ci.yml

name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
    # Skip workflow for documentation-only changes
    paths-ignore:
      - 'docs/**'
      - '*.md'
      - '.gitignore'
      - 'LICENSE'
      - '.prettierignore'
      - '.eslintrc*'
  # P5 §4: SonarQube 2x/semana (seg + qui 09:03 UTC)
  schedule:
    - cron: '3 9 * * 1,4'
  workflow_dispatch:

env:
  HUSKY: '0'

jobs:
  quality:
    name: Quality Gates
    runs-on: ubuntu-latest

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '22'
          cache: 'npm'

      - name: Install dependencies
        run: npm ci --legacy-peer-deps

      - name: Security audit
        run: npm audit --audit-level=high

      # Dependabot only touches package.json — skip source-code checks
      - name: Lint
        if: github.event.pull_request == null || github.event.pull_request.user.login != 'dependabot[bot]'
        run: npm run lint

      - name: Format check
        if: github.event.pull_request == null || github.event.pull_request.user.login != 'dependabot[bot]'
        run: npm run format:check

      - name: Typecheck
        if: github.event.pull_request == null || github.event.pull_request.user.login != 'dependabot[bot]'
        run: npm run typecheck

  fallow:
    name: Fallow - Codebase Intelligence
    runs-on: ubuntu-latest
    # Run on PRs and pushes, but don't block the pipeline initially
    continue-on-error: true
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0 # Full history for churn analysis

      - name: Fallow - Codebase Intelligence
        uses: fallow-rs/fallow@v2.89.0
        with:
          fail-on-issues: 'false'
          comment: 'true'
          review-comments: 'false'

  test:
    name: Tests & Coverage
    runs-on: ubuntu-latest
    needs: quality
    # Skip for dependency-only bumps (Dependabot PRs)
    # Uses PR author, not trigger actor — works even when human reopens the PR
    if: github.event.pull_request == null || github.event.pull_request.user.login != 'dependabot[bot]'

    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '22'
          cache: 'npm'

      - name: Install dependencies
        run: npm ci --legacy-peer-deps

      - name: Run tests with coverage
        run: npm run test:coverage

      - name: SonarCloud Scan
        uses: SonarSource/sonarqube-scan-action@713881670b6b3676cda39549040e2d88c70d582e
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}

      - name: Upload coverage report
        uses: actions/upload-artifact@v4
        if: always()
        with:
          name: coverage-report
          path: coverage/
          retention-days: 7

  e2e:
    name: E2E Tests
    runs-on: ubuntu-latest
    needs: test
    # Same condition: skip for Dependabot PRs
    if: github.event.pull_request == null || github.event.pull_request.user.login != 'dependabot[bot]'
    env:
      SUPABASE_LOCAL_ANON_KEY: ''
      SUPABASE_LOCAL_SERVICE_ROLE_KEY: ''

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '22'
          cache: 'npm'

      - name: Install dependencies
        run: npm ci --legacy-peer-deps

      - name: Install Playwright browsers
        run: npx playwright install chromium --with-deps

      - name: Setup Supabase CLI
        uses: supabase/setup-cli@v1
        with:
          version: latest

      - name: Start local Supabase
        run: supabase start

      - name: Export Supabase keys
        run: |
          STATUS_ENV=$(supabase status --output env 2>/dev/null || echo "")
          ANON_KEY=$(echo "$STATUS_ENV" | grep "^ANON_KEY=" | cut -d= -f2- | sed "s/^[\"']//; s/[\"']$//")
          SERVICE_KEY=$(echo "$STATUS_ENV" | grep "^SERVICE_ROLE_KEY=" | cut -d= -f2- | sed "s/^[\"']//; s/[\"']$//")
          if [ -z "$ANON_KEY" ] || [ -z "$SERVICE_KEY" ]; then
            echo "ERROR: Could not extract Supabase keys from 'supabase status --output env'"
            supabase status
            exit 1
          fi
          echo "SUPABASE_LOCAL_ANON_KEY=$ANON_KEY" >> $GITHUB_ENV
          echo "SUPABASE_LOCAL_SERVICE_ROLE_KEY=$SERVICE_KEY" >> $GITHUB_ENV

      - name: Push database schema
        env:
          DATABASE_URL: postgresql://postgres:postgres@127.0.0.1:54322/postgres
        run: npx prisma db push --accept-data-loss

      - name: Seed E2E test users
        env:
          DATABASE_URL: postgresql://postgres:postgres@127.0.0.1:54322/postgres
          NEXT_PUBLIC_SUPABASE_URL: http://127.0.0.1:54321
          NEXT_PUBLIC_SUPABASE_ANON_KEY: ${{ env.SUPABASE_LOCAL_ANON_KEY }}
          SUPABASE_SERVICE_ROLE_KEY: ${{ env.SUPABASE_LOCAL_SERVICE_ROLE_KEY }}
        run: npx tsx prisma/seed-e2e.ts

      - name: Run E2E tests
        env:
          NEXT_PUBLIC_SUPABASE_URL: http://127.0.0.1:54321
          NEXT_PUBLIC_SUPABASE_PUBLISHABLE_DEFAULT_KEY: ${{ env.SUPABASE_LOCAL_ANON_KEY }}
          SUPABASE_SERVICE_ROLE_KEY: ${{ env.SUPABASE_LOCAL_SERVICE_ROLE_KEY }}
          DATABASE_URL: postgresql://postgres:postgres@127.0.0.1:54322/postgres
          PLAYWRIGHT_BASE_URL: http://localhost:3333
        # Use npx directly, not npm run e2e: dotenv -e .env.test would override
        # dynamic Supabase anon key with the static hardcoded key from .env.test.
        run: npx playwright test

      - name: Upload Playwright report
        uses: actions/upload-artifact@v4
        if: always()
        with:
          name: playwright-report
          path: playwright-report/
          retention-days: 7