ci.yml

name: CI

on:
  push:
    branches: [ main, develop ]
  pull_request:
    branches: [ main, develop ]
    types: [ opened, synchronize, reopened ]

jobs:
  test:
    name: Test Suite
    runs-on: ubuntu-latest

    services:
      postgres:
        image: postgres:16
        env:
          POSTGRES_USER: test
          POSTGRES_PASSWORD: test
          POSTGRES_DB: meshmonitor_test
        ports:
          - 5433:5432
        options: >-
          --health-cmd pg_isready
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5
      mysql:
        image: mysql:8
        env:
          MYSQL_ROOT_PASSWORD: root
          MYSQL_USER: test
          MYSQL_PASSWORD: test
          MYSQL_DATABASE: meshmonitor_test
        ports:
          - 3307:3306
        options: >-
          --health-cmd "mysqladmin ping -h localhost"
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5

    strategy:
      matrix:
        node-version: [20.x, 22.x, 24.x, 25.x]

    steps:
      - name: Checkout code
        uses: actions/checkout@v7
        with:
          submodules: recursive  # Initialize protobufs submodule for tests

      - name: Setup Node.js ${{ matrix.node-version }}
        uses: actions/setup-node@v7
        with:
          node-version: ${{ matrix.node-version }}
          cache: 'npm'

      - name: Cache dependencies
        uses: actions/cache@v6
        with:
          path: ~/.npm
          key: ${{ runner.os }}-node-${{ matrix.node-version }}-${{ hashFiles('**/package-lock.json') }}
          restore-keys: |
            ${{ runner.os }}-node-${{ matrix.node-version }}-
            ${{ runner.os }}-node-

      - name: Install dependencies
        run: npm install --legacy-peer-deps

      - name: Run lint ratchet
        # BLOCKING: fails only on new violations above the checked-in baseline.
        # Existing debt is frozen in eslint-baseline.json and burns down over time.
        # Regenerate baseline: npm run lint:baseline. Tracking: #3962 Task 1.4.
        run: npm run lint:ci

      - name: Run type checking
        run: npm run typecheck

      # Test-file type check runs on ONE Node version (non-blocking; tracks
      # toward a clean tsconfig.tests). Coverage generation + Codecov upload were
      # removed (#4172): they ran on a single leg, produced no enforced signal
      # (no token, no thresholds, no PR status check, no badge — Codecov was
      # already fail_ci_if_error:false), and @vitest/coverage-v8 hung for 30+ min
      # on Node 24, repeatedly blocking merges. `npm run test:coverage` remains
      # available for ad-hoc local reports.
      - name: Type-check tests (non-blocking)
        if: matrix.node-version == '24.x'
        run: npm run typecheck:tests
        # NON-BLOCKING: ~283 pre-existing test-type errors (mock/signature drift).
        # Flip to blocking (remove continue-on-error) once `npm run typecheck:tests` is clean (0 errors).
        # Tracking: remediation epic #3962 Task 1.2.
        continue-on-error: true

      - name: Run tests
        run: npm run test:run

  build:
    name: Build Check
    runs-on: ubuntu-latest
    needs: test

    steps:
      - name: Checkout code
        uses: actions/checkout@v7
        with:
          submodules: recursive  # Initialize protobufs submodule

      - name: Setup Node.js
        uses: actions/setup-node@v7
        with:
          node-version: '24.x'
          cache: 'npm'

      - name: Install dependencies
        run: npm install --legacy-peer-deps

      - name: Build frontend
        run: npm run build

      - name: Build server
        run: npm run build:server

      - name: Check build artifacts
        run: |
          echo "Checking frontend build..."
          ls -la dist/
          echo "Checking server build..."
          ls -la dist/server/

  docker:
    name: Docker Build
    runs-on: ubuntu-latest
    needs: test

    steps:
      - name: Checkout code
        uses: actions/checkout@v7
        with:
          submodules: recursive

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v4

      - name: Build Docker image
        uses: docker/build-push-action@v7
        with:
          context: .
          push: false
          load: true
          tags: meshmonitor:test
          cache-from: type=gha
          cache-to: type=gha,mode=max

      - name: Test Docker image
        run: |
          docker run --rm meshmonitor:test node --version
          docker run --rm meshmonitor:test ls -la /app/

  security:
    name: Security Scan
    runs-on: ubuntu-latest
    if: github.event_name == 'pull_request'

    steps:
      - name: Checkout code
        uses: actions/checkout@v7

      - name: Install Trivy
        run: |
          sudo apt-get install -y wget apt-transport-https gnupg lsb-release
          wget -qO - https://aquasecurity.github.io/trivy-repo/deb/public.key | gpg --dearmor | sudo tee /usr/share/keyrings/trivy.gpg > /dev/null
          echo "deb [signed-by=/usr/share/keyrings/trivy.gpg] https://aquasecurity.github.io/trivy-repo/deb $(lsb_release -sc) main" | sudo tee /etc/apt/sources.list.d/trivy.list
          sudo apt-get update
          sudo apt-get install -y trivy

      - name: Run Trivy vulnerability scanner
        run: trivy fs --scanners vuln --format sarif --output trivy-results.sarif --severity HIGH,CRITICAL .

      - name: Upload Trivy results to GitHub Security
        uses: github/codeql-action/upload-sarif@v4
        if: always()
        with:
          sarif_file: 'trivy-results.sarif'

      - name: Dependency audit
        run: npm audit --audit-level=moderate
        continue-on-error: true  # Don't fail on audit issues for now

  clamav:
    name: ClamAV Scan
    runs-on: ubuntu-latest
    if: github.event_name == 'pull_request'

    steps:
      - name: Checkout code
        uses: actions/checkout@v7

      - name: Install & update ClamAV
        run: |
          set -e
          sudo apt-get update
          sudo apt-get install -y clamav clamav-freshclam
          sudo systemctl stop clamav-freshclam || true
          sudo freshclam --verbose

      - name: Setup Node.js
        uses: actions/setup-node@v7
        with:
          node-version: 22.x
          cache: 'npm'

      - name: Install dependencies
        run: npm install --legacy-peer-deps

      - name: Verify ClamAV detects EICAR signature
        run: |
          set -euo pipefail
          printf 'X5O!P%%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*' > eicar.com
          status=0
          clamscan eicar.com > eicar.log 2>&1 || status=$?
          cat eicar.log
          if [ "$status" -ne 1 ]; then
            echo "ClamAV failed to detect EICAR test signature" >&2
            exit 1
          fi
          rm -f eicar.com eicar.log

      - name: Scan source tree
        run: |
          set -euo pipefail
          clamscan -ri --exclude-dir='^\.git$' . | tee clamav.log
          if grep -qE 'Infected files: [1-9][0-9]*' clamav.log; then
            echo "ClamAV found infected files!" >&2
            grep 'FOUND' clamav.log >&2
            exit 1
          fi

      - name: Upload scan results
        if: always()
        uses: actions/upload-artifact@v7
        with:
          name: clamav-scan-results
          path: clamav.log

  pr-comment:
    name: PR Comment
    runs-on: ubuntu-latest
    needs: [test, build, docker]
    if: github.event_name == 'pull_request'

    steps:
      - name: Comment on PR
        uses: actions/github-script@v9
        continue-on-error: true  # Don't fail if we can't comment
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          script: |
            const issue_number = context.payload.pull_request.number;
            const { owner, repo } = context.repo;

            const comment = `## ✅ CI Checks Passed

            All tests and builds completed successfully!

            - **Tests**: All unit tests passing
            - **Type Check**: No TypeScript errors
            - **Build**: Frontend and server built successfully
            - **Docker**: Image builds successfully

            Ready for review! 🚀`;

            // Check if we already commented
            const comments = await github.rest.issues.listComments({
              owner,
              repo,
              issue_number,
            });

            const botComment = comments.data.find(comment =>
              comment.user.type === 'Bot' &&
              comment.body.includes('CI Checks')
            );

            if (botComment) {
              // Update existing comment
              await github.rest.issues.updateComment({
                owner,
                repo,
                comment_id: botComment.id,
                body: comment
              });
            } else {
              // Create new comment
              await github.rest.issues.createComment({
                owner,
                repo,
                issue_number,
                body: comment
              });
            }