ci.yml

name: CI

on:
  push:
    branches: [main, master]
  pull_request:
    branches: [main, master]

jobs:
  test:
    name: Test (Node ${{ matrix.node-version }})
    runs-on: ubuntu-latest

    strategy:
      matrix:
        node-version: [20, 22, 24]

    steps:
      - name: Checkout repository
        uses: actions/checkout@v6

      - name: Setup Node.js ${{ matrix.node-version }}
        uses: actions/setup-node@v6
        with:
          node-version: ${{ matrix.node-version }}
          cache: "npm"

      - name: Install dependencies
        run: npm ci

      - name: Run tests
        run: npm test

      - name: Run tests with coverage
        if: matrix.node-version == 20
        run: npm run test:coverage

      - name: Upload coverage to Codecov
        if: matrix.node-version == 20
        uses: codecov/codecov-action@v6
        with:
          fail_ci_if_error: false
        continue-on-error: true

  test-windows:
    name: Test (Windows, Node ${{ matrix.node-version }})
    runs-on: windows-latest

    strategy:
      fail-fast: false
      matrix:
        node-version: [20, 22, 24]

    steps:
      - name: Checkout repository
        uses: actions/checkout@v6

      - name: Setup Node.js ${{ matrix.node-version }}
        uses: actions/setup-node@v6
        with:
          node-version: ${{ matrix.node-version }}
          cache: "npm"

      - name: Install dependencies
        run: npm ci

      - name: Run tests
        run: npm test

  e2e:
    name: E2E
    runs-on: ubuntu-latest

    steps:
      - name: Checkout repository
        uses: actions/checkout@v6

      - name: Setup Node.js
        uses: actions/setup-node@v6
        with:
          node-version: 20
          cache: "npm"

      - name: Install dependencies
        run: npm ci

      - name: Install Playwright browser
        run: npx playwright install --with-deps chromium

      - name: Run end-to-end tests
        run: npm run test:e2e

      - name: Upload Playwright artifacts
        if: failure()
        uses: actions/upload-artifact@v7
        with:
          name: playwright-artifacts
          path: |
            playwright-report/
            test-results/
          if-no-files-found: ignore
          retention-days: 7

  e2e-windows:
    name: E2E CLI (Windows)
    runs-on: windows-latest

    steps:
      - name: Checkout repository
        uses: actions/checkout@v6

      - name: Setup Node.js
        uses: actions/setup-node@v6
        with:
          node-version: 20
          cache: "npm"

      - name: Install dependencies
        run: npm ci

      - name: Run CLI end-to-end tests
        run: npm run test:e2e:cli

  lint:
    name: Lint
    runs-on: ubuntu-latest

    steps:
      - name: Checkout repository
        uses: actions/checkout@v6

      - name: Setup Node.js
        uses: actions/setup-node@v6
        with:
          node-version: 20
          cache: "npm"

      - name: Install dependencies
        run: npm ci

      - name: Run lint
        run: npm run lint

  typecheck:
    name: Typecheck
    runs-on: ubuntu-latest

    steps:
      - name: Checkout repository
        uses: actions/checkout@v6

      - name: Setup Node.js
        uses: actions/setup-node@v6
        with:
          node-version: 20
          cache: "npm"

      - name: Install dependencies
        run: npm ci

      - name: Run typecheck
        run: npm run typecheck

  dependency-review:
    name: Dependency Review
    if: github.event_name == 'pull_request'
    runs-on: ubuntu-latest
    permissions:
      contents: read
      pull-requests: read

    steps:
      - name: Checkout repository
        uses: actions/checkout@v6

      - name: Dependency review
        id: dependency-review
        uses: actions/dependency-review-action@v5
        continue-on-error: true

      - name: Explain dependency review fallback
        if: steps.dependency-review.outcome == 'failure'
        run: |
          echo "Dependency review is informational until GitHub Dependency Graph is enabled for this repository."
          echo "Enable Security -> Dependency graph in repository settings to make this gate authoritative."

  build:
    name: Build
    runs-on: ubuntu-latest
    needs: [test, test-windows, e2e, e2e-windows, lint, typecheck]

    steps:
      - name: Checkout repository
        uses: actions/checkout@v6

      - name: Setup Node.js
        uses: actions/setup-node@v6
        with:
          node-version: 20
          cache: "npm"

      - name: Install dependencies
        run: npm ci

      - name: Build
        run: npm run build

      - name: Verify CLI loads
        run: node dist/index.js --help

      - name: Upload build artifacts
        uses: actions/upload-artifact@v7
        with:
          name: dist
          path: dist/
          retention-days: 7

  sbom:
    name: SBOM
    runs-on: ubuntu-latest
    needs: [test, test-windows, e2e, e2e-windows, lint, typecheck, build]

    steps:
      - name: Checkout repository
        uses: actions/checkout@v6

      - name: Setup Node.js
        uses: actions/setup-node@v6
        with:
          node-version: 20
          cache: "npm"

      - name: Install dependencies
        run: npm ci

      - name: Generate SBOM
        run: npm sbom --omit=dev --sbom-format spdx > sbom.spdx.json

      - name: Upload SBOM artifact
        uses: actions/upload-artifact@v7
        with:
          name: sbom-spdx
          path: sbom.spdx.json
          retention-days: 7