ci.yml

name: CI & Security Audit

on:
  push:
    branches: [main, master]
  pull_request:
    branches: [main, master]

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  audit-and-test:
    name: Security Audit, Lint & Test
    runs-on: ubuntu-latest

    steps:
      - name: Check out repository
        uses: actions/checkout@v4

      - name: Set up Node.js
        uses: actions/setup-node@v4
        with:
          node-version: 20
          cache: "npm"

      - name: Install dependencies
        run: npm ci

      - name: Run dependency vulnerability audit
        run: npm audit --audit-level=critical
        continue-on-error: false

      - name: Run unit & integration tests
        run: npx vitest run
        env:
          NEXT_PUBLIC_SUPABASE_URL: https://mock.supabase.co
          NEXT_PUBLIC_SUPABASE_ANON_KEY: mock-anon-key
          SUPABASE_SERVICE_ROLE_KEY: mock-service-role-key
          DATABASE_URL: postgresql://mock:mock@localhost:5432/mock
          STRIPE_SECRET_KEY: sk_test_mock
          STRIPE_WEBHOOK_SECRET: whsec_mock