ci.yml

name: CI

on:
  push:
    branches: [ main ]
  pull_request:
    branches: [ main ]

jobs:
  test:
    runs-on: ${{ matrix.os }}
    strategy:
      matrix:
        os: [ubuntu-latest, windows-latest, macos-latest]
        node-version: [18.x, 20.x]

    steps:
    - uses: actions/checkout@v4
    
    - name: Use Node.js ${{ matrix.node-version }}
      uses: actions/setup-node@v4
      with:
        node-version: ${{ matrix.node-version }}
        cache: 'npm'
    
    - name: Install dependencies
      run: npm ci
    
    - name: Check code style
      run: npm run lint --if-present
    
    - name: Run tests
      run: npm test --if-present
    
    - name: Test server startup
      run: |
        node scripts/test-servers.js
      timeout-minutes: 2

  validate-configs:
    runs-on: [self-hosted, runnerhub]
    steps:
    - uses: actions/checkout@v4
    
    - name: Validate JSON configs
      run: |
        for file in config/*.json .vscode/*.json; do
          if [ -f "$file" ]; then
            echo "Validating $file"
            node -e "JSON.parse(require('fs').readFileSync('$file', 'utf8'))" || exit 1
          fi
        done

  security:
    runs-on: [self-hosted, runnerhub]
    steps:
    - uses: actions/checkout@v4
      with:
        fetch-depth: 0  # Fetch full history for better secret scanning
    
    - name: Run security audit
      run: npm audit --audit-level=high
      continue-on-error: true
    
    - name: Check for secrets
      uses: trufflesecurity/trufflehog@main
      with:
        path: ./
        base: ""
        head: ""