ci.yml

name: CI

on:
  push:
    branches:
      - main
  pull_request:
    branches:
      - main

permissions:
  contents: read

jobs:
  # ── Frontend quality gate ─────────────────────────────────────────────────
  frontend:
    name: Frontend (lint → typecheck → build → test)
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: frontend
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-node@v4
        with:
          node-version-file: .nvmrc
          cache: npm
          cache-dependency-path: frontend/package-lock.json

      - name: Install dependencies
        run: npm ci

      - name: Lint (fail on warnings)
        run: npm run lint -- --max-warnings=0

      - name: Typecheck
        run: npm run typecheck

      - name: Build
        run: npm run build

      - name: Test
        run: npm test

  # ── Soroban ABI golden-vector drift guard ────────────────────────────────
  golden-vectors:
    name: Soroban ABI golden vectors
    runs-on: ubuntu-latest
    if: |
      github.event_name == 'push' ||
      contains(toJson(github.event.pull_request.changed_files), 'contracts/') ||
      contains(toJson(github.event.pull_request.changed_files), 'backend/src/soroban/') ||
      contains(toJson(github.event.pull_request.changed_files), 'backend/src/tx/')
    defaults:
      run:
        working-directory: backend
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-node@v4
        with:
          node-version: 22

      - run: npm install

      - name: Run golden-vector encoding tests
        run: npx jest --testPathPattern="golden-vectors" --no-coverage

      - name: Verify vectors are up-to-date (no uncommitted drift)
        run: |
          npx ts-node ../scripts/refresh-vectors.ts
          if ! git diff --exit-code backend/src/soroban/golden-vectors.json; then
            echo "::error::golden-vectors.json is stale. Run 'npm run refresh-vectors' locally, review the diff, and commit the updated file."
            exit 1
          fi

  # ── Smart contract (Rust / Soroban) ──────────────────────────────────────
  contract:
    name: Contract (Rust / Soroban)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@stable
        with:
          targets: wasm32-unknown-unknown

      - name: Cache Rust build artifacts
        uses: actions/cache@v4
        with:
          path: |
            ~/.cargo/registry
            ~/.cargo/git
            target/
          key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}
          restore-keys: ${{ runner.os }}-cargo-

      - name: Run contract tests
        run: cargo test --workspace --features testutils

      - name: Build WASM (release)
        run: cargo build --release --target wasm32-unknown-unknown --workspace

  # ── Backend unit tests ────────────────────────────────────────────────────
  unit-tests:
    name: Backend unit tests
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: backend

    env:
      REDIS_HOST: 127.0.0.1
      REDIS_PORT: 6379
      NODE_ENV: test

    steps:
      - uses: actions/checkout@v4

      - name: Start Redis
        run: |
          sudo apt-get update -qq
          sudo apt-get install -y redis-server
          sudo systemctl start redis-server
          redis-cli ping

      - uses: actions/setup-node@v4
        with:
          node-version: '20'

      - name: Install dependencies
        run: npm ci

      - name: Run unit tests
        run: npm test

  # ── Playwright E2E tests ──────────────────────────────────────────────────
  e2e-tests:
    name: Playwright E2E tests
    runs-on: ubuntu-latest
    needs: frontend
    defaults:
      run:
        working-directory: frontend
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-node@v4
        with:
          node-version: '20'

      - name: Install dependencies
        run: npm ci

      - name: Install Playwright browsers
        run: npx playwright install --with-deps

      - name: Run Playwright tests
        run: npx playwright test --reporter=html
        continue-on-error: true

      - name: Upload Playwright artifacts on failure
        if: failure()
        uses: actions/upload-artifact@v4
        with:
          name: playwright-failure-${{ github.run_id }}
          path: |
            test-results/
            playwright-report/
          retention-days: 14

  # ── Accessibility (axe) ───────────────────────────────────────────────────
  accessibility:
    name: Accessibility (axe / Playwright)
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: frontend
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-node@v4
        with:
          node-version: 22
          cache: npm
          cache-dependency-path: frontend/package-lock.json

      - run: npm ci
      - run: npm run build

      - name: Install Playwright browsers
        run: npx playwright install --with-deps chromium

      - name: Run axe accessibility checks
        run: npx playwright test tests/accessibility.spec.ts --reporter=list
        env:
          BASE_URL: http://localhost:3000

      - uses: actions/upload-artifact@v4
        if: failure()
        with:
          name: axe-report-${{ github.sha }}
          path: frontend/playwright-report/
          retention-days: 14