running the older per-backend store_test.go suites, which now pass on
  # postgres since env_id is seeded.
  #
  # That filter used to be justified here by the claim that the mongo suite
  # contains a hanging migration-lock test, TestMigrate_DoesNotBreakFreshLock.
  # It does not hang. Measured against a single-node rs0 replica set matching
  # this job's own service, it passes in 11 to 12 seconds over four runs,
  # waiting out the migration lock-acquire retry rather than blocking on it.
  # The claim was stale and cost at least one person time chasing a hang that
  # was not there.
  #
  # What that correction does not settle is whether the rest of the
  # integration-tagged tests belong in this job. There are 96 of them, this
  # pattern matches 7, and the remaining 89 are built by nothing and run by
  # nothing. That is a real question with a real cost either way, and it wants
  # deciding rather than inheriting. If you widen the filter, run them as a set
  # against main first, because the last count taken of them was taken against
  # a stale tree and was wrong.
  #
  # BLOCKING: all four backends (memory + sqlite from the `go` job, and
  # postgres + mongo here) must pass the same store contract, so behavioral
  # drift between implementations fails CI rather than shipping.
  #
  # The path covers ./plugins/... as well as ./store/..., because plugins ship
  # their own four-backend stores and drift between those is the same class of
  # bug. Packages with no matching test simply match nothing.
  #
  # The -run pattern matches three prefixes, and adding a fourth name to it
  # is a smell: prefer naming a new test to fit one of these.
  #
  #   TestConformance         the cross-backend store contract suites
  #   TestStoreConformance_   plugins/agentauth, which predates that name and
  #                           whose postgres and mongo halves were, before
  #                           this pattern, built by nothing and run by
  #                           nothing while looking like coverage
  #   TestMigration_          integration tests for a single migration, where
  #                           the thing under test is what the migration does
  #                           to data that is already there
  #
  # A check that runs zero tests is indistinguishable from a check that
  # passes, so anything integration-tagged that this pattern does not match
  # is dead weight in the tree.
  #
  # -p 1 is load-bearing. Every package here shares the one mongo database
  # this job starts, and at least one drops it during teardown, so running
  # package binaries concurrently produced "database is in the process of
  # being dropped" and IX lock timeouts in roughly one run in three. It did
  # not bite while the path was ./store/... alone, because store/mongo was
  # the only package touching mongo.
  integration:
    name: Store Conformance (pg + mongo)
    runs-on: ubuntu-latest
    needs: ci

    steps:
      - name: Checkout
        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6

      - name: Set up Go
        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
        with:
          go-version-file: go.mod
          cache: true
          cache-dependency-path: go.sum

      - name: Download modules
        run: go mod download

      - name: Start MongoDB (single-node replica set)
        run: |
          docker run -d --name mongo -p 27017:27017 mongo:7 --replSet rs0
          echo "Waiting for mongod..."
          for i in $(seq 1 30); do
            if docker exec mongo mongosh --quiet --eval 'db.runCommand({ ping: 1 })' >/dev/null 2>&1; then break; fi
            sleep 2
          done
          docker exec mongo mongosh --quiet --eval 'rs.initiate({_id:"rs0",members:[{_id:0,host:"localhost:27017"}]})'
          echo "Waiting for primary..."
          for i in $(seq 1 30); do
            if docker exec mongo mongosh --quiet --eval 'db.hello().isWritablePrimary' | grep -q true; then break; fi
            sleep 2
          done

      # TESTCONTAINERS_RYUK_DISABLED turns off the reaper, the container
      # testcontainers starts to clean up after a test process that dies without
      # tidying up after itself. The reaper is a flake source here. On
      # 2026-09-06 it failed to come up inside its own 60 second deadline and
      # took both postgres conformance suites down with it, before a line of
      # authsome code ran:
      #
      #   create container: reaper: wait for reaper: context deadline exceeded
      #
      # What it guards against cannot happen on this job. Every container start
      # in the tree pairs with an explicit Terminate in t.Cleanup, and this
      # runner is destroyed when the job ends, so a leaked container has nowhere
      # to leak to. Nothing sets this outside CI, so a local run still gets the
      # reaper, which is where the guard is worth having.
      - name: Run store conformance suite
        env:
          AUTHSOME_MONGO_URI: mongodb://localhost:27017/authsome_test?replicaSet=rs0&directConnection=true
          TESTCONTAINERS_RYUK_DISABLED: "true"
        run: go test -tags integration -p 1 -run '^TestConformance$|^TestStoreConformance_|^TestMigration_' -count=1 -timeout 15m ./store/... ./plugins/...

  # ─── Lint ───────────────────────────────────────────────────────────
  # ─── Private Paths ──────────────────────────────────────────────────
  # Fails if a path that must never ship is tracked in git.
  #
  # No `needs:` on purpose. This is a two-second check and it should report
  # before the Go matrix finishes, because the thing it catches is cheap to
  # fix now and impossible to fix later: Go's module proxy archives the whole
  # module tree at every tagged version and serves it forever. cloud/ shipped
  # that way in v0.0.1 through v0.0.16 and cannot be withdrawn.
  private-paths:
    name: Private Paths
    runs-on: ubuntu-latest

    steps:
      - name: Checkout
        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6

      - name: Check no forbidden path is tracked
        run: ./scripts/check-private-paths.sh

  lint:
    name: Lint
    runs-on: ubuntu-latest
    needs: ci

    steps:
      - name: Checkout
        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6

      - name: Set up Go
        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
        with:
          go-version-file: go.mod
          cache: true
          cache-dependency-path: go.sum

      - name: golangci-lint
        uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a # v9
        with:
          version: latest
          args: --timeout 10m

  # ─── Vulnerability Check ───────────────────────────────────────────
  # govulncheck reports only vulnerabilities in code paths this module
  # actually reaches, so a finding here is one to act on, not to triage.
  vuln:
    name: Vulnerability check
    runs-on: ubuntu-latest
    needs: ci

    steps:
      - name: Checkout
        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6

      - name: Set up Go
        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
        with:
          go-version-file: go.mod
          cache: true
          cache-dependency-path: go.sum

      - name: govulncheck
        run: go run golang.org/x/vuln/cmd/govulncheck@latest ./...

  # ─── Dependency Review ─────────────────────────────────────────────
  # On a pull request, refuse a dependency change that introduces a known
  # high-severity vulnerability or a disallowed licence.
  dependency-review:
    name: Dependency review
    runs-on: ubuntu-latest
    if: github.event_name == 'pull_request'
    permissions:
      contents: read

    steps:
      - name: Checkout
        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6

      - name: Review dependency changes
        uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0
        with:
          fail-on-severity: high

  # ─── Secret Scan ───────────────────────────────────────────────────
  # gitleaks scans the commits a pull request adds, and the commits a push
  # to main lands, for anything shaped like a credential. Fixtures that only
  # look like one are allowlisted by value in .gitleaks.toml.
  #
  # It runs the gitleaks CLI directly. gitleaks-action wants a paid licence
  # key on an organization account and stopped every run without one. The
  # binary is pinned by version and checksum, the same way the actions in
  # this file are pinned by commit.
  gitleaks:
    name: Secret scan
    runs-on: ubuntu-latest
    permissions:
      contents: read
    env:
      GITLEAKS_VERSION: 8.30.1
      GITLEAKS_SHA256: 551f6fc83ea457d62a0d98237cbad105af8d557003051f41f3e7ca7b3f2470eb

    steps:
      - name: Checkout
        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
        with:
          fetch-depth: 0

      - name: Install gitleaks
        working-directory: ${{ runner.temp }}
        run: |
          curl -sSfL -o gitleaks.tar.gz \
            "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz"
          echo "${GITLEAKS_SHA256}  gitleaks.tar.gz" | sha256sum -c -
          tar -xzf gitleaks.tar.gz gitleaks
          echo "$RUNNER_TEMP" >> "$GITHUB_PATH"

      # A push to main can't be a force push (the ruleset blocks it), so
      # BEFORE is always an ancestor. It's all zeros only on the first push
      # of a branch, and then everything reachable is new.
      - name: gitleaks
        env:
          EVENT: ${{ github.event_name }}
          PR_BASE: ${{ github.event.pull_request.base.sha }}
          PR_HEAD: ${{ github.event.pull_request.head.sha }}
          BEFORE: ${{ github.event.before }}
          AFTER: ${{ github.sha }}
        run: |
          if [ "$EVENT" = "pull_request" ]; then
            range="$PR_BASE..$PR_HEAD"
          elif [ -n "$BEFORE" ] && [ "$BEFORE" != "0000000000000000000000000000000000000000" ]; then
            range="$BEFORE..$AFTER"
          else
            range="$AFTER"
          fi
          echo "Scanning $range"
          gitleaks git --no-banner --redact --verbose --log-opts="--no-merges $range" .

  # ─── Format Check ──────────────────────────────────────────────────
  format:
    name: Format
    runs-on: ubuntu-latest

    steps:
      - name: Checkout
        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6

      - name: Set up Go
        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
        with:
          go-version-file: go.mod
          cache: true
          cache-dependency-path: go.sum

      - name: Install goimports
        run: go install golang.org/x/tools/cmd/goimports@latest

      - name: Check formatting (goimports)
        run: |
          OUTPUT=$(goimports -l -local github.com/xraph/authsome .)
          if [ -n "$OUTPUT" ]; then
            echo "::error::The following files need goimports formatting:"
            echo "$OUTPUT"
            exit 1
          fi

  # ─── SDK Generation ──────────────────────────────────────────────
  sdkgen:
    name: SDK Generation
    runs-on: ubuntu-latest
    needs: ci

    steps:
      - name: Checkout
        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6

      - name: Set up Go
        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
        with:
          go-version-file: go.mod
          cache: true
          cache-dependency-path: go.sum

      - name: Generate SDKs
        run: make -C sdkgen generate SDK_OUT=../sdk

      # The same generator also emits embedded-mode clients into the ui and
      # flutter packages. Those were left out of the check below when it was
      # first written, and drifted roughly three months behind the routes as a
      # result — long enough that catching up meant a breaking change to both
      # packages rather than a regeneration. They are generated and compared
      # here for the same reason the standalone SDKs are.
      - name: Generate embedded clients
        run: |
          make -C sdkgen generate-ui-core
          make -C sdkgen generate-flutter-core

      # The steps above regenerate into the working tree. Until this check
      # existed nothing compared the result against what is committed, so a
      # change to a route or a request struct could ship without spec.json or
      # the SDKs ever catching up, and the job still went green. That is how
      # the SSO connection_id field reached main described nowhere in the spec.
      - name: Check the committed SDKs match the generated ones
        run: |
          paths="sdk/ sdkgen/spec.json ui/packages/core/src/generated flutter/packages/authsome_core/lib/src/generated"
          if ! git diff --quiet -- $paths; then
            echo "::error::Generated SDKs differ from what is committed. Run: make -C sdkgen generate SDK_OUT=../sdk && make -C sdkgen generate-ui-core && make -C sdkgen generate-flutter-core"
            git diff --stat -- $paths
            git diff -- sdkgen/spec.json | head -200
            exit 1
          fi
          echo "Committed SDKs are up to date."

      - name: Upload SDK artifacts
        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
        with:
          name: authsome-sdk
          path: sdk/
          retention-days: 14

  # ─── JS/TypeScript ──────────────────────────────────────────────────
  js:
    name: JS/TypeScript
    runs-on: ubuntu-latest

    steps:
      - name: Checkout
        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6

      - name: Setup Node.js
        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
        with:
          node-version: "20"

      - name: Setup pnpm
        uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4
        with:
          version: 9

      - name: Install dependencies
        run: cd ui && pnpm install --frozen-lockfile

      - name: Audit dependencies
        run: cd ui && pnpm audit --audit-level=high

      - name: Build
        run: cd ui && pnpm run build

      - name: Typecheck
        run: cd ui && pnpm run typecheck

      # Neither of these ran here before. `pnpm lint` had been failing in
      # ui-components for long enough to accumulate 13 findings, and nothing
      # reported it, because this job only built and typechecked. The tests are
      # added for the same reason: a harness CI never runs is only marginally
      # more visible than a lint that CI never runs.
      - name: Lint
        run: cd ui && pnpm run lint

      - name: Test
        run: cd ui && pnpm run test

      - name: Build SDK TypeScript
        run: |
          cd sdk/typescript
          npm install
          npm run build

      - name: Test SDK TypeScript
        run: cd sdk/typescript && npm test

  # ─── Flutter ────────────────────────────────────────────────────────
  flutter:
    name: Flutter
    runs-on: ubuntu-latest

    steps:
      - name: Checkout
        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6

      - name: Setup Flutter
        uses: subosito/flutter-action@1a449444c387b1966244ae4d4f8c696479add0b2 # v2
        with:
          channel: stable

      - name: Get dependencies (workspace)
        run: cd flutter && flutter pub get

      # The example bundles .env as an asset and the file is not in git, so
      # analyze warns about a missing asset. Do what the example's README
      # asks a developer to do.
      - name: Provide the example's .env
        run: cp flutter/example/.env.example flutter/example/.env

      - name: Analyze (workspace)
        run: cd flutter && flutter analyze --no-fatal-infos

      - name: Test SDK Dart
        run: cd sdk/dart && dart pub get && dart test