ci.yml

name: CI

on:
  pull_request:
    branches: [main, development]
  push:
    branches: [main, development]
  workflow_dispatch:

concurrency:
  group: ci-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

env:
  NODE_VERSION: '24'

jobs:
  # ════════════════════════════════════════════════════════════════════
  # Quality Checks (parallel)
  # ════════════════════════════════════════════════════════════════════
  lint:
    name: Lint & Format
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Setup pnpm
        uses: pnpm/action-setup@v5

      - name: Setup Node.js
        uses: actions/setup-node@v6
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: 'pnpm'

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Biome check
        run: pnpm biome check .

      - name: Prettier check
        run: pnpm prettier --check "**/*.{md,mdx,yml,yaml}"

  typecheck:
    name: Type Check
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Setup pnpm
        uses: pnpm/action-setup@v5

      - name: Setup Node.js
        uses: actions/setup-node@v6
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: 'pnpm'

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Type check
        run: pnpm typecheck

  security:
    name: Security Audit
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Setup pnpm
        uses: pnpm/action-setup@v5

      - name: Setup Node.js
        uses: actions/setup-node@v6
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: 'pnpm'

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Security audit
        run: pnpm audit-ci --config .audit-ci.json

  # ════════════════════════════════════════════════════════════════════
  # Build & Test
  # ════════════════════════════════════════════════════════════════════
  build:
    name: Build
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Setup pnpm
        uses: pnpm/action-setup@v5

      - name: Setup Node.js
        uses: actions/setup-node@v6
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: 'pnpm'

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Build package
        run: pnpm build

      - name: Upload build artifacts
        uses: actions/upload-artifact@v6
        with:
          name: build
          path: build/
          retention-days: 1

  test:
    name: Test
    runs-on: ubuntu-latest
    timeout-minutes: 15
    needs: build
    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Setup pnpm
        uses: pnpm/action-setup@v5

      - name: Setup Node.js
        uses: actions/setup-node@v6
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: 'pnpm'

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Download build artifacts
        uses: actions/download-artifact@v7
        with:
          name: build
          path: build/

      - name: Run unit tests
        run: pnpm test:coverage

      - name: Run integration tests
        run: pnpm test:integration

      - name: Upload coverage
        uses: codecov/codecov-action@v5
        with:
          token: ${{ secrets.CODECOV_TOKEN }}
          files: ./coverage/coverage-final.json
          flags: unittests
          fail_ci_if_error: false

  # ════════════════════════════════════════════════════════════════════
  # Docs Build Verification
  # ════════════════════════════════════════════════════════════════════
  docs:
    name: Docs Build
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Setup pnpm
        uses: pnpm/action-setup@v5

      - name: Setup Node.js
        uses: actions/setup-node@v6
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: 'pnpm'
          cache-dependency-path: docs/pnpm-lock.yaml

      - name: Install docs dependencies
        working-directory: docs
        run: pnpm install --frozen-lockfile

      - name: Build docs
        working-directory: docs
        run: pnpm build

  # ════════════════════════════════════════════════════════════════════
  # Status Check (branch protection)
  # ════════════════════════════════════════════════════════════════════
  status:
    name: CI Status
    runs-on: ubuntu-latest
    needs: [lint, typecheck, security, build, test, docs]
    if: always()
    steps:
      - name: Check status
        run: |
          if [ "${{ needs.lint.result }}" != "success" ] || \
             [ "${{ needs.typecheck.result }}" != "success" ] || \
             [ "${{ needs.security.result }}" != "success" ] || \
             [ "${{ needs.build.result }}" != "success" ] || \
             [ "${{ needs.test.result }}" != "success" ] || \
             [ "${{ needs.docs.result }}" != "success" ]; then
            echo "::error::One or more jobs failed"
            exit 1
          fi
          echo "All checks passed!"

      - name: Summary
        if: always()
        run: |
          echo "## CI Results" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "| Check | Status |" >> $GITHUB_STEP_SUMMARY
          echo "|-------|--------|" >> $GITHUB_STEP_SUMMARY
          echo "| Lint & Format | ${{ needs.lint.result == 'success' && '●' || '○' }} |" >> $GITHUB_STEP_SUMMARY
          echo "| Type Check | ${{ needs.typecheck.result == 'success' && '●' || '○' }} |" >> $GITHUB_STEP_SUMMARY
          echo "| Security Audit | ${{ needs.security.result == 'success' && '●' || '○' }} |" >> $GITHUB_STEP_SUMMARY
          echo "| Build | ${{ needs.build.result == 'success' && '●' || '○' }} |" >> $GITHUB_STEP_SUMMARY
          echo "| Test | ${{ needs.test.result == 'success' && '●' || '○' }} |" >> $GITHUB_STEP_SUMMARY
          echo "| Docs | ${{ needs.docs.result == 'success' && '●' || '○' }} |" >> $GITHUB_STEP_SUMMARY