ci.yml

name: CI Pipeline

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

env:
  AWS_REGION: us-east-1
  ECR_REGISTRY: ${{ vars.AWS_ACCOUNT_ID }}.dkr.ecr.us-east-1.amazonaws.com/workshop

jobs:
  detect-changes:
    runs-on: ubuntu-latest
    outputs:
      api-gateway: ${{ steps.changes.outputs.api-gateway }}
      auth-service: ${{ steps.changes.outputs.auth-service }}
      file-service: ${{ steps.changes.outputs.file-service }}
      document-service: ${{ steps.changes.outputs.document-service }}
      collab-service: ${{ steps.changes.outputs.collab-service }}
      notification-service: ${{ steps.changes.outputs.notification-service }}
      search-service: ${{ steps.changes.outputs.search-service }}
      analytics-service: ${{ steps.changes.outputs.analytics-service }}
      admin-service: ${{ steps.changes.outputs.admin-service }}
      audit-service: ${{ steps.changes.outputs.audit-service }}
      web-app: ${{ steps.changes.outputs.web-app }}
      admin-dashboard: ${{ steps.changes.outputs.admin-dashboard }}
      demo-platform: ${{ steps.changes.outputs.demo-platform }}
      infrastructure: ${{ steps.changes.outputs.infrastructure }}
      report-service: ${{ steps.changes.outputs.report-service }}
      legacy-portal: ${{ steps.changes.outputs.legacy-portal }}
      api-tests: ${{ steps.changes.outputs.api-tests }}
    steps:
      - uses: actions/checkout@v4
      - uses: dorny/paths-filter@v3
        id: changes
        with:
          filters: |
            api-gateway:
              - 'services/api-gateway/**'
            auth-service:
              - 'services/auth-service/**'
            file-service:
              - 'services/file-service/**'
            document-service:
              - 'services/document-service/**'
            collab-service:
              - 'services/collab-service/**'
            notification-service:
              - 'services/notification-service/**'
            search-service:
              - 'services/search-service/**'
            analytics-service:
              - 'services/analytics-service/**'
            admin-service:
              - 'services/admin-service/**'
            audit-service:
              - 'services/audit-service/**'
            web-app:
              - 'frontend/client-app/**'
            admin-dashboard:
              - 'frontend/admin-dashboard/**'
            demo-platform:
              - 'demo-platform/**'
              - 'scripts/**'
            infrastructure:
              - 'infrastructure/**'
            report-service:
              - 'services/report-service/**'
            legacy-portal:
              - 'services/legacy-portal/**'
            api-tests:
              - 'tests/api/**'
              - 'docs/api-route-matrix.md'
              - 'services/api-gateway/internal/config/**'
              - 'docker-compose*.yml'
              - 'Makefile'

  # Go - API Gateway
  api-gateway:
    needs: detect-changes
    if: needs.detect-changes.outputs.api-gateway == 'true'
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: services/api-gateway
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-go@v5
        with:
          go-version: '1.22'
      - run: go vet ./...
      - run: go test -race -coverprofile=coverage.out ./...
      - run: go build -o /dev/null ./cmd/server

  # Java - Auth Service
  auth-service:
    needs: detect-changes
    if: needs.detect-changes.outputs.auth-service == 'true'
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: services/auth-service
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-java@v4
        with:
          distribution: temurin
          java-version: '17'
      - uses: gradle/actions/setup-gradle@v3
        with:
          gradle-version: '8.6'
      - run: gradle check --no-daemon

  # Rust - File Service
  file-service:
    needs: detect-changes
    if: needs.detect-changes.outputs.file-service == 'true'
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: services/file-service
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
        with:
          components: clippy, rustfmt
      - run: cargo fmt --check
      - run: cargo clippy -- -D warnings
      - run: cargo test
      - run: cargo build --release

  # Python - Document Service
  document-service:
    needs: detect-changes
    if: needs.detect-changes.outputs.document-service == 'true'
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: services/document-service
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: '3.12'
      - run: pip install poetry==1.8.2
      - run: poetry install
      - run: poetry run ruff check .
      - run: poetry run pytest --cov=app

  # Node.js - Collaboration Service
  collab-service:
    needs: detect-changes
    if: needs.detect-changes.outputs.collab-service == 'true'
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: services/collab-service
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: '20'
      - run: npm ci
      - run: npm run lint
      - run: npm test
      - run: npm run build

  # Kotlin - Notification Service
  notification-service:
    needs: detect-changes
    if: needs.detect-changes.outputs.notification-service == 'true'
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: services/notification-service
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-java@v4
        with:
          distribution: temurin
          java-version: '17'
      - uses: gradle/actions/setup-gradle@v3
        with:
          gradle-version: '8.6'
      - run: gradle check --no-daemon

  # Python - Search Service
  search-service:
    needs: detect-changes
    if: needs.detect-changes.outputs.search-service == 'true'
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: services/search-service
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: '3.12'
      - run: pip install -r requirements-dev.txt
      - run: python -m pytest --cov=app

  # Scala - Analytics Service
  analytics-service:
    needs: detect-changes
    if: needs.detect-changes.outputs.analytics-service == 'true'
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: services/analytics-service
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-java@v4
        with:
          distribution: temurin
          java-version: '17'
      - name: Install sbt
        run: |
          echo "deb https://repo.scala-sbt.org/scalasbt/debian all main" | sudo tee /etc/apt/sources.list.d/sbt.list
          curl -sL "https://keyserver.ubuntu.com/pks/lookup?op=get&search=0x2EE0EA64E40A89B84B2DF73499E82A75642AC823" | sudo apt-key add -
          sudo apt-get update
          sudo apt-get install -y sbt
      - run: sbt compile
      - run: sbt test

  # Ruby - Admin Service
  admin-service:
    needs: detect-changes
    if: needs.detect-changes.outputs.admin-service == 'true'
    runs-on: ubuntu-latest
    services:
      postgres:
        image: postgres:15
        env:
          POSTGRES_USER: otterworks
          POSTGRES_PASSWORD: otterworks
          POSTGRES_DB: admin_service_test
        ports:
          - 5432:5432
        options: >-
          --health-cmd pg_isready
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5
    defaults:
      run:
        working-directory: services/admin-service
    env:
      DATABASE_HOST: localhost
      DATABASE_PORT: 5432
      DATABASE_USER: otterworks
      DATABASE_PASSWORD: otterworks
      RAILS_ENV: test
    steps:
      - uses: actions/checkout@v4
      - uses: ruby/setup-ruby@v1
        with:
          ruby-version: '3.3'
          bundler-cache: true
          working-directory: services/admin-service
      - run: bundle exec rails db:schema:load
      - run: bundle exec rspec

  # C# - Audit Service
  audit-service:
    needs: detect-changes
    if: needs.detect-changes.outputs.audit-service == 'true'
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: services/audit-service
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-dotnet@v4
        with:
          dotnet-version: '8.0.x'
      - run: dotnet restore
      - run: dotnet build --no-restore
      - run: dotnet test --no-build

  # React/Next.js - Web App
  web-app:
    needs: detect-changes
    if: needs.detect-changes.outputs.web-app == 'true'
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: frontend/client-app
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: '20'
      - run: npm ci
      - run: npm run lint
      - run: npm test
      - run: npm run build

  # Angular - Admin Dashboard
  admin-dashboard:
    needs: detect-changes
    if: needs.detect-changes.outputs.admin-dashboard == 'true'
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: frontend/admin-dashboard
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: '20'
      - run: npm ci
      - run: npm run lint || true
      - run: npm test || true
      - run: npm run build

  # Java 17 / Maven - Report Service
  report-service:
    needs: detect-changes
    if: needs.detect-changes.outputs.report-service == 'true'
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: services/report-service
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-java@v4
        with:
          distribution: temurin
          java-version: '17'
          cache: maven
      - run: mvn -B verify

  # Java 11 / Maven - Legacy Portal. Uses the checked-in wrapper rather than the
  # runner's mvn: the portal builds on Spring Boot 2.x and pins its own Maven.
  legacy-portal:
    needs: detect-changes
    if: needs.detect-changes.outputs.legacy-portal == 'true'
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: services/legacy-portal
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
      - uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # v4
        with:
          distribution: temurin
          java-version: '11'
          cache: maven
      - run: ./mvnw test -B

  # Terraform validation
  infrastructure:
    needs: detect-changes
    if: needs.detect-changes.outputs.infrastructure == 'true'
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: infrastructure/terraform
    steps:
      - uses: actions/checkout@v4
      - uses: hashicorp/setup-terraform@v3
        with:
          terraform_version: 1.7.0
      - run: terraform fmt -check -recursive
      - run: terraform init -backend=false
      - run: terraform validate

  # The tenant control plane: dashboard typecheck/lint, plus the shell tests for
  # the reaper and idle-suspend. Those two decide what gets deleted and what gets
  # scaled to zero, and both fail silently by nature -- a tenant that is never
  # examined looks exactly like one that was correctly left alone.
  demo-platform:
    needs: detect-changes
    if: needs.detect-changes.outputs.demo-platform == 'true'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
        with:
          node-version: '20'
          cache: npm
          cache-dependency-path: demo-platform/dashboard/package-lock.json
      - run: npm ci
        working-directory: demo-platform/dashboard
      - run: npm run typecheck
        working-directory: demo-platform/dashboard
      - run: npm run lint
        working-directory: demo-platform/dashboard
      # Scoped to the control plane. `scripts/` has a backlog of findings that
      # would make this gate permanently red, and so ignored; widen it once
      # that is cleared.
      - run: shellcheck demo-platform/reaper/*.sh demo-platform/scripts/*.sh demo-platform/lib/*.sh demo-platform/runner/entrypoint.sh
      - run: ./demo-platform/reaper/test-reaper.sh
      - run: ./demo-platform/reaper/test-idle-suspend.sh
      - run: ./demo-platform/reaper/test-infra-sweep.sh
      - run: ./demo-platform/reaper/test-orphan-sweep.sh

  # Terraform validation for the demo control plane's own stack
  demo-platform-terraform:
    needs: detect-changes
    if: needs.detect-changes.outputs.demo-platform == 'true'
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: demo-platform/infra/terraform
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
      - uses: hashicorp/setup-terraform@b9cd54a3c349d3f38e8881555d616ced269862dd # v3
        with:
          terraform_version: 1.7.0
      - run: terraform fmt -check -recursive
      - run: terraform init -backend=false
      - run: terraform validate

  # Black-box API flow test validation
  api-flow-tests:
    needs: detect-changes
    if: needs.detect-changes.outputs.api-tests == 'true' || needs.detect-changes.outputs.api-gateway == 'true'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: '3.12'
      - run: python -m pip install -r tests/api/requirements.txt
      - run: python -m py_compile tests/api/*.py
      - run: python -m pytest tests/api --collect-only -q