ci.yml

name: CI/CD Pipeline

on:
  push:
    branches: [ main ]
    tags: [ 'v*' ]
    paths-ignore:
      - '.github/CODEOWNERS'
      - '.github/SECURITY.md'
      - '.slsa-goreleaser/**'
      - '.gitignore'
      - 'docs/**'
      - '**.md'
  pull_request:
    branches: [ main ]
    paths-ignore:
      - '.github/CODEOWNERS'
      - '.github/SECURITY.md'
      - '.slsa-goreleaser/**'
      - '.gitignore'
      - 'docs/**'
      - '**.md'

# NOTE: If your enterprise restricts GITHUB_TOKEN permissions,
# create a Personal Access Token (PAT) with 'repo' and 'write:packages' scopes
# and add it as a secret named 'GH_PAT'

env:
  GO_VERSION: '1.26'
  DAGGER_VERSION: '0.18.14'
  REGISTRY: ghcr.io
  IMAGE_NAME: ${{ github.repository }}

jobs:
  lint:
    name: Lint Code
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v5
    
    - name: Set up Go
      uses: actions/setup-go@v6
      with:
        go-version: ${{ env.GO_VERSION }}
    
    - name: Download dependencies
      run: go mod download

    - name: Install mockgen
      run: go install github.com/golang/mock/mockgen@v1.6.0

    - name: Generate mocks
      run: go generate ./...
    
    - uses: dagger/dagger-for-github@8.0.0
      with:
        version: ${{ env.DAGGER_VERSION }}
        verb: call
        module: ./ci
        args: lint --source .

  test:
    name: Run Tests
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v5
    
    - name: Set up Go
      uses: actions/setup-go@v6
      with:
        go-version: ${{ env.GO_VERSION }}

    - name: Install mockgen
      run: go install github.com/golang/mock/mockgen@v1.6.0

    - name: Add Go bin to PATH
      run: echo "$(go env GOPATH)/bin" >> $GITHUB_PATH
    
    - name: Download dependencies
      run: go mod download
    
    - uses: dagger/dagger-for-github@8.0.0
      with:
        version: ${{ env.DAGGER_VERSION }}
        verb: call
        module: ./ci
        args: test --source .
    
    - name: Run JS client tests
      run: node web/js/graphql-client-test.js

    - name: Run tests with coverage
      run: |
        go test -race -coverprofile=coverage.txt -covermode=atomic ./...
        
    - name: Upload coverage to Codecov
      uses: codecov/codecov-action@v5
      with:
        token: ${{ secrets.CODECOV_TOKEN }}
        files: ./coverage.txt
        flags: unittests
        name: codecov-umbrella
        fail_ci_if_error: false

  web-v2:
    # v2 SPA (Vite + React + TypeScript) lives at web-v2/. Its built
    # output is embedded into the Go binary via //go:embed all:dist,
    # so the Go test/build jobs above don't catch a broken TypeScript
    # source — the pre-checked-in dist/ keeps embedding cleanly. This
    # job is the source-side safety net: typecheck, lint, unit tests,
    # production build, and a schema-drift check between the GraphQL
    # SDL the Go backend exposes and the copy web-v2 codegen consumes.
    #
    # No untrusted user input flows into run: blocks. The only ${{ }}
    # expression is github.workspace, which is GitHub-controlled.
    name: Web v2 (typecheck · lint · test · build · schema check)
    runs-on: ubuntu-latest
    timeout-minutes: 15
    # Read-only token: this job only checks out and builds. Keeps the
    # blast radius minimal if a dependency in the build is compromised.
    permissions:
      contents: read
    steps:
      # Actions pinned to full commit SHAs (not moving tags) so an action
      # owner cannot silently repoint a tag at malicious code in our runner.
      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
        with:
          persist-credentials: false

      - name: GraphQL schema drift check
        # Backend SDL is the source of truth; web-v2 keeps a synced
        # copy so its codegen produces typed clients. Fail loudly if
        # they ever diverge.
        run: |
          diff -q internal/reporter/graphql/schema.graphql \
                  web-v2/src/gql/schema.graphql \
            || { echo "::error::GraphQL schema drift between backend and web-v2 copy. Sync the two files."; exit 1; }

      - uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4.3.0
        with:
          version: 9

      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
        with:
          node-version: '20'
          cache: 'pnpm'
          cache-dependency-path: web-v2/pnpm-lock.yaml

      - name: Install dependencies
        working-directory: web-v2
        run: pnpm install --frozen-lockfile

      - name: Typecheck
        working-directory: web-v2
        run: pnpm typecheck

      - name: Lint
        working-directory: web-v2
        run: pnpm lint

      - name: Unit tests
        working-directory: web-v2
        run: pnpm test:run

      - name: Build production bundle
        working-directory: web-v2
        run: pnpm build

  security-scan:
    name: Security Scan (Trivy)
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v5
    
    - uses: dagger/dagger-for-github@8.0.0
      with:
        version: ${{ env.DAGGER_VERSION }}
        verb: call
        module: ./ci
        args: security-scan --source .

  vulnerability-check:
    name: Go Vulnerability Check
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v5
    
    - name: Set up Go
      uses: actions/setup-go@v6
      with:
        go-version: ${{ env.GO_VERSION }}

    - name: Install govulncheck
      run: go install golang.org/x/vuln/cmd/govulncheck@v1.3.0
    
    - name: Run govulncheck
      run: |
        # Advisory-only: || true prevents blocking merges on vulnerabilities in indirect
        # dependencies that have no available fix. Remove once all transitive CVEs are cleared.
        govulncheck ./cmd/... ./internal/... ./pkg/... || true

  dependency-review:
    name: Dependency Review
    runs-on: ubuntu-latest
    if: github.event_name == 'pull_request'
    steps:
    - uses: actions/checkout@v5
    - uses: actions/dependency-review-action@v4.7.1
      with:
        fail-on-severity: moderate
        # Allow-list of advisories confined to the web-v2 dev/build/test
        # toolchain (babel, esbuild, vite, ws, lodash, form-data, immutable,
        # js-yaml — pulled via graphql-codegen / jsdom / vite). None reach the
        # shipped production bundle (verified: no runtime dependency path), and
        # several have no in-place patch on the pinned major (e.g. vite's
        # server.fs.deny fix lands only in 6.x). fail-on-scopes can't filter
        # these because GitHub's dependency graph carries no dev/runtime scope
        # for the pnpm lockfile. Runtime deps stay fully enforced at moderate+.
        # Revisit when the web-v2 toolchain is upgraded.
        allow-ghsas: GHSA-4x5r-pxfx-6jf8,GHSA-67mh-4wv8-2f99,GHSA-hmw2-7cc7-3qxx,GHSA-wf6x-7x77-mvgw,GHSA-h67p-54hq-rp68,GHSA-r5fr-rjxr-66jc,GHSA-f23m-r3pf-42rh,GHSA-4w7w-66w2-5vf9,GHSA-v6wh-96g9-6wx3,GHSA-fx2h-pf6j-xcff,GHSA-96hv-2xvq-fx4p,GHSA-v56q-mh7h-f735,GHSA-xvcm-6775-5m9r

  build:
    name: Build Images
    runs-on: ubuntu-latest
    # For PRs, only run a single build test. For main/tags, build all platforms
    strategy:
      matrix:
        platform: ${{ github.event_name == 'pull_request' && fromJson('["linux/amd64"]') || fromJson('["linux/amd64", "linux/arm64"]') }}
    steps:
    - uses: actions/checkout@v5
    
    - name: Set up Docker Buildx
      uses: docker/setup-buildx-action@v3
    
    - name: Cache Docker layers
      uses: actions/cache@v4
      with:
        path: /tmp/.buildx-cache
        key: ${{ runner.os }}-buildx-${{ github.sha }}
        restore-keys: |
          ${{ runner.os }}-buildx-
    
    - uses: dagger/dagger-for-github@8.0.0
      with:
        version: ${{ env.DAGGER_VERSION }}
        verb: call
        module: ./ci
        args: build --source . --platforms ${{ matrix.platform }}


  all-checks:
    name: All Checks (Main Branch)
    runs-on: ubuntu-latest
    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
    steps:
    - uses: actions/checkout@v5
    
    - uses: dagger/dagger-for-github@8.0.0
      with:
        version: ${{ env.DAGGER_VERSION }}
        verb: call
        module: ./ci
        args: all --source .

  upload-main-coverage:
    name: Upload Coverage (main)
    runs-on: ubuntu-latest
    permissions:
      contents: read
    if: github.event.repository.fork == false && github.ref == 'refs/heads/main'
    steps:
      - uses: actions/checkout@v4
        with:
          persist-credentials: false
      - uses: actions/setup-go@v5
        with:
          go-version: ${{ env.GO_VERSION }}
      - run: go test -race -coverprofile=coverage.txt -covermode=atomic ./...
      # codecov/codecov-action v5.1.2 (pinned for security)
      - uses: codecov/codecov-action@5a1091511ad55cbe89839c7260b706298ca349f7
        with:
          token: ${{ secrets.CODECOV_TOKEN }}
          files: ./coverage.txt
          flags: unittests
          name: main-coverage
          fail_ci_if_error: false