ci.yml

# ---------------------------------------------------------------------------
# CI Pipeline — build, test, and security scan on every PR
# ---------------------------------------------------------------------------
# Phase 6.7: Runs on PRs to main. Does NOT deploy — that's Phase 7.
#
# Jobs:
#   1. backend  — dotnet build + vulnerability check
#   2. frontend — npm ci + tsc + build + audit
#   3. security — gitleaks secret scanning
# ---------------------------------------------------------------------------

name: CI

on:
  pull_request:
    branches: [main]
  push:
    branches: [main, refactor/main]

concurrency:
  group: ci-${{ github.ref }}
  cancel-in-progress: true

jobs:
  backend:
    name: Backend (build + vuln check)
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: 02-Server

    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-dotnet@v4
        with:
          dotnet-version: "8.0.x"

      - name: Restore
        run: dotnet restore

      - name: Build
        run: dotnet build --no-restore -c Release

      - name: Check for vulnerable packages
        run: |
          dotnet list package --vulnerable --include-transitive 2>&1 | tee vuln-report.txt
          if grep -q "has the following vulnerable packages" vuln-report.txt; then
            echo "::warning::Vulnerable packages detected — review vuln-report.txt"
          fi

  frontend:
    name: Frontend (build + type check + audit)
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: 03-Client

    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-node@v4
        with:
          node-version: "20"
          cache: "npm"
          cache-dependency-path: 03-Client/package-lock.json

      - name: Install dependencies
        run: npm ci

      - name: Type check
        run: npx tsc --noEmit

      - name: Build
        run: npm run build
        env:
          VITE_API_BASE_URL: https://placeholder.azurewebsites.net/api

      - name: Audit (high + critical only)
        run: npm audit --audit-level=high || true

  security:
    name: Secret scanning
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - uses: gitleaks/gitleaks-action@v2
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}