ci.yml

name: CI/CD Pipeline

on:
  push:
    branches: [ main, develop ]
    paths-ignore:
      - 'README.md'
      - 'CONTRIBUTING.md'
      - 'DEVELOPMENT.md'
      - 'IMPROVEMENTS.md'
      - 'docs/**'
      - '**/*.md'
      - '.dockerignore'
      - '.gitignore'
  pull_request:
    branches: [ main, develop ]
    paths-ignore:
      - 'README.md'
      - 'CONTRIBUTING.md'
      - 'DEVELOPMENT.md'
      - 'IMPROVEMENTS.md'
      - 'docs/**'
      - '**/*.md'
      - '.dockerignore'
      - '.gitignore'

env:
  CARGO_TERM_COLOR: always
  DATABASE_URL: postgres://postgres:password@localhost:5432/keylo_test
  TEST_DATABASE_URL: postgres://postgres:password@localhost:5432/keylo_test

jobs:
  test:
    name: Run Tests
    runs-on: ubuntu-latest

    services:
      postgres:
        image: postgres:15
        env:
          POSTGRES_PASSWORD: password
          POSTGRES_DB: keylo_test
        options: >-
          --health-cmd pg_isready
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5
        ports:
          - 5432:5432

    steps:
    - name: Checkout code
      uses: actions/checkout@v4

    - name: Install Rust
      uses: dtolnay/rust-toolchain@stable

    - name: Set up Node.js
      uses: actions/setup-node@v4
      with:
        node-version: 24
        cache: npm
        cache-dependency-path: web/package-lock.json

    - name: Cache dependencies
      uses: actions/cache@v3
      with:
        path: |
          ~/.cargo/registry
          ~/.cargo/git
          target
        key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}
        restore-keys: |
          ${{ runner.os }}-cargo-

    - name: Check code formatting
      run: cargo fmt --all -- --check

    - name: Build setup web UI
      working-directory: web
      run: |
        npm ci
        npm run build

    - name: Wait for Postgres
      env:
        PGPASSWORD: password
      run: |
        until pg_isready -h localhost -p 5432 -U postgres; do
          echo "Waiting for postgres..."
          sleep 1
        done

    - name: Apply DB migrations for SQLx compile-time checks
      env:
        PGPASSWORD: password
      run: |
        for f in $(find migrations -maxdepth 1 -name '*.sql' | sort); do
          echo "Applying migration: $f"
          psql -h localhost -U postgres -d keylo_test -v ON_ERROR_STOP=1 -f "$f"
        done
        psql -h localhost -U postgres -d keylo_test -v ON_ERROR_STOP=1 -c "SELECT to_regclass('public.users') AS users_table;"

    - name: Run clippy
      run: cargo clippy -- -D warnings

    - name: Run unit tests
      run: cargo test --lib

    - name: Run integration tests
      run: cargo test --test integration_test

    - name: Run user integration tests
      run: cargo test --test user_integration_test

    - name: Run RBAC integration tests
      run: cargo test --test rbac_integration_test

    - name: Run OAuth integration tests
      run: cargo test --test oauth_integration_test

    - name: Run database integration tests
      run: cargo test --test database_integration_test

    - name: Run load tests
      run: cargo test --test load_test

    - name: Build release binary
      run: cargo build --release

  security-audit:
    name: Security Audit
    runs-on: ubuntu-latest

    steps:
    - name: Checkout code
      uses: actions/checkout@v4

    - name: Install Rust
      uses: dtolnay/rust-toolchain@stable

    - name: Install cargo-audit
      run: cargo install cargo-audit

    - name: Run security audit
      run: cargo audit --ignore RUSTSEC-2023-0071

  coverage:
    name: Code Coverage
    runs-on: ubuntu-latest

    services:
      postgres:
        image: postgres:15
        env:
          POSTGRES_PASSWORD: password
          POSTGRES_DB: keylo_test
        options: >-
          --health-cmd pg_isready
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5
        ports:
          - 5432:5432

    steps:
    - name: Checkout code
      uses: actions/checkout@v4

    - name: Install Rust
      uses: dtolnay/rust-toolchain@stable

    - name: Install cargo-tarpaulin
      run: cargo install cargo-tarpaulin

    - name: Wait for Postgres
      env:
        PGPASSWORD: password
      run: |
        until pg_isready -h localhost -p 5432 -U postgres; do
          echo "Waiting for postgres..."
          sleep 1
        done

    - name: Apply DB migrations for SQLx compile-time checks
      env:
        PGPASSWORD: password
      run: |
        for f in $(find migrations -maxdepth 1 -name '*.sql' | sort); do
          echo "Applying migration: $f"
          psql -h localhost -U postgres -d keylo_test -v ON_ERROR_STOP=1 -f "$f"
        done
        psql -h localhost -U postgres -d keylo_test -v ON_ERROR_STOP=1 -c "SELECT to_regclass('public.users') AS users_table;"

    - name: Run tests with coverage
      run: cargo tarpaulin --out Xml

    - name: Upload coverage to Codecov
      uses: codecov/codecov-action@v3
      with:
        file: cobertura.xml
        fail_ci_if_error: false