ci.yml

name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

jobs:
  lint:
    if: github.repository == 'haesookimDev/xgen-sandbox'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-go@v5
        with:
          go-version: '1.26'

      - name: Lint agent
        run: cd agent && go vet ./...

      - name: Lint sidecar
        run: cd sidecar && go vet ./...

  test:
    if: github.repository == 'haesookimDev/xgen-sandbox'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-go@v5
        with:
          go-version: '1.26'

      - name: Test agent
        run: cd agent && go test -race -coverprofile=coverage-agent.out -v ./...

      - name: Test sidecar
        run: cd sidecar && go test -race -coverprofile=coverage-sidecar.out -v ./...

      - name: Upload coverage
        uses: actions/upload-artifact@v4
        with:
          name: coverage
          path: |
            agent/coverage-agent.out
            sidecar/coverage-sidecar.out

  dashboard-lint:
    if: github.repository == 'haesookimDev/xgen-sandbox'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: '20'
          cache: npm
          cache-dependency-path: dashboard/package-lock.json

      - name: Install dependencies
        run: cd dashboard && npm ci

      - name: Type check
        run: cd dashboard && npx tsc --noEmit

      - name: Lint
        run: cd dashboard && npx eslint .

  sdk-check:
    if: github.repository == 'haesookimDev/xgen-sandbox'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-node@v4
        with:
          node-version: '20'

      - name: Build TypeScript SDK
        run: cd sdks/typescript && npm install && npm run build

      - uses: actions/setup-go@v5
        with:
          go-version: '1.26'

      - name: Vet Go SDK
        run: cd sdks/go && go vet ./...

      - uses: actions/setup-python@v5
        with:
          python-version: '3.11'

      - name: Check Python SDK
        run: cd sdks/python && pip install -e ".[dev]" 2>/dev/null || pip install -e . && python -c "import xgen_sandbox; print('Python SDK OK')"

  build:
    if: github.repository == 'haesookimDev/xgen-sandbox'
    runs-on: ubuntu-latest
    needs: [lint, test, dashboard-lint, sdk-check]
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-go@v5
        with:
          go-version: '1.26'
      - uses: actions/setup-node@v4
        with:
          node-version: '20'
          cache: npm
          cache-dependency-path: dashboard/package-lock.json

      - name: Build agent
        run: cd agent && go build -o ../bin/agent ./cmd/agent

      - name: Build sidecar
        run: cd sidecar && go build -o ../bin/sidecar ./cmd/sidecar

      - name: Build dashboard
        run: cd dashboard && npm ci && npm run build

  docker:
    runs-on: ubuntu-latest
    needs: [build]
    if: github.repository == 'haesookimDev/xgen-sandbox' && github.event_name == 'push' && github.ref == 'refs/heads/main'
    permissions:
      packages: write
      security-events: write
    env:
      REGISTRY_IMAGE: ghcr.io/${{ github.repository }}
    steps:
      - uses: actions/checkout@v4

      - name: Lowercase registry image name
        run: echo "REGISTRY_IMAGE=${REGISTRY_IMAGE,,}" >> "$GITHUB_ENV"

      - uses: docker/setup-buildx-action@v3
      - uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Build agent image
        uses: docker/build-push-action@v6
        with:
          context: ./agent
          load: true
          tags: ${{ env.REGISTRY_IMAGE }}/agent:${{ github.sha }}
          cache-from: type=gha
          cache-to: type=gha,mode=max

      - name: Build sidecar image
        uses: docker/build-push-action@v6
        with:
          context: ./sidecar
          load: true
          tags: ${{ env.REGISTRY_IMAGE }}/sidecar:${{ github.sha }}
          cache-from: type=gha
          cache-to: type=gha,mode=max

      - name: Build dashboard image
        uses: docker/build-push-action@v6
        with:
          context: ./dashboard
          load: true
          tags: ${{ env.REGISTRY_IMAGE }}/dashboard:${{ github.sha }}
          cache-from: type=gha
          cache-to: type=gha,mode=max

      - name: Scan agent image
        uses: aquasecurity/trivy-action@v0.35.0
        with:
          image-ref: ${{ env.REGISTRY_IMAGE }}/agent:${{ github.sha }}
          format: table
          exit-code: '1'
          severity: CRITICAL,HIGH

      - name: Scan sidecar image
        uses: aquasecurity/trivy-action@v0.35.0
        with:
          image-ref: ${{ env.REGISTRY_IMAGE }}/sidecar:${{ github.sha }}
          format: table
          exit-code: '1'
          severity: CRITICAL,HIGH

      - name: Scan dashboard image
        uses: aquasecurity/trivy-action@v0.35.0
        with:
          image-ref: ${{ env.REGISTRY_IMAGE }}/dashboard:${{ github.sha }}
          format: table
          exit-code: '1'
          severity: CRITICAL,HIGH

      - name: Push agent image
        uses: docker/build-push-action@v6
        with:
          context: ./agent
          push: true
          tags: |
            ${{ env.REGISTRY_IMAGE }}/agent:latest
            ${{ env.REGISTRY_IMAGE }}/agent:${{ github.sha }}
          cache-from: type=gha

      - name: Push sidecar image
        uses: docker/build-push-action@v6
        with:
          context: ./sidecar
          push: true
          tags: |
            ${{ env.REGISTRY_IMAGE }}/sidecar:latest
            ${{ env.REGISTRY_IMAGE }}/sidecar:${{ github.sha }}
          cache-from: type=gha

      - name: Push dashboard image
        uses: docker/build-push-action@v6
        with:
          context: ./dashboard
          push: true
          tags: |
            ${{ env.REGISTRY_IMAGE }}/dashboard:latest
            ${{ env.REGISTRY_IMAGE }}/dashboard:${{ github.sha }}
          cache-from: type=gha