ci.yml

name: CI/CD Pipeline

on:
  push:
    branches: [ main, develop ]
  pull_request:

env:
  CARGO_TERM_COLOR: always
  NODE_VERSION: '18'

jobs:
  # ─── Smart Contracts ─────────────────────────────────────────────
  contracts:
    name: Contracts
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v4

      - uses: dtolnay/rust-toolchain@stable
        with:
          toolchain: 1.85.0

      - name: Build contracts
        continue-on-error: true
        run: cd contracts && cargo build --lib

      - name: Run contract tests
        continue-on-error: true
        run: cd contracts && cargo test

      - name: Run gas benchmarks
        run: cd contracts && cargo test bench_ -- --nocapture

      - name: Generate gas report artifact
        if: always()
        run: |
          echo "=== StarkEd Contracts Gas Report ===" > contracts/gas-report.txt
          echo "Generated: $(date -u)" >> contracts/gas-report.txt
          echo "Commit: ${{ github.sha }}" >> contracts/gas-report.txt
          cd contracts && cargo test bench_gas_report -- --nocapture 2>&1 | tee -a gas-report.txt
        continue-on-error: true

      - name: Upload gas report
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: gas-report
          path: contracts/gas-report.txt
        continue-on-error: true

  # ─── Backend ─────────────────────────────────────────────────────
  backend:
    name: Backend
    runs-on: ubuntu-latest

    services:
      postgres:
        image: postgres:15
        env:
          POSTGRES_PASSWORD: postgres
          POSTGRES_DB: starked_test
        options: >-
          --health-cmd pg_isready
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5
        ports:
          - 5432:5432

      redis:
        image: redis:7
        options: >-
          --health-cmd "redis-cli ping"
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5
        ports:
          - 6379:6379

    steps:
      - uses: actions/checkout@v4

      - name: Setup Node.js ${{ env.NODE_VERSION }}
        uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION }}

      - name: Install dependencies
        uses: nick-fields/retry@v3
        with:
          timeout_minutes: 5
          max_attempts: 2
          retry_on: error
          command: cd backend && npm ci

      - name: Type check
        run: cd backend && npx tsc --noEmit

      - name: Lint
        continue-on-error: true
        run: cd backend && npm run lint

      - name: Test
        continue-on-error: true
        timeout-minutes: 10
        run: cd backend && npm run test:ci
        env:
          DATABASE_URL: postgresql://postgres:postgres@localhost:5432/starked_test
          REDIS_URL: redis://localhost:6379
          JWT_SECRET: test_secret

      - name: Build
        run: cd backend && npm run build

  # ─── Frontend ────────────────────────────────────────────────────
  frontend:
    name: Frontend
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v4

      - name: Setup Node.js ${{ env.NODE_VERSION }}
        uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION }}

      - name: Install dependencies
        uses: nick-fields/retry@v3
        with:
          timeout_minutes: 5
          max_attempts: 2
          retry_on: error
          command: cd frontend && npm install --legacy-peer-deps

      - name: Type check
        continue-on-error: true
        run: cd frontend && npx tsc --noEmit

      - name: Lint
        continue-on-error: true
        run: cd frontend && npm run lint

      - name: Test
        continue-on-error: true
        timeout-minutes: 10
        run: cd frontend && npm run test:ci

      - name: Build
        continue-on-error: true
        timeout-minutes: 15
        run: cd frontend && NODE_OPTIONS="--max-old-space-size=4096" npm run build

      - name: Start server for E2E tests
        run: |
          cd frontend
          npm run build 2>/dev/null || true
          npx next start -p 3000 &
          sleep 5
        env:
          NODE_OPTIONS: "--max-old-space-size=4096"

      - name: E2E Tests (Playwright)
        continue-on-error: true
        timeout-minutes: 20
        run: |
          cd frontend
          npx playwright install --with-deps chromium
          npm run test:e2e
        env:
          PLAYWRIGHT_BASE_URL: http://localhost:3000

      - name: Upload Playwright report
        if: always()
        continue-on-error: true
        uses: actions/upload-artifact@v4
        with:
          name: playwright-report
          path: frontend/playwright-report/
          retention-days: 7

  # ─── Dependency Audit ────────────────────────────────────────────
  dependency-audit:
    name: Dependency Audit
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v4

      - name: Setup Node.js ${{ env.NODE_VERSION }}
        uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION }}

      - name: Audit backend dependencies (high/critical)
        continue-on-error: true
        run: cd backend && npm audit --audit-level=high

      - name: Audit frontend dependencies (high/critical)
        continue-on-error: true
        run: cd frontend && npm audit --audit-level=high

  # ─── Cargo Audit (contracts) ─────────────────────────────────────
  cargo-audit:
    name: Cargo Audit
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v4

      - uses: dtolnay/rust-toolchain@stable
        with:
          toolchain: 1.85.0

      - name: Install cargo-audit
        run: cargo install cargo-audit --version 0.21.1 --locked

      - name: Audit contract dependencies
        continue-on-error: true
        run: cd contracts && cargo audit

  # ─── Gas Comparison (PR vs main) ─────────────────────────────────
  gas-comparison:
    name: Gas Comparison
    runs-on: ubuntu-latest
    if: github.event_name == 'pull_request'

    steps:
      - uses: actions/checkout@v4
        with:
          ref: ${{ github.event.pull_request.base.sha }}
          path: base

      - uses: actions/checkout@v4
        with:
          path: pr

      - uses: dtolnay/rust-toolchain@stable
        with:
          toolchain: stable

      - name: Run benchmarks on base (main)
        run: |
          cd base/contracts
          cargo test bench_ -- --nocapture 2>&1 | tee ../base-gas.txt
        continue-on-error: true

      - name: Run benchmarks on PR
        run: |
          cd pr/contracts
          cargo test bench_ -- --nocapture 2>&1 | tee ../pr-gas.txt
        continue-on-error: true

      - name: Compare gas reports
        run: |
          echo "### Gas Comparison Report" >> $GITHUB_STEP_SUMMARY
          echo "| Operation | Base (main) | PR | Change |" >> $GITHUB_STEP_SUMMARY
          echo "|-----------|-------------|-----|--------|" >> $GITHUB_STEP_SUMMARY
          echo "| (see artifacts) | - | - | - |" >> $GITHUB_STEP_SUMMARY
        continue-on-error: true

      - name: Upload base gas report
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: gas-report-base
          path: base/contracts/base-gas.txt
        continue-on-error: true

      - name: Upload PR gas report
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: gas-report-pr
          path: pr/contracts/pr-gas.txt
        continue-on-error: true

  # ─── Security Scan ───────────────────────────────────────────────
  security-scan:
    name: Security Scan
    runs-on: ubuntu-latest
    continue-on-error: true
    permissions:
      contents: read
      security-events: write

    steps:
      - uses: actions/checkout@v4

      - name: Run Trivy vulnerability scan
        uses: aquasecurity/trivy-action@master
        continue-on-error: true
        with:
          scan-type: 'fs'
          scan-ref: '.'
          format: 'sarif'
          output: 'trivy-results.sarif'
          severity: 'CRITICAL,HIGH'
          ignore-unfixed: true

      - name: Upload scan results
        # Only upload SARIF on push so code-scanning results
        # do not block pull requests with pre-existing deps.
        if: always() && github.event_name == 'push'
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: 'trivy-results.sarif'