ci.yml

name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

# Cancel in-progress runs on same branch
concurrency:
  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
  cancel-in-progress: true

permissions:
  contents: read

jobs:
  # ============================================================
  # Platform: CDK + Helm + Scripts (every PR) ~2 min
  # ============================================================
  platform-lint:
    name: "Platform: CDK + Helm + Scripts"
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version: '22'
          cache: 'npm'
          cache-dependency-path: cdk/package-lock.json

      - name: CDK compile
        working-directory: cdk
        run: npm ci && npx tsc --noEmit

      - name: CDK synth + cdk-nag
        working-directory: cdk
        run: |
          cp cdk.json.example cdk.json
          npx cdk synth --no-staging -c @ci-synth=true 2>&1 | tee /tmp/synth.log || true
          # Fail on real CDK synth errors (not cdk-nag findings)
          if grep -qP '^Error:' /tmp/synth.log; then
            echo "::error::CDK synth failed"
            exit 1
          fi
          # cdk-nag findings are non-blocking for sample code
          echo "::group::cdk-nag findings"
          if grep -q '\[Error at' /tmp/synth.log; then
            echo "::warning::cdk-nag found issues (non-blocking for sample code)"
            grep '\[Error at' /tmp/synth.log || true
          else
            echo "No cdk-nag errors"
          fi
          echo "::endgroup::"

      - name: Helm lint
        run: |
          # legacy (Deployment) mode
          helm lint helm/charts/openclaw-platform/ --set ingress.enabled=true --set ingress.host=test.example.com --set tenant.name=test
          # sandbox (SandboxClaim/SandboxTemplate) mode
          helm lint helm/charts/openclaw-platform/ --set ingress.enabled=true --set ingress.host=test.example.com --set tenant.name=test --set sandbox.enabled=true
          # sandbox + gVisor runtime tier (PR#2)
          helm lint helm/charts/openclaw-platform/ --set ingress.enabled=true --set ingress.host=test.example.com --set tenant.name=test --set sandbox.enabled=true --set sandbox.runtimeClassName=gvisor

      - name: CDK unit tests
        working-directory: cdk
        run: npx jest --silent

      - name: Lambda pytest
        env:
          AWS_DEFAULT_REGION: us-east-1
          AWS_REGION: us-east-1
        run: |
          pip3 install pytest --quiet
          for dir in cdk/lambda/pre-signup cdk/lambda/post-confirmation cdk/lambda/cost-enforcer; do
            echo "Testing $dir..."
            python3 -m pytest "$dir"/test_index.py -q
          done

      - name: Shell syntax
        run: for f in scripts/*.sh; do bash -n "$f"; done

      - name: ShellCheck
        run: shellcheck --severity=error scripts/*.sh

      - name: Rubric compliance
        run: |
          if bash scripts/check-rubric.sh; then
            echo "Rubric: clean"
          else
            echo "::warning::Rubric found doc-style issues (non-blocking for sample code; tracked as follow-up)"
          fi

  # ============================================================
  # Security (every PR) ~1 min
  # ============================================================
  security-scan:
    name: "Security scan"
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

      - name: No hardcoded secrets
        run: |
          FOUND=$(grep -rn 'AKIA[A-Z0-9]\\{16\\}' --include="*.ts" --include="*.py" --include="*.sh" --include="*.rs" --include="*.yaml" --include="*.md" 2>/dev/null | grep -v node_modules | grep -v ".git/" | grep -v target/ | grep -v cdk.out | grep -v cdk.json || true)
          [ -n "$FOUND" ] && echo "$FOUND" && exit 1 || echo "Clean"

      - name: No CJK in code
        run: |
          python3 << 'PYEOF'
          import glob, os
          found = []
          for ext in ['*.ts', '*.py', '*.rs', '*.html']:
              for f in glob.glob(f'**/{ext}', recursive=True):
                  if any(x in f for x in ['node_modules','cdk.out','.git','target/']): continue
                  try:
                      with open(f) as fh:
                          for i, line in enumerate(fh, 1):
                              if any('\u4e00' <= c <= '\u9fff' for c in line):
                                  found.append(f'{f}:{i}')
                  except: pass
          if found:
              print(f'Found CJK in {len(found)} lines:')
              for f in found[:10]: print(f'  {f}')
              exit(1)
          print('Clean')
          PYEOF

      - name: No sensitive data in commit messages
        if: github.event_name == 'pull_request'
        run: |
          git fetch origin main --depth=1 2>/dev/null || true
          COMMITS=$(git log --format='%B' origin/main..HEAD 2>/dev/null || echo "")
          if [ -z "$COMMITS" ]; then
            echo "Could not determine commit range, skipping"
            exit 0
          fi
          FOUND=$(echo "$COMMITS" | grep -iE '[0-9]{12}\\.dkr\\.ecr|AKIA[A-Z0-9]{16}|[a-z0-9]{10,}\\.cloudfront\\.net|arn:aws:' || true)
          if [ -n "$FOUND" ]; then
            echo "::error::Commit messages contain sensitive data:"
            echo "$FOUND"
            exit 1
          fi
          echo "Clean"

      - name: npm audit
        working-directory: cdk
        run: |
          npm ci --ignore-scripts
          npm audit --audit-level=high 2>&1 || true

      - name: Semgrep (JS/TS/Python)
        run: |
          pip3 install semgrep==1.156.0 --quiet
          set +e
          semgrep scan --config auto --severity ERROR --severity WARNING --error .
          EXIT_CODE=$?
          set -e
          if [ $EXIT_CODE -eq 0 ]; then
            echo "Semgrep: no findings"
          elif [ $EXIT_CODE -eq 1 ]; then
            echo "::warning::Semgrep found issues (non-blocking for sample code)"
          else
            echo "::error::Semgrep crashed with exit code $EXIT_CODE"
            exit $EXIT_CODE
          fi

      - name: Install Trivy
        run: |
          TRIVY_VERSION="0.69.3"
          TRIVY_SHA256="1816b632dfe529869c740c0913e36bd1629cb7688bd5634f4a858c1d57c88b75"
          curl -sfL "https://github.com/aquasecurity/trivy/releases/download/v${TRIVY_VERSION}/trivy_${TRIVY_VERSION}_Linux-64bit.tar.gz" -o /tmp/trivy.tar.gz
          echo "${TRIVY_SHA256}  /tmp/trivy.tar.gz" | sha256sum -c -
          tar xzf /tmp/trivy.tar.gz -C /usr/local/bin trivy

      - name: Trivy config scan (Dockerfile, Helm, K8s YAML)
        run: trivy config --severity HIGH,CRITICAL --exit-code 0 .

      - name: Trivy filesystem scan (dependencies)
        run: trivy fs --severity HIGH,CRITICAL --exit-code 0 .

  # ============================================================
  # CodeQL — DISABLED
  # Requires GitHub Advanced Security (GHAS), not available on
  # private repos with GitHub Free plan. Re-enable if repo goes
  # public or org upgrades to GHAS.
  # ============================================================