ci.yml

name: CI

# Fast quality + security gates on every push/PR. Heavy e2e (Redis/Kafka) and
# chaos/mutation/bench run in nightly.yml. Actions use version tags; Dependabot
# (github-actions) + a follow-up SHA-pin pass harden these further.

on:
  push:
    branches: [main, develop]
  pull_request:
    branches: [main, develop]

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: read

jobs:
  quality:
    name: Quality (lint · typecheck · 100% coverage · arch)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
      - uses: actions/setup-node@v7
        with:
          node-version: "22"
          cache: "npm"
      - run: npm ci
      - name: Lint (zero errors)
        run: npm run lint
      - name: Typecheck (zero errors)
        run: npm run typecheck
      - name: Architecture (no circular imports)
        run: npm run lint:arch
      - name: API surface gate (api-extractor — fails on undocumented public-API drift)
        run: npm run api:check
      - name: Unit tests + coverage (enforced 100% of src/**)
        run: npm run test:coverage
      - name: Upload coverage report
        uses: actions/upload-artifact@v7
        if: always()
        with:
          name: coverage
          path: coverage/

  board:
    name: Board UI (audit · typecheck · build · tests)
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: board
    steps:
      - uses: actions/checkout@v6
      - uses: actions/setup-node@v7
        with:
          node-version: "22"
          cache: "npm"
          cache-dependency-path: board/package-lock.json
      - run: npm ci
      # Gate the board on HIGH+ advisories too (root has this; the board
      # previously had no audit step, which let an esbuild HIGH go uncaught).
      - name: Dependency audit (fail on HIGH+)
        run: npm audit --audit-level=high
      # `build` is `tsc --noEmit && vite build` — typechecks then bundles.
      - run: npm run build
      - run: npm test

  security:
    name: Security (audit · secrets · SBOM · OSV)
    runs-on: ubuntu-latest
    permissions:
      contents: read
      security-events: write
    steps:
      - uses: actions/checkout@v6
        with:
          fetch-depth: 0
      - uses: actions/setup-node@v7
        with:
          node-version: "22"
          cache: "npm"
      - run: npm ci
      - name: Dependency audit (fail on HIGH+; moderates triaged in SECURITY.md)
        run: npm audit --audit-level=high
      - name: Generate CycloneDX 1.6 SBOM
        # --ignore-npm-errors: `npm ls` exits non-zero on a harmless dev-only peer
        # mismatch (madge→precinct wants TypeScript 5.x while the project pins 6.x);
        # the installed tree is valid, so the SBOM is still complete and accurate.
        run: npx --yes @cyclonedx/cyclonedx-npm@latest --ignore-npm-errors --output-format JSON --spec-version 1.6 --output-file sbom.json
      - name: Upload SBOM
        uses: actions/upload-artifact@v7
        with:
          name: sbom-cyclonedx
          path: sbom.json
      - name: Secret scan (gitleaks)
        uses: gitleaks/gitleaks-action@v3
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      - name: OSV-Scanner
        uses: google/osv-scanner-action/osv-scanner-action@v2.3.8
        continue-on-error: true
        with:
          scan-args: |-
            --lockfile=package-lock.json
            --format=sarif
            --output=osv.sarif
      - name: Upload OSV SARIF
        # `always()` so the SARIF still uploads even when the OSV-Scanner step
        # itself errors after writing the file (it runs continue-on-error). The
        # `hashFiles` guard covers the other path: when an earlier gate (e.g. the
        # audit) fails, OSV-Scanner is skipped and osv.sarif never exists — an
        # unguarded upload then adds a bogus second failure ("Path does not
        # exist: osv.sarif") that masks the real one.
        if: always() && hashFiles('osv.sarif') != ''
        uses: github/codeql-action/upload-sarif@v4
        with:
          sarif_file: osv.sarif
          category: osv-scanner

  codeql:
    name: CodeQL (JS/TS static analysis)
    runs-on: ubuntu-latest
    permissions:
      contents: read
      security-events: write
    steps:
      - uses: actions/checkout@v6
      - uses: github/codeql-action/init@v4
        with:
          languages: javascript-typescript
      - uses: github/codeql-action/analyze@v4

  docker:
    name: Docker build + image scan (Trivy)
    runs-on: ubuntu-latest
    needs: [quality]
    permissions:
      contents: read
      security-events: write
    steps:
      - uses: actions/checkout@v6
      - uses: docker/setup-buildx-action@v4
      - uses: docker/build-push-action@v6
        with:
          context: .
          push: false
          load: true # load into the local daemon so Trivy can scan the built image
          tags: kaiban-distributed:ci-${{ github.sha }}
      # Blocking gate: fail the build on a FIXABLE CRITICAL/HIGH OS or library CVE
      # in the runtime image (unfixed base-image CVEs are reported but don't block).
      - name: Scan image (Trivy — gate on fixable CRITICAL/HIGH)
        uses: aquasecurity/trivy-action@v0.36.0
        with:
          image-ref: kaiban-distributed:ci-${{ github.sha }}
          format: table
          severity: CRITICAL,HIGH
          ignore-unfixed: true
          exit-code: "1"
        env:
          TRIVY_DB_REPOSITORY: ghcr.io/aquasecurity/trivy-db
      # Always publish the full SARIF to the Security tab, even when the gate fails.
      - name: Scan image (Trivy — SARIF report)
        if: always()
        uses: aquasecurity/trivy-action@v0.36.0
        with:
          image-ref: kaiban-distributed:ci-${{ github.sha }}
          format: sarif
          output: trivy.sarif
          severity: CRITICAL,HIGH
          ignore-unfixed: true
          exit-code: "0"
        env:
          TRIVY_DB_REPOSITORY: ghcr.io/aquasecurity/trivy-db
      - name: Upload Trivy SARIF to code scanning
        if: always()
        uses: github/codeql-action/upload-sarif@v4
        with:
          sarif_file: trivy.sarif
          category: trivy-image