build-test.yml

name: Build & Test

on:
  push:
    branches: [ main, master, develop ]
  pull_request:
    branches: [ main, master ]

permissions:
  contents: read

jobs:
  test:
    name: Test on ${{ matrix.os }}
    runs-on: ${{ matrix.os }}
    strategy:
      matrix:
        os: [ubuntu-latest, windows-latest, macos-latest]

    env:
      DOTNET_CLI_TELEMETRY_OPTOUT: true
      DOTNET_NOLOGO: true
      DOTNET_SKIP_FIRST_TIME_EXPERIENCE: true

    steps:
      - name: Checkout repository
        uses: actions/checkout@v6
        with:
          fetch-depth: 0

      - name: Setup .NET SDK
        uses: actions/setup-dotnet@v5
        with:
          dotnet-version: '10.0.x'

      - name: Cache NuGet packages
        uses: actions/cache@v5
        with:
          path: ~/.nuget/packages
          key: ${{ runner.os }}-nuget-${{ hashFiles('**/*.csproj') }}
          restore-keys: |
            ${{ runner.os }}-nuget-

      - name: Restore dependencies
        run: dotnet restore --no-cache

      - name: Build solution
        run: dotnet build -c Release --no-restore --no-incremental

      - name: Run unit tests
        run: dotnet test NativeInvoke.Tests/NativeInvoke.Tests.csproj -c Release --no-build --logger "trx;LogFileName=test_results.trx" --results-directory ./TestResults --verbosity normal

      - name: Upload test results
        if: always()
        uses: actions/upload-artifact@v7
        with:
          name: test-results-${{ matrix.os }}
          path: ./TestResults/*.trx
          retention-days: 30

      - name: Parse test results
        if: always()
        run: |
          if [ -f "./TestResults/test_results.trx" ]; then
            echo "## Test Results Summary" >> $GITHUB_STEP_SUMMARY
            echo "Platform: ${{ matrix.os }}" >> $GITHUB_STEP_SUMMARY
            echo "" >> $GITHUB_STEP_SUMMARY

            # Extract test results from TRX file
            if command -v xmllint &> /dev/null; then
              TOTAL_TESTS=$(xmllint --xpath "string(//TestDefinitions/@totalTestCount)" ./TestResults/test_results.trx 2>/dev/null || echo "0")
              PASSED_TESTS=$(xmllint --xpath "string(//TestRun/Results/UnitTestResult[count(@outcome='passed')])" ./TestResults/test_results.trx 2>/dev/null || echo "0")
              FAILED_TESTS=$(xmllint --xpath "string(//TestRun/Results/UnitTestResult[count(@outcome='failed')])" ./TestResults/test_results.trx 2>/dev/null || echo "0")

              echo "✅ **Total Tests:** $TOTAL_TESTS" >> $GITHUB_STEP_SUMMARY
              echo "✅ **Passed:** $PASSED_TESTS" >> $GITHUB_STEP_SUMMARY
              echo "❌ **Failed:** $FAILED_TESTS" >> $GITHUB_STEP_SUMMARY

              if [ "$FAILED_TESTS" -gt 0 ]; then
                echo "" >> $GITHUB_STEP_SUMMARY
                echo "### ❌ Test Failures Detected" >> $GITHUB_STEP_SUMMARY
                echo "Unit tests failed on ${{ matrix.os }}. Check the test results for details." >> $GITHUB_STEP_SUMMARY
                exit 1
              else
                echo "" >> $GITHUB_STEP_SUMMARY
                echo "### ✅ All Tests Passed" >> $GITHUB_STEP_SUMMARY
              fi
            else
              echo "No test results file found" >> $GITHUB_STEP_SUMMARY
            fi
          else
            # Fallback for systems without xmllint
            echo "## Test Results Summary" >> $GITHUB_STEP_SUMMARY
            echo "Platform: ${{ matrix.os }}" >> $GITHUB_STEP_SUMMARY
            echo "✅ Tests completed" >> $GITHUB_STEP_SUMMARY
          fi
        shell: bash

  code-quality:
    name: Code Quality
    runs-on: ubuntu-latest
    needs: test

    env:
      DOTNET_CLI_TELEMETRY_OPTOUT: true
      DOTNET_NOLOGO: true
      DOTNET_SKIP_FIRST_TIME_EXPERIENCE: true

    steps:
      - name: Checkout repository
        uses: actions/checkout@v6

      - name: Setup .NET SDK
        uses: actions/setup-dotnet@v5
        with:
          dotnet-version: '10.0.x'

      - name: Restore dependencies
        run: dotnet restore --no-cache

      - name: Build solution
        run: dotnet build -c Release --no-restore --no-incremental

      - name: Analyze code quality
        run: |
          echo "## Code Quality Analysis" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY

          # Check for compiler warnings
          WARNINGS=$(dotnet build -c Release --no-restore --verbosity quiet 2>&1 | grep -c "warning" || echo "0")
          ERRORS=$(dotnet build -c Release --no-restore --verbosity quiet 2>&1 | grep -c "error" || echo "0")

          echo "📊 **Build Warnings:** $WARNINGS" >> $GITHUB_STEP_SUMMARY
          echo "🚨 **Build Errors:** $ERRORS" >> $GITHUB_STEP_SUMMARY

          if [ "$ERRORS" -gt 0 ]; then
            echo "" >> $GITHUB_STEP_SUMMARY
            echo "### ❌ Build Errors Detected" >> $GITHUB_STEP_SUMMARY
            echo "The build has $ERRORS errors. These must be fixed before release." >> $GITHUB_STEP_SUMMARY
            exit 1
          elif [ "$WARNINGS" -gt 0 ]; then
            echo "" >> $GITHUB_STEP_SUMMARY
            echo "### ⚠️ Build Warnings Detected" >> $GITHUB_STEP_SUMMARY
            echo "The build has $WARNINGS warnings. Consider fixing these for better code quality." >> $GITHUB_STEP_SUMMARY
          else
            echo "" >> $GITHUB_STEP_SUMMARY
            echo "### ✅ Clean Build" >> $GITHUB_STEP_SUMMARY
            echo "No warnings or errors detected!" >> $GITHUB_STEP_SUMMARY
          fi

  security-scan:
    name: Security Scan
    runs-on: ubuntu-latest
    needs: test
    if: github.event_name == 'push' && (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/master')

    steps:
      - name: Checkout repository
        uses: actions/checkout@v6

      - name: Setup .NET SDK
        uses: actions/setup-dotnet@v5
        with:
          dotnet-version: '10.0.x'

      - name: Run security scan
        run: |
          echo "## Security Scan Results" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY

          # Check for common security issues in source code
          SECURITY_ISSUES=0

          # Check for hardcoded secrets (basic patterns)
          if grep -r -i "password\|secret\|key\|token" --include="*.cs" --include="*.csproj" .; then
            echo "🚨 **Potential hardcoded secrets detected**" >> $GITHUB_STEP_SUMMARY
            echo "Review the code for hardcoded credentials or secrets." >> $GITHUB_STEP_SUMMARY
            SECURITY_ISSUES=$((SECURITY_ISSUES + 1))
          fi

          if [ $SECURITY_ISSUES -eq 0 ]; then
            echo "✅ **No obvious security issues found**" >> $GITHUB_STEP_SUMMARY
          fi