ci.yml

name: CI

on:
  push:
    branches: [main, develop]
  pull_request:
    branches: [main, develop]

jobs:
  backend:
    name: Backend Tests
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: server

    services:
      postgres:
        image: postgres:16
        env:
          POSTGRES_USER: wrzdj
          POSTGRES_PASSWORD: wrzdj
          POSTGRES_DB: wrzdj_test
        ports:
          - 5432:5432
        options: >-
          --health-cmd pg_isready
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5

    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Set up Python
        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
        with:
          python-version: "3.11"
          cache: "pip"
          cache-dependency-path: server/pyproject.toml

      - name: Install dependencies
        run: |
          python -m pip install --upgrade pip
          pip install -e ".[dev]"

      - name: Lint with ruff
        run: ruff check .

      - name: Format check with ruff
        run: ruff format --check .

      - name: Security scan with bandit
        run: bandit -r app -c pyproject.toml

      - name: Dependency audit with pip-audit
        # Ignored CVEs (each requires explicit justification + revisit cadence):
        #   CVE-2024-23342 (ecdsa timing attack) - transitive from python-jose, no fix released yet
        #   CVE-2026-3219  (pip 26.x: concatenated tar/ZIP handling, CVSS 4.6 MEDIUM) -
        #                  affects pip the build tool, not runtime deps. Our CI installs from
        #                  pinned requirements only; no untrusted-source install path. Fix is
        #                  in pip PR #13870; revisit when GitHub Actions ships a patched pip.
        #   CVE-2026-6357  (pip 26.x: PATH handling) - same class as above; affects pip the
        #                  build tool only, not runtime deps. Revisit when GHA upgrades pip.
        #   PYSEC-2025-183 (pyjwt 2.10.1+ weak encryption, DISPUTED) - no fix released, the
        #                  pyjwt maintainers contest the advisory. We already pin pyjwt to the
        #                  latest available (2.12.1). Revisit when an upstream fix lands.
        #   MAL-2026-4750  (fastapi 0.136.3 "malicious code", WITHDRAWN by OSV 2026-05-26) -
        #                  False positive. 0.136.3 is an official tiangolo release; the flagged
        #                  dependency 'fastar' is a legitimate Rust-tar-bindings package
        #                  (published Oct 2025, predates the release) and is pulled ONLY via
        #                  fastapi's [standard] extra, which we do NOT install (we use plain
        #                  fastapi + uvicorn[standard]) - so it never enters our dependency tree.
        #                  We deliberately stay on 0.136.3 for its underscore-header rejection
        #                  (PR #15589) and SSE field validation (PR #15588). OSV withdrew the
        #                  advisory; pip-audit's feed still serves it. REMOVE this ignore once
        #                  the withdrawn entry is purged from the feed.
        run: pip-audit --ignore-vuln CVE-2024-23342 --ignore-vuln CVE-2026-3219 --ignore-vuln CVE-2026-6357 --ignore-vuln PYSEC-2025-183 --ignore-vuln MAL-2026-4750

      - name: Run tests with coverage
        env:
          DATABASE_URL: postgresql+psycopg://wrzdj:wrzdj@localhost:5432/wrzdj_test
          JWT_SECRET: test-secret-key
          ENV: development
        run: pytest -n 4 --dist=loadfile --cov=app --cov-report=xml --cov-report=term-missing --durations=25 --durations-min=1.0

      - name: Check Alembic migrations are up to date
        env:
          DATABASE_URL: postgresql+psycopg://wrzdj:wrzdj@localhost:5432/wrzdj_test
          JWT_SECRET: test-secret-key
          ENV: development
        run: alembic upgrade head && alembic check

      - name: Upload coverage to Codecov
        uses: codecov/codecov-action@57e3a136b779b570ffcdbf80b3bdc90e7fab3de2 # v6.0.0
        with:
          files: server/coverage.xml
          flags: backend
          fail_ci_if_error: false

  frontend:
    name: Frontend Tests
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: dashboard

    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Set up Node.js
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version: "22"
          cache: "npm"
          cache-dependency-path: dashboard/package-lock.json

      - name: Install dependencies
        run: npm ci

      - name: Lint
        run: npm run lint

      - name: Type check
        run: npx tsc --noEmit

      - name: Run tests with coverage
        run: npm test -- --run --coverage

      - name: Security audit
        run: npm audit --audit-level=high
        continue-on-error: true

  bridge:
    name: Bridge Tests
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: bridge

    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Set up Node.js
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version: "22"
          cache: "npm"
          cache-dependency-path: bridge/package-lock.json

      - name: Install dependencies
        run: npm ci

      - name: Type check
        run: npx tsc --noEmit

      - name: Run tests with coverage
        run: npm test -- --run --coverage

      - name: Security audit
        run: npm audit --audit-level=high
        continue-on-error: true

  bridge-app:
    name: Bridge App Tests
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: bridge-app

    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Set up Node.js
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version: "22"
          cache: "npm"
          cache-dependency-path: bridge-app/package-lock.json

      - name: Install bridge dependencies
        working-directory: bridge
        run: npm ci

      - name: Install dependencies
        run: npm ci

      - name: Type check
        run: npx tsc --noEmit

      - name: Run tests with coverage
        run: npm test -- --run --coverage

      - name: Security audit
        run: npm audit --audit-level=high
        continue-on-error: true

  kiosk:
    name: Kiosk WiFi Portal Tests
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: kiosk/wifi-portal

    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Set up Python
        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
        with:
          python-version: "3.11"

      - name: Install test dependencies
        run: pip install pytest

      - name: Run tests
        run: python -m pytest test_portal.py -q

  docker-build:
    name: Docker Build Smoke Test
    runs-on: ubuntu-latest
    permissions:
      contents: read

    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      - uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0

      # amd64-only, no push: verifies both images build on every PR/push without
      # paying for the multi-arch (arm64-under-QEMU) publish, which now runs only
      # on main/tag pushes in docker-publish.yml. The job NAME must stay exactly
      # "Docker Build Smoke Test" — main's branch protection requires that check.
      - name: Build backend image
        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
        with:
          context: ./server
          platforms: linux/amd64
          push: false
          load: false
          cache-from: type=gha,scope=ci-api
          cache-to: type=gha,mode=max,scope=ci-api

      - name: Build frontend image
        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
        with:
          context: ./dashboard
          build-args: |
            NEXT_PUBLIC_API_URL=http://localhost:8000
          platforms: linux/amd64
          push: false
          load: false
          cache-from: type=gha,scope=ci-web
          cache-to: type=gha,mode=max,scope=ci-web