ci.yml

# VaultStadio CI Pipeline
# Runs on every push and pull request
# Runner: self-hosted macOS X64 (labels: self-hosted, macOS, X64)

name: CI

on:
  push:
    branches: [main, master, develop]
  pull_request:
    branches: [main, master, develop]

env:
  JAVA_VERSION: '17'
  JAVA_DISTRIBUTION: 'temurin'
  GRADLE_OPTS: '-Dorg.gradle.jvmargs=-Xmx4g'

jobs:
  # Build and test the Kotlin backend
  backend:
    name: Backend Build & Test
    runs-on: [self-hosted, macOS, X64]
    
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
      
      - name: Set up JDK
        uses: actions/setup-java@v4
        with:
          java-version: ${{ env.JAVA_VERSION }}
          distribution: ${{ env.JAVA_DISTRIBUTION }}
      
      - name: Setup Gradle
        uses: gradle/gradle-build-action@v3
        with:
          project-root: backend
          cache-read-only: ${{ github.ref != 'refs/heads/main' && github.ref != 'refs/heads/master' }}
      
      - name: Ensure Docker is available (for Testcontainers)
        run: |
          if [ -d "/Applications/Docker.app" ]; then
            echo "Starting Docker Desktop..."
            open -a Docker
            echo "Waiting for Docker daemon (up to 90s)..."
            for i in $(seq 1 45); do
              if docker info >/dev/null 2>&1; then
                echo "Docker is ready."
                break
              fi
              if [ $i -eq 45 ]; then
                echo "Docker did not become ready in time."
                exit 1
              fi
              sleep 2
            done
          else
            echo "Checking Docker..."
            docker info || exit 1
          fi
      
      - name: Build backend modules
        working-directory: backend
        run: |
          ./gradlew :core:build \
            :plugins-api:build \
            :infrastructure:build \
            :api:build \
            -x test
      
      - name: Run backend tests
        working-directory: backend
        run: |
          ./gradlew :core:test \
            :api:test \
            :infrastructure:test \
            :plugins-api:test \
            :plugins:image-metadata:test \
            :plugins:video-metadata:test \
            :plugins:fulltext-search:test \
            :plugins:ai-classification:test \
            --continue

      - name: Generate backend coverage reports
        working-directory: backend
        run: |
          ./gradlew :core:jacocoTestReport \
            :api:jacocoTestReport \
            :infrastructure:jacocoTestReport \
            :plugins-api:jacocoTestReport \
            :plugins:image-metadata:jacocoTestReport \
            :plugins:video-metadata:jacocoTestReport \
            :plugins:fulltext-search:jacocoTestReport \
            :plugins:ai-classification:jacocoTestReport \
            --continue

      - name: Upload test results
        uses: actions/upload-artifact@v4
        if: always()
        with:
          name: backend-test-results
          path: |
            backend/**/build/reports/tests/
            backend/**/build/test-results/
          retention-days: 7

      - name: Upload backend coverage reports
        uses: actions/upload-artifact@v4
        with:
          name: jacoco-coverage-backend
          path: |
            backend/core/build/reports/jacoco/test/jacocoTestReport.xml
            backend/api/build/reports/jacoco/test/jacocoTestReport.xml
            backend/infrastructure/build/reports/jacoco/test/jacocoTestReport.xml
            backend/plugins-api/build/reports/jacoco/test/jacocoTestReport.xml
            backend/plugins/image-metadata/build/reports/jacoco/test/jacocoTestReport.xml
            backend/plugins/video-metadata/build/reports/jacoco/test/jacocoTestReport.xml
            backend/plugins/fulltext-search/build/reports/jacoco/test/jacocoTestReport.xml
            backend/plugins/ai-classification/build/reports/jacoco/test/jacocoTestReport.xml
          retention-days: 1

  # Build the frontend (standalone project in frontend/)
  frontend:
    name: Frontend Build
    runs-on: [self-hosted, macOS, X64]

    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Set up JDK
        uses: actions/setup-java@v4
        with:
          java-version: ${{ env.JAVA_VERSION }}
          distribution: ${{ env.JAVA_DISTRIBUTION }}

      - name: Setup Gradle
        uses: gradle/gradle-build-action@v3

      - name: Build frontend (Desktop)
        run: cd frontend && ./gradlew :composeApp:compileKotlinDesktop --no-build-cache

      - name: Run frontend tests (desktop)
        run: cd frontend && ./gradlew :composeApp:desktopTest --continue --no-build-cache

      - name: Generate frontend coverage report
        run: cd frontend && ./gradlew :composeApp:jacocoTestReport --continue --no-build-cache

      - name: Upload frontend coverage report
        uses: actions/upload-artifact@v4
        with:
          name: jacoco-coverage-frontend
          path: frontend/composeApp/build/reports/jacoco/jacocoTestReport/jacocoTestReport.xml
          retention-days: 1

  # Upload coverage to Codecov
  coverage:
    name: Coverage (Codecov)
    runs-on: [self-hosted, macOS, X64]
    needs: [backend, frontend]

    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Download backend coverage reports
        uses: actions/download-artifact@v4
        with:
          name: jacoco-coverage-backend
          path: coverage-backend

      - name: Download frontend coverage report
        uses: actions/download-artifact@v4
        with:
          name: jacoco-coverage-frontend
          path: coverage-frontend

      - name: List coverage files (debug)
        run: |
          echo "=== coverage-backend ==="
          find coverage-backend -type f 2>/dev/null || true
          echo "=== coverage-frontend ==="
          find coverage-frontend -type f 2>/dev/null || true
          echo "=== all jacocoTestReport.xml in workspace ==="
          find . -name 'jacocoTestReport.xml' -type f 2>/dev/null || true

      - name: Discover coverage files for Codecov
        id: coverage-files
        run: |
          FILES=$(find . -name 'jacocoTestReport.xml' -type f 2>/dev/null | tr '\n' ',' | sed 's/,$//')
          echo "list=$FILES" >> "$GITHUB_OUTPUT"
          if [ -z "$FILES" ]; then
            echo "No jacocoTestReport.xml found"
            exit 1
          fi
          echo "Found coverage files: $FILES"

      - name: Upload to Codecov
        uses: codecov/codecov-action@v5
        with:
          disable_search: true
          files: ${{ steps.coverage-files.outputs.list }}
          fail_ci_if_error: false
        env:
          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}

  # Build plugins
  plugins:
    name: Plugins Build
    runs-on: [self-hosted, macOS, X64]
    
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
      
      - name: Set up JDK
        uses: actions/setup-java@v4
        with:
          java-version: ${{ env.JAVA_VERSION }}
          distribution: ${{ env.JAVA_DISTRIBUTION }}
      
      - name: Setup Gradle
        uses: gradle/gradle-build-action@v3
        with:
          project-root: backend
      
      - name: Build plugins
        working-directory: backend
        run: |
          ./gradlew :plugins:image-metadata:build \
            :plugins:video-metadata:build \
            :plugins:fulltext-search:build \
            :plugins:ai-classification:build \
            -x test

  # Build Android app
  android:
    name: Android Build
    runs-on: [self-hosted, macOS, X64]
    
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
      
      - name: Set up JDK
        uses: actions/setup-java@v4
        with:
          java-version: ${{ env.JAVA_VERSION }}
          distribution: ${{ env.JAVA_DISTRIBUTION }}
      
      - name: Set up Android SDK
        uses: android-actions/setup-android@v3
      
      - name: Install Android SDK components
        run: |
          sdkmanager --install \
            "platforms;android-34" \
            "build-tools;34.0.0"
      
      - name: Setup Gradle
        uses: gradle/gradle-build-action@v3
      
      - name: Build Android APK (debug)
        run: cd frontend && ./gradlew :androidApp:assembleDevDebug

  # Code quality checks (no root Gradle; backend and frontend are standalone)
  lint:
    name: Lint & Code Quality
    runs-on: [self-hosted, macOS, X64]
    
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
      
      - name: Set up JDK
        uses: actions/setup-java@v4
        with:
          java-version: ${{ env.JAVA_VERSION }}
          distribution: ${{ env.JAVA_DISTRIBUTION }}
      
      - name: Set up Android SDK
        uses: android-actions/setup-android@v3
      
      - name: Install Android SDK components
        run: |
          sdkmanager --install \
            "platforms;android-34" \
            "build-tools;34.0.0"
      
      - name: Check no FQN in type positions
        run: ./scripts/check-no-fqn.sh
      
      - name: Run Detekt (backend)
        working-directory: backend
        run: ./gradlew detektMain --continue
      
      - name: Run Detekt (frontend)
        working-directory: frontend
        run: ./gradlew detektMain --continue
      
      - name: Upload Detekt report
        uses: actions/upload-artifact@v4
        if: always()
        with:
          name: detekt-report
          path: '**/build/reports/detekt/'
          retention-days: 7

  # Security scanning
  security:
    name: Security Scan
    runs-on: [self-hosted, macOS, X64]
    
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
      
      - name: Run Trivy vulnerability scanner
        uses: aquasecurity/trivy-action@master
        with:
          scan-type: 'fs'
          scan-ref: '.'
          format: 'sarif'
          output: 'trivy-results.sarif'
          severity: 'CRITICAL,HIGH'
        continue-on-error: true
      
      - name: Upload Trivy scan results
        uses: github/codeql-action/upload-sarif@v3
        if: always()
        with: 
          sarif_file: 'trivy-results.sarif'
        continue-on-error: true