ci.yml

name: CI/CD Pipeline

on:
  push:
    branches: [main, develop]
  pull_request:
    branches: [main, develop]

env:
  BUN_VERSION: '1.3'

jobs:
  # Install dependencies and cache
  install:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Setup Bun
        uses: oven-sh/setup-bun@v2
        with:
          bun-version: ${{ env.BUN_VERSION }}
      - name: Cache Bun modules
        uses: actions/cache@v4
        with:
          path: ~/.bun/install/cache
          key: ${{ runner.os }}-bun-${{ hashFiles('**/bun.lock') }}
          restore-keys: |
            ${{ runner.os }}-bun-
      - name: Install dependencies
        run: bun install --frozen-lockfile

  # Linting and formatting
  lint:
    needs: install
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Setup Bun
        uses: oven-sh/setup-bun@v2
        with:
          bun-version: ${{ env.BUN_VERSION }}
      - name: Restore Bun cache
        uses: actions/cache@v4
        with:
          path: ~/.bun/install/cache
          key: ${{ runner.os }}-bun-${{ hashFiles('**/bun.lock') }}
      - name: Install dependencies
        run: bun install --frozen-lockfile
      - name: Run ESLint
        run: bun run lint
      - name: Check Prettier formatting
        run: bun run format:check

  # Type checking
  type-check:
    needs: install
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Setup Bun
        uses: oven-sh/setup-bun@v2
        with:
          bun-version: ${{ env.BUN_VERSION }}
      - name: Restore Bun cache
        uses: actions/cache@v4
        with:
          path: ~/.bun/install/cache
          key: ${{ runner.os }}-bun-${{ hashFiles('**/bun.lock') }}
      - name: Install dependencies
        run: bun install --frozen-lockfile
      - name: Generate Prisma client
        run: bun run db:generate
      - name: Build packages
        run: bun run --filter './packages/*' build
      - name: Type check
        run: bun run type-check

  # Run tests
  test:
    needs: install
    runs-on: ubuntu-latest
    services:
      postgres:
        image: postgres:16-alpine
        env:
          POSTGRES_USER: muditor
          POSTGRES_PASSWORD: password
          POSTGRES_DB: muditor_test
        ports:
          - 5432:5432
        options: >-
          --health-cmd pg_isready
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5
      redis:
        image: redis:7-alpine
        ports:
          - 6379:6379
        options: >-
          --health-cmd "redis-cli ping"
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5
    env:
      DATABASE_URL: postgresql://muditor:password@localhost:5432/muditor_test
      REDIS_URL: redis://localhost:6379
    steps:
      - uses: actions/checkout@v4
      - name: Setup Bun
        uses: oven-sh/setup-bun@v2
        with:
          bun-version: ${{ env.BUN_VERSION }}
      - name: Restore Bun cache
        uses: actions/cache@v4
        with:
          path: ~/.bun/install/cache
          key: ${{ runner.os }}-bun-${{ hashFiles('**/bun.lock') }}
      - name: Install dependencies
        run: bun install --frozen-lockfile
      - name: Generate Prisma client
        run: bun run db:generate
      - name: Push database schema
        run: bun run db:push
      - name: Run tests
        run: bun run test

  # Run Playwright E2E tests
  e2e-tests:
    needs: install
    runs-on: ubuntu-latest
    services:
      postgres:
        image: postgres:16-alpine
        env:
          POSTGRES_USER: muditor
          POSTGRES_PASSWORD: password
          POSTGRES_DB: muditor_test
        ports:
          - 5432:5432
        options: >-
          --health-cmd pg_isready
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5
      redis:
        image: redis:7-alpine
        ports:
          - 6379:6379
        options: >-
          --health-cmd "redis-cli ping"
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5
    env:
      DATABASE_URL: postgresql://muditor:password@localhost:5432/muditor_test
      REDIS_URL: redis://localhost:6379
      PLAYWRIGHT_BASE_URL: http://localhost:3000
    steps:
      - uses: actions/checkout@v4
      - name: Setup Bun
        uses: oven-sh/setup-bun@v2
        with:
          bun-version: ${{ env.BUN_VERSION }}
      - name: Restore Bun cache
        uses: actions/cache@v4
        with:
          path: ~/.bun/install/cache
          key: ${{ runner.os }}-bun-${{ hashFiles('**/bun.lock') }}
      - name: Install dependencies
        run: bun install --frozen-lockfile
      - name: Install Playwright Browsers
        run: bunx playwright install --with-deps
      - name: Generate Prisma client
        run: bun run db:generate
      - name: Push database schema
        run: bun run db:push
      - name: Seed test database
        run: bun run db:seed
      - name: Run Playwright tests
        run: bun run test:e2e
      - name: Upload Playwright Report
        uses: actions/upload-artifact@v4
        if: always()
        with:
          name: playwright-report
          path: test-results/
          retention-days: 30

  # Build applications
  build:
    needs: [lint, type-check, test, e2e-tests]
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Setup Bun
        uses: oven-sh/setup-bun@v2
        with:
          bun-version: ${{ env.BUN_VERSION }}
      - name: Restore Bun cache
        uses: actions/cache@v4
        with:
          path: ~/.bun/install/cache
          key: ${{ runner.os }}-bun-${{ hashFiles('**/bun.lock') }}
      - name: Install dependencies
        run: bun install --frozen-lockfile
      - name: Generate Prisma client
        run: bun run db:generate
      - name: Build all packages
        run: bun run build
      - name: Upload build artifacts
        uses: actions/upload-artifact@v4
        with:
          name: build-artifacts
          path: |
            apps/*/dist
            apps/*/.next
            packages/*/dist

  # Security audit (non-blocking — transitive dependency vulns shouldn't block CI)
  security:
    runs-on: ubuntu-latest
    continue-on-error: true
    steps:
      - uses: actions/checkout@v4
      - name: Setup Bun
        uses: oven-sh/setup-bun@v2
        with:
          bun-version: ${{ env.BUN_VERSION }}
      - name: Run security audit
        run: bun pm audit --audit-level critical || true

  # Deploy to staging (only on develop branch)
  deploy-staging:
    needs: build
    runs-on: ubuntu-latest
    if: github.ref == 'refs/heads/develop' && github.event_name == 'push'
    environment: staging
    steps:
      - uses: actions/checkout@v4
      - name: Download build artifacts
        uses: actions/download-artifact@v4
        with:
          name: build-artifacts
      # TODO: Add deployment steps for staging environment

  # Deploy to production (only on main branch)
  deploy-production:
    needs: build
    runs-on: ubuntu-latest
    if: github.ref == 'refs/heads/main' && github.event_name == 'push'
    environment: production
    steps:
      - uses: actions/checkout@v4
      - name: Download build artifacts
        uses: actions/download-artifact@v4
        with:
          name: build-artifacts
      # TODO: Add deployment steps for production environment