ci.yml

name: CI

on:
  push:
    branches: [main, develop]
  pull_request:
    branches: [main, develop]

env:
  CARGO_TERM_COLOR: always
  RUST_BACKTRACE: 1

permissions:
  contents: read

jobs:
  # === Path filtering — decide what needs to run ===
  changes:
    name: Detect Changes
    runs-on: ubuntu-latest
    timeout-minutes: 2
    permissions:
      contents: read
      pull-requests: read
    outputs:
      docs: ${{ steps.filter.outputs.docs }}
      backend: ${{ steps.filter.outputs.backend }}
      frontend: ${{ steps.filter.outputs.frontend }}
      docker: ${{ steps.filter.outputs.docker }}
      github: ${{ steps.filter.outputs.github }}
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false
      - uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1
        id: filter
        with:
          filters: |
            docs:
              - 'docs/**'
              - '*.md'
              - 'README.md'
            backend:
              - 'apps/rook/src/**'
              - 'crates/**'
              - 'Cargo.toml'
              - 'Cargo.lock'
              - '**/Cargo.toml'
              - 'rust-toolchain.toml'
            frontend:
              - 'apps/rook/dashboard/**'
              - '!apps/rook/dashboard/e2e/**'
            docker:
              - 'Dockerfile*'
              - 'dev/e2e/**'
            github:
              - '.github/workflows/**'

  # === Reusable dashboard build (cached artifact) ===
  build-dashboard:
    name: Build Dashboard
    runs-on: ubuntu-latest
    needs: changes
    if: needs.changes.outputs.frontend == 'true' || needs.changes.outputs.backend == 'true' || needs.changes.outputs.github == 'true'
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false
      - uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6
      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version: 22
          cache: 'pnpm'
      - name: Install dependencies
        run: pnpm install
      - name: Build dashboard
        run: pnpm --filter @dallay/rook-dashboard run build
      - name: Upload dashboard dist
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: dashboard-dist
          path: apps/rook/dashboard/dist
          retention-days: 1

  # === Fast checks (parallel, no dependencies) ===
  fmt:
    name: Format
    runs-on: ubuntu-latest
    needs: changes
    if: needs.changes.outputs.backend == 'true' || needs.changes.outputs.github == 'true'
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false
      - uses: dtolnay/rust-toolchain@dd44c20b1206a46e25fba8503d5d7c9a33bd355a
        with:
          components: rustfmt
      - name: Check formatting
        run: cargo fmt --all -- --check

  markdown:
    name: Markdown
    runs-on: ubuntu-latest
    needs: changes
    if: needs.changes.outputs.docs == 'true' || needs.changes.outputs.github == 'true'
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false
      - uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6
      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version: 22
          cache: 'pnpm'
      - name: Install dependencies
        run: pnpm install
      - name: Lint markdown
        run: pnpm exec markdownlint-cli2 "*.md" "docs/**/*.md"

  # === Clippy + Check (need dashboard artifact) ===
  clippy:
    name: Clippy
    runs-on: ubuntu-latest
    needs: [changes, build-dashboard]
    if: needs.changes.outputs.backend == 'true' || needs.changes.outputs.github == 'true'
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false
      - name: Download dashboard dist
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: dashboard-dist
          path: apps/rook/dashboard/dist
      - uses: dtolnay/rust-toolchain@dd44c20b1206a46e25fba8503d5d7c9a33bd355a
        with:
          components: clippy
      - name: Cache cargo
        uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4
      - name: Run Clippy
        run: cargo clippy --workspace --all-targets -- -D warnings

  check:
    name: Check
    runs-on: ubuntu-latest
    needs: [changes, build-dashboard]
    if: needs.changes.outputs.backend == 'true' || needs.changes.outputs.github == 'true'
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false
      - name: Download dashboard dist
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: dashboard-dist
          path: apps/rook/dashboard/dist
      - uses: dtolnay/rust-toolchain@dd44c20b1206a46e25fba8503d5d7c9a33bd355a
      - name: Cache cargo
        uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4
      - name: Check workspace
        run: cargo check --workspace

  # === Tests (parallel after fast checks pass) ===
  test:
    name: Test (Rust)
    runs-on: ubuntu-latest
    needs: [changes, build-dashboard, fmt, clippy]
    if: needs.changes.outputs.backend == 'true' || needs.changes.outputs.github == 'true'
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false
      - name: Download dashboard dist
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: dashboard-dist
          path: apps/rook/dashboard/dist
      - uses: dtolnay/rust-toolchain@dd44c20b1206a46e25fba8503d5d7c9a33bd355a
      - name: Cache cargo
        uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4
      - name: Run tests
        run: cargo test --workspace --all-features

  test-frontend:
    name: Test (Frontend)
    runs-on: ubuntu-latest
    timeout-minutes: 30
    needs: [changes]
    if: needs.changes.outputs.frontend == 'true' || needs.changes.outputs.github == 'true'
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false
      - uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version: 22
          cache: 'pnpm'
      - name: Install dashboard dependencies
        run: pnpm install --filter @dallay/rook-dashboard
      - name: Run Vitest tests
        working-directory: apps/rook/dashboard
        run: pnpm exec vitest run

  test-e2e:
    name: Test (E2E)
    runs-on: ubuntu-latest
    timeout-minutes: 60
    needs: [changes, test, test-frontend]
    if: |
      always() &&
      (needs.changes.outputs.backend == 'true' || needs.changes.outputs.frontend == 'true' || needs.changes.outputs.docker == 'true' || needs.changes.outputs.github == 'true') &&
      needs.test.result != 'failure' &&
      needs.test-frontend.result != 'failure'
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false
      - uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version: 22
          cache: 'pnpm'
      - name: Install dashboard dependencies
        run: pnpm install --filter @dallay/rook-dashboard
      - name: Install Playwright browsers
        working-directory: apps/rook/dashboard
        run: pnpm exec playwright install --with-deps
      - name: Build E2E Docker image
        run: docker build --no-cache -f Dockerfile.dev -t rook:e2e-api-keys .
      - name: Run E2E tests
        run: ./dev/e2e/run-api-keys-e2e.sh --test
      - name: Cleanup
        if: always()
        run: ./dev/e2e/run-api-keys-e2e.sh --cleanup

  doc:
    name: Doc
    runs-on: ubuntu-latest
    needs: [changes, build-dashboard]
    if: needs.changes.outputs.backend == 'true' || needs.changes.outputs.github == 'true'
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false
      - name: Download dashboard dist
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: dashboard-dist
          path: apps/rook/dashboard/dist
      - uses: dtolnay/rust-toolchain@dd44c20b1206a46e25fba8503d5d7c9a33bd355a
        with:
          components: rustfmt, clippy
      - name: Cache cargo
        uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4
      - name: Build docs
        run: cargo doc --workspace --no-deps --document-private-items
        env:
          RUSTDOCFLAGS: -D warnings

  # === Security (parallel, merge gate) ===
  audit:
    name: Audit
    runs-on: ubuntu-latest
    needs: [changes, build-dashboard]
    if: needs.changes.outputs.backend == 'true' || needs.changes.outputs.github == 'true'
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false
      - name: Download dashboard dist
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: dashboard-dist
          path: apps/rook/dashboard/dist
      - uses: dtolnay/rust-toolchain@dd44c20b1206a46e25fba8503d5d7c9a33bd355a
      - name: Cache cargo
        uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4
      - name: Install cargo-audit
        run: cargo install cargo-audit
      - name: Run cargo audit
        run: cargo audit

  trivy-fs:
    name: Security / Trivy (filesystem + deps)
    runs-on: ubuntu-latest
    timeout-minutes: 15
    needs: changes
    if: needs.changes.outputs.backend == 'true' || needs.changes.outputs.docker == 'true' || needs.changes.outputs.github == 'true'
    permissions:
      contents: read
      security-events: write
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false
      - name: Create reports directory
        run: mkdir -p reports/trivy
      - name: Run Trivy filesystem + dependency scan
        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25
        with:
          version: v0.70.0
          scan-type: fs
          scan-ref: .
          scanners: vuln,misconfig
          severity: HIGH,CRITICAL
          ignore-unfixed: true
          format: sarif
          output: reports/trivy/trivy-pr.sarif
          exit-code: '1'
      - name: Upload Trivy SARIF
        if: always()
        uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e
        with:
          sarif_file: reports/trivy/trivy-pr.sarif
          category: trivy-fs

  gitleaks-pr:
    name: Security / Gitleaks (PR commits only)
    runs-on: ubuntu-latest
    timeout-minutes: 10
    needs: changes
    # Gitleaks scans git history for secrets - runs on all PRs regardless of path changes
    # to catch accidental commits of credentials in any file type
    permissions:
      contents: read
      security-events: write
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          fetch-depth: 50
          persist-credentials: false
      - name: Install Gitleaks CLI
        run: |
          curl -sSfL https://github.com/gitleaks/gitleaks/releases/download/v8.28.0/gitleaks_8.28.0_linux_x64.tar.gz \
            | tar -xzf - -C /usr/local/bin gitleaks
          gitleaks --version
      - name: Scan staged + recent commits
        run: |
          mkdir -p reports/gitleaks
          gitleaks git \
            --config .gitleaks.toml \
            --log-opts="--all -n 50" \
            --report-format sarif \
            --report-path reports/gitleaks/gitleaks-pr.sarif \
            --exit-code 1
      - name: Upload Gitleaks SARIF
        if: always()
        uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e
        with:
          sarif_file: reports/gitleaks/gitleaks-pr.sarif
          category: gitleaks-pr

  semgrep-pr:
    name: Security / Semgrep (SAST)
    runs-on: ubuntu-latest
    timeout-minutes: 20
    needs: changes
    if: needs.changes.outputs.backend == 'true' || needs.changes.outputs.docker == 'true' || needs.changes.outputs.github == 'true'
    permissions:
      contents: read
      security-events: write
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false
      - name: Install Semgrep CLI
        run: pip install semgrep==1.126.0
      - name: Run Semgrep SAST scan
        run: |
          mkdir -p reports/semgrep
          semgrep scan \
            --config p/rust \
            --config p/dockerfile \
            --config p/github-actions \
            --severity ERROR \
            --sarif \
            --output reports/semgrep/semgrep-pr.sarif
      - name: Fail on findings
        run: |
          FINDINGS_COUNT=$(jq '[.runs[].results[]] | length' reports/semgrep/semgrep-pr.sarif)
          if [ "$FINDINGS_COUNT" -eq 0 ]; then
            echo "No high-severity findings"
          else
            echo "High-severity Semgrep findings detected: $FINDINGS_COUNT finding(s)"
            exit 1
          fi
      - name: Upload Semgrep SARIF
        if: always()
        uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e
        with:
          sarif_file: reports/semgrep/semgrep-pr.sarif
          category: semgrep-pr

  # === Coverage (optional, only after tests pass) ===
  coverage:
    name: Coverage (Rust)
    runs-on: ubuntu-latest
    needs: [changes, build-dashboard, test]
    if: needs.changes.outputs.backend == 'true' || needs.changes.outputs.github == 'true'
    permissions:
      contents: read
      statuses: write
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false
      - name: Download dashboard dist
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: dashboard-dist
          path: apps/rook/dashboard/dist
      - uses: dtolnay/rust-toolchain@dd44c20b1206a46e25fba8503d5d7c9a33bd355a
      - name: Cache cargo
        uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4
      - name: Install cargo-llvm-cov
        run: cargo install cargo-llvm-cov
      - name: Generate coverage report
        run: cargo llvm-cov --lcov --output-path lcov.info
      - name: Upload coverage to Codecov
        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v6
        with:
          files: lcov.info
          flags: backend
          fail_ci_if_error: false
          verbose: true
        env:
          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
          CODECOV_DISABLE_VERIFICATION: true

  coverage-frontend:
    name: Coverage (Frontend)
    runs-on: ubuntu-latest
    needs: [changes, test-frontend]
    if: needs.changes.outputs.frontend == 'true' || needs.changes.outputs.github == 'true'
    permissions:
      contents: read
      statuses: write
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false
      - uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version: 22
          cache: 'pnpm'
      - name: Install dashboard dependencies
        run: pnpm install --filter @dallay/rook-dashboard
      - name: Run Vitest with coverage
        working-directory: apps/rook/dashboard
        run: pnpm exec vitest run --coverage --coverage.reporter=lcov --coverage.reporter=json --coverage.reportsDirectory=coverage
      - name: Upload coverage to Codecov
        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v6
        with:
          files: apps/rook/dashboard/coverage/lcov.info
          flags: frontend
          fail_ci_if_error: false
          verbose: true
        env:
          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
          CODECOV_DISABLE_VERIFICATION: true

  sonar:
    name: SonarCloud
    runs-on: ubuntu-latest
    needs: [changes, test, test-frontend]
    if: needs.changes.outputs.backend == 'true' || needs.changes.outputs.frontend == 'true' || needs.changes.outputs.github == 'true'
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false
      - uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version: 22
          cache: 'pnpm'
      - name: Install dependencies
        run: pnpm install
      - name: Generate frontend coverage
        if: needs.changes.outputs.frontend == 'true'
        working-directory: apps/rook/dashboard
        run: pnpm exec vitest run --coverage --coverage.reporter=lcov --coverage.reportsDirectory=coverage
      - name: SonarQube Scan
        if: env.SONAR_TOKEN != ''
        uses: SonarSource/sonarqube-scan-action@7006c4492b2e0ee0f816d36501671557c97f5995 # v8.1.0
        env:
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}

  # === Cross-compile validation (only on main/develop push, not PRs) ===
  build-targets:
    name: Build (cross-compile validation)
    runs-on: ubuntu-latest
    needs: [changes, build-dashboard, test]
    if: |
      github.event_name == 'push' &&
      (needs.changes.outputs.backend == 'true' || needs.changes.outputs.github == 'true')
    strategy:
      fail-fast: false
      matrix:
        target:
          - x86_64-unknown-linux-gnu
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false
      - name: Download dashboard dist
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: dashboard-dist
          path: apps/rook/dashboard/dist
      - uses: dtolnay/rust-toolchain@dd44c20b1206a46e25fba8503d5d7c9a33bd355a
        with:
          targets: ${{ matrix.target }}
      - name: Cache cargo
        uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4
      - name: Build for ${{ matrix.target }}
        run: cargo build -p rook --release --target ${{ matrix.target }}

  build-windows:
    name: Build (Windows validation)
    runs-on: windows-latest
    needs: [changes, build-dashboard, test]
    if: |
      github.event_name == 'push' &&
      (needs.changes.outputs.backend == 'true' || needs.changes.outputs.github == 'true')
    strategy:
      fail-fast: false
      matrix:
        target:
          - x86_64-pc-windows-msvc
          - aarch64-pc-windows-msvc
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false
      - name: Download dashboard dist
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: dashboard-dist
          path: apps/rook/dashboard/dist
      - uses: dtolnay/rust-toolchain@dd44c20b1206a46e25fba8503d5d7c9a33bd355a
        with:
          targets: ${{ matrix.target }}
      - name: Cache cargo
        uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4
      - name: Build for ${{ matrix.target }}
        run: cargo build -p rook --release --target ${{ matrix.target }}

  build-darwin:
    name: Build (Darwin validation)
    runs-on: macos-latest
    needs: [changes, build-dashboard, test]
    if: |
      github.event_name == 'push' &&
      (needs.changes.outputs.backend == 'true' || needs.changes.outputs.github == 'true')
    strategy:
      fail-fast: false
      matrix:
        target:
          - x86_64-apple-darwin
          - aarch64-apple-darwin
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false
      - name: Download dashboard dist
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: dashboard-dist
          path: apps/rook/dashboard/dist
      - uses: dtolnay/rust-toolchain@dd44c20b1206a46e25fba8503d5d7c9a33bd355a
        with:
          targets: ${{ matrix.target }}
      - name: Cache cargo
        uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4
      - name: Build for ${{ matrix.target }}
        run: cargo build -p rook --release --target ${{ matrix.target }}

  # === Multi-platform tests (only on main/develop push) ===
  test-multi:
    name: Test (${{ matrix.os }})
    runs-on: ${{ matrix.os }}
    needs: [changes, build-dashboard, test]
    if: |
      github.event_name == 'push' &&
      (needs.changes.outputs.backend == 'true' || needs.changes.outputs.github == 'true')
    strategy:
      fail-fast: false
      matrix:
        os: [macos-latest, windows-latest]
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false
      - name: Download dashboard dist
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: dashboard-dist
          path: apps/rook/dashboard/dist
      - uses: dtolnay/rust-toolchain@dd44c20b1206a46e25fba8503d5d7c9a33bd355a
        with:
          components: clippy
      - name: Cache cargo
        uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4
      - name: Run tests
        run: cargo test --workspace --all-features
      - name: Run clippy
        run: cargo clippy --workspace --all-targets -- -D warnings