ci-cd.yml

name: CI/CD

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

permissions:
  contents: read

jobs:
  build-deploy:
    name: Build and Deploy
    runs-on: ubuntu-latest

    steps:
      - name: Checkout code
        uses: actions/checkout@v6

      - name: Set up Node.js
        uses: actions/setup-node@v6.4.0
        with:
          node-version: "22"
          cache: "npm"

      - name: Install dependencies
        run: npm ci --legacy-peer-deps

      # Run ESLint (with security plugin)
      - name: Lint code
        run: npm run lint --if-present

      # Run Security Audit
      - name: Run npm audit
        run: npm audit --audit-level=moderate

      # Build project
      - name: Build project
        run: npm run build

      # Deploy only if on main
      - name: Deploy to Netlify
        if: github.ref == 'refs/heads/main'
        run: npx netlify-cli deploy --dir=dist --site=$NETLIFY_SITE_ID --prod
        env:
          NETLIFY_AUTH_TOKEN: ${{ secrets.NETLIFY_AUTH_TOKEN }}
          NETLIFY_SITE_ID: ${{ secrets.NETLIFY_SITE_ID }}