ci.yml

# SPDX-License-Identifier: MPL-2.0
# // Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
# SPDX-License-Identifier: MPL-2.0
permissions:
  actions: read
  contents: read
name: CI/CD Pipeline
on:
  push:
    branches: [main, develop]
  pull_request:
    branches: [main, develop]
  release:
    types: [published]
env:
  JULIA_VERSION: '1.10'
  NODE_VERSION: '20'
jobs:
  lint-julia:
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
      - uses: julia-actions/setup-julia@ac0d62164df5a47de404f4e96ce86a1a28a28d56 # v1
        with:
          version: ${{ env.JULIA_VERSION }}
      - name: Install JuliaFormatter
        run: julia -e 'using Pkg; Pkg.add("JuliaFormatter")'
      - name: Check Julia formatting
        run: |
          julia -e 'using JuliaFormatter; format("src/julia", verbose=true, overwrite=false) || exit(1)'
  lint-typescript:
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: 'npm'
      - name: Install dependencies
        run: npm ci
      - name: Lint TypeScript
        run: npm run lint
      - name: Check Prettier formatting
        run: npx prettier --check "src/**/*.{ts,tsx,js,jsx}"
  test-julia:
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
      - uses: julia-actions/setup-julia@ac0d62164df5a47de404f4e96ce86a1a28a28d56 # v1
        with:
          version: ${{ env.JULIA_VERSION }}
      - name: Cache Julia packages
        uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4
        with:
          path: ~/.julia
          key: ${{ runner.os }}-julia-${{ hashFiles('**/Project.toml') }}
          restore-keys: |
            ${{ runner.os }}-julia-
      - name: Install dependencies
        run: julia --project=. -e 'using Pkg; Pkg.instantiate()'
      - name: Run tests
        run: julia --project=. -e 'using Pkg; Pkg.test(coverage=true)'
      - name: Process coverage
        uses: julia-actions/julia-processcoverage@03114f09f119417c3242a9fb6e0b722676aedf38 # v1
      - name: Upload coverage to Codecov
        uses: codecov/codecov-action@ab904c41d6ece82784817410c45d8b8c02684457 # v3
        with:
          files: lcov.info
          flags: julia
  test-typescript:
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: 'npm'
      - name: Install dependencies
        run: npm ci
      - name: Run tests with coverage
        run: npm run test:coverage
      - name: Upload coverage to Codecov
        uses: codecov/codecov-action@ab904c41d6ece82784817410c45d8b8c02684457 # v3
        with:
          files: ./coverage/cobertura-coverage.xml
          flags: typescript
  build:
    runs-on: ubuntu-latest
    timeout-minutes: 15
    needs: [lint-julia, lint-typescript, test-julia, test-typescript]
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
      - uses: julia-actions/setup-julia@ac0d62164df5a47de404f4e96ce86a1a28a28d56 # v1
        with:
          version: ${{ env.JULIA_VERSION }}
      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: 'npm'
      - name: Install Julia dependencies
        run: julia --project=. -e 'using Pkg; Pkg.instantiate()'
      - name: Install Node dependencies
        run: npm ci
      - name: Build TypeScript
        run: npm run build
      - name: Build Excel add-in
        run: npm run build:excel
      - name: Build LibreOffice extension
        run: npm run build:libre
      - name: Upload Excel add-in artifact
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        with:
          name: excel-addin
          path: dist/officejs/
      - name: Upload LibreOffice extension artifact
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        with:
          name: libreoffice-extension
          path: dist/uno/economic-toolkit.oxt
  security:
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
        with:
          node-version: ${{ env.NODE_VERSION }}
      - name: Run npm audit
        run: npm audit --production || true
      - name: Run Snyk security scan
        uses: snyk/actions/node@9adf32b1121593767fc3c057af55b55db032dc04 # master
        continue-on-error: true
        env:
          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
  docker-build:
    runs-on: ubuntu-latest
    timeout-minutes: 15
    needs: [build]
    if: github.event_name == 'push' && (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/develop')
    permissions:
      contents: read
      packages: write
      id-token: write
      attestations: write
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
      - name: Login to GitHub Container Registry
        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Extract metadata
        id: meta
        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5
        with:
          images: ghcr.io/${{ github.repository }}
          tags: |
            type=ref,event=branch
            type=ref,event=pr
            type=semver,pattern={{version}}
            type=semver,pattern={{major}}.{{minor}}
            type=sha
      - name: Build and push
        id: push
        uses: docker/build-push-action@ca052bb54ab0790a636c9b5f226502c73d547a25 # v5
        with:
          context: .
          file: ./Containerfile
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          cache-from: type=gha
          cache-to: type=gha,mode=max
      - name: Attest container provenance
        uses: actions/attest-build-provenance@e8998f949152b193b063cb0ec769d69d929409be # v2
        with:
          subject-name: ghcr.io/${{ github.repository }}
          subject-digest: ${{ steps.push.outputs.digest }}
          push-to-registry: true
  release:
    runs-on: ubuntu-latest
    timeout-minutes: 15
    needs: [build, security]
    if: github.event_name == 'release'
    permissions:
      contents: write
      id-token: write
      attestations: write
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
      - name: Download Excel add-in
        uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a # v3
        with:
          name: excel-addin
          path: dist/officejs/
      - name: Download LibreOffice extension
        uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a # v3
        with:
          name: libreoffice-extension
          path: dist/uno/
      - name: Create release assets
        run: |
          cd dist/officejs && zip -r ../../economic-toolkit-excel.zip .
          cd ../..
      - name: Upload release assets
        uses: softprops/action-gh-release@de2c0eb89ae2a093876385947365aca7b0e5f844 # v1
        with:
          files: |
            economic-toolkit-excel.zip
            dist/uno/economic-toolkit.oxt
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      - name: Attest build provenance
        uses: actions/attest-build-provenance@e8998f949152b193b063cb0ec769d69d929409be # v2
        with:
          subject-path: |
            economic-toolkit-excel.zip
            dist/uno/economic-toolkit.oxt
  coverage-report:
    runs-on: ubuntu-latest
    timeout-minutes: 15
    needs: [test-julia, test-typescript]
    steps:
      - name: Coverage summary
        run: |
          echo "Code coverage reports uploaded to Codecov"
          echo "View at: https://codecov.io/gh/${{ github.repository }}"