api-testing.yml

name: Comprehensive API Testing

on:
  push:
    branches: [ main, develop ]
  pull_request:
    branches: [ main ]
  schedule:
    - cron: '0 2 * * *'  # Daily at 2 AM

jobs:
  api-tests:
    runs-on: ubuntu-latest
    
    services:
      postgres:
        image: postgres:15
        env:
          POSTGRES_PASSWORD: test
          POSTGRES_USER: test
          POSTGRES_DB: nepa_test
        options: >-
          --health-cmd pg_isready
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5
        ports:
          - 5432:5432
      
      redis:
        image: redis:7
        options: >-
          --health-cmd "redis-cli ping"
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5
        ports:
          - 6379:6379

    steps:
    - name: Checkout code
      uses: actions/checkout@v4

    - name: Setup Node.js
      uses: actions/setup-node@v4
      with:
        node-version: '18'
        cache: 'npm'

    - name: Install dependencies
      run: |
        cd api-testing
        npm install

    - name: Setup K6 for load testing
      run: |
        sudo gpg -k
        sudo gpg --no-default-keyring --keyring /usr/share/keyrings/k6-archive-keyring.gpg --keyserver hkp://keyserver.ubuntu.com:80 --recv-keys C5AD17C747E3415A3642D57D77C6C491D6AC1D69
        echo "deb [signed-by=/usr/share/keyrings/k6-archive-keyring.gpg] https://dl.k6.io/deb stable main" | sudo tee /etc/apt/sources.list.d/k6.list
        sudo apt-get update
        sudo apt-get install k6

    - name: Wait for services
      run: |
        sleep 10
        pg_isready -h localhost -p 5432 -U test
        redis-cli -h localhost -p 6379 ping

    - name: Run database migrations
      run: |
        cd ..
        npm run prisma:migrate
      env:
        DATABASE_URL: postgresql://test:test@localhost:5432/nepa_test

    - name: Start API server
      run: |
        npm run dev &
        sleep 30
      env:
        DATABASE_URL: postgresql://test:test@localhost:5432/nepa_test
        REDIS_URL: redis://localhost:6379

    - name: Run unit tests
      run: |
        cd api-testing
        npm run test:unit
      env:
        API_BASE_URL: http://localhost:3000
        DATABASE_URL: postgresql://test:test@localhost:5432/nepa_test

    - name: Run integration tests
      run: |
        cd api-testing
        npm run test:integration
      env:
        API_BASE_URL: http://localhost:3000
        DATABASE_URL: postgresql://test:test@localhost:5432/nepa_test

    - name: Run security tests
      run: |
        cd api-testing
        npm run test:security
      env:
        API_BASE_URL: http://localhost:3000
        DATABASE_URL: postgresql://test:test@localhost:5432/nepa_test

    - name: Run contract tests
      run: |
        cd api-testing
        npm run test:contract
      env:
        API_BASE_URL: http://localhost:3000
        DATABASE_URL: postgresql://test:test@localhost:5432/nepa_test

    - name: Run performance tests
      run: |
        cd api-testing
        npm run test:performance
      env:
        API_BASE_URL: http://localhost:3000
        DATABASE_URL: postgresql://test:test@localhost:5432/nepa_test

    - name: Run load tests
      run: |
        cd api-testing
        npm run test:load
      env:
        API_BASE_URL: http://localhost:3000

    - name: Run end-to-end tests
      run: |
        cd api-testing
        npm run test:e2e
      env:
        API_BASE_URL: http://localhost:3000
        DATABASE_URL: postgresql://test:test@localhost:5432/nepa_test

    - name: Generate test report
      run: |
        cd api-testing
        npm run test:generate-report

    - name: Upload test reports
      uses: actions/upload-artifact@v4
      if: always()
      with:
        name: test-reports
        path: api-testing/test-reports/
        retention-days: 30

    - name: Upload coverage reports
      uses: actions/upload-artifact@v4
      if: always()
      with:
        name: coverage-reports
        path: api-testing/coverage/
        retention-days: 30

    - name: Comment PR with test results
      if: github.event_name == 'pull_request'
      uses: actions/github-script@v7
      with:
        script: |
          const fs = require('fs');
          const path = 'api-testing/test-reports';
          
          if (fs.existsSync(path)) {
            const files = fs.readdirSync(path);
            const reportFile = files.find(f => f.endsWith('.json'));
            
            if (reportFile) {
              const report = JSON.parse(fs.readFileSync(`${path}/${reportFile}`, 'utf8'));
              
              const comment = `
              ## 🧪 API Test Results
              
              **Summary:**
              - Total Tests: ${report.summary.totalTests}
              - Passed: ${report.summary.passedTests} ✅
              - Failed: ${report.summary.failedTests} ❌
              - Success Rate: ${report.summary.successRate.toFixed(1)}%
              
              **Performance:**
              ${report.performanceTests.map(test => 
                `- ${test.url}: ${test.avgResponseTime.toFixed(2)}ms avg, ${test.errorRate.toFixed(2)}% error rate`
              ).join('\n')}
              
              **Security:**
              ${report.securityTests.map(test => 
                `- ${test.testType}: ${test.passed ? '✅' : '❌'}`
              ).join('\n')}
              
              Full reports are available in the artifacts.
              `;
              
              github.rest.issues.createComment({
                issue_number: context.issue.number,
                owner: context.repo.owner,
                repo: context.repo.repo,
                body: comment
              });
            }
          }

  security-scan:
    runs-on: ubuntu-latest
    needs: api-tests
    
    steps:
    - name: Checkout code
      uses: actions/checkout@v4

    - name: Run security vulnerability scan
      run: |
        cd api-testing
        npm audit --audit-level moderate
        npm run test:security-scan
      env:
        API_BASE_URL: http://localhost:3000

    - name: Upload security scan results
      uses: actions/upload-artifact@v4
      if: always()
      with:
        name: security-scan-results
        path: api-testing/security-reports/
        retention-days: 30