frontend-ci.yml

name: Frontend CI

# Runs on every push/PR that touches the frontend directory.
on:
  push:
    branches:
      - main
    paths:
      - 'frontend/**'
      - '.github/workflows/frontend-ci.yml'
  pull_request:
    branches:
      - main
    paths:
      - 'frontend/**'
      - '.github/workflows/frontend-ci.yml'

permissions:
  contents: read

jobs:
  # ── 1. Lint ──────────────────────────────────────────────────────────────────
  lint:
    name: ESLint
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: frontend
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version-file: .nvmrc
          cache: npm
          cache-dependency-path: frontend/package-lock.json

      - name: Install dependencies
        run: npm ci

      - name: Lint (fail on warnings)
        run: npm run lint

  # ── 2. Typecheck ─────────────────────────────────────────────────────────────
  typecheck:
    name: TypeScript typecheck
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: frontend
    env:
      # Build-time env vars required by next.config.mjs validation
      NEXT_PUBLIC_API_URL: https://api.example.com
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version-file: .nvmrc
          cache: npm
          cache-dependency-path: frontend/package-lock.json

      - name: Install dependencies
        run: npm ci

      - name: Typecheck
        run: npm run typecheck

  # ── 3. Build ─────────────────────────────────────────────────────────────────
  build:
    name: Next.js build
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: frontend
    env:
      NEXT_PUBLIC_API_URL: https://api.example.com
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version-file: .nvmrc
          cache: npm
          cache-dependency-path: frontend/package-lock.json

      - name: Install dependencies
        run: npm ci

      - name: Build
        run: npm run build

  # ── 4. Unit tests ─────────────────────────────────────────────────────────────
  test:
    name: Jest unit tests
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: frontend
    env:
      NEXT_PUBLIC_API_URL: https://api.example.com
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version-file: .nvmrc
          cache: npm
          cache-dependency-path: frontend/package-lock.json

      - name: Install dependencies
        run: npm ci

      - name: Run tests
        run: npm test

  # ── 5. Dependency audit ───────────────────────────────────────────────────────
  audit:
    name: npm audit
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: frontend
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version-file: .nvmrc
          cache: npm
          cache-dependency-path: frontend/package-lock.json

      - name: Install dependencies
        run: npm ci

      - name: Audit npm dependencies (fail on high/critical)
        run: npm audit --audit-level=high

  # ── 6. CSP allowlist drift guard ─────────────────────────────────────────────
  csp-check:
    name: CSP allowlist
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: frontend
    env:
      NEXT_PUBLIC_API_URL: https://api.example.com
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version-file: .nvmrc
          cache: npm
          cache-dependency-path: frontend/package-lock.json

      - name: Install dependencies
        run: npm ci

      - name: Check CSP allowlist
        run: npm run check-csp

  # ── 7. No deleted-route imports guard ────────────────────────────────────────
  no-deleted-routes:
    name: No deleted route references
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Ensure no files link to the deleted /policy routes
        run: |
          # The /policy/* routes were removed in favour of /policies/*.
          # Any new reference to these paths is a regression.
          PATTERNS=(
            "href=['\"/]/policy['\"/]"
            "href=['\"/]/policy/"
            "push\(['\"/]/policy['\"/]\)"
            "push\(['\"/]/policy/"
            "ctaHref.*['\"/]/policy['\"/]"
            "from.*QuoteAPI"
            "import.*QuoteAPI"
          )

          found=0
          for pattern in "${PATTERNS[@]}"; do
            matches=$(grep -rn --include="*.ts" --include="*.tsx" "$pattern" frontend/src/ 2>/dev/null || true)
            if [ -n "$matches" ]; then
              echo "::error::Deleted route/export reference detected — $pattern"
              echo "$matches"
              found=$((found + 1))
            fi
          done

          if [ "$found" -gt 0 ]; then
            echo "::error::$found deleted reference(s) found. Update them to use /policies before merging."
            exit 1
          fi
          echo "✅ No deleted route references detected"