ci.yml

name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

jobs:
  test-and-validate:
    runs-on: ubuntu-latest

    steps:
      - name: Checkout
        uses: actions/checkout@v5

      - name: Setup Node.js
        uses: actions/setup-node@v5
        with:
          node-version: '20'
          cache: 'npm'

      - name: Install dependencies
        run: npm ci

      - name: Check for critical vulnerabilities (production deps only)
        # Only PRODUCTION dependencies gate CI. npm audit hits the live advisory
        # DB, so auditing dev tooling (jest/eslint/etc.) made CI flip red with no
        # code change whenever a new advisory dropped. `--omit=dev` keeps a real
        # gate on shipped code while removing that flakiness.
        run: npm audit --audit-level=critical --omit=dev

      - name: Validate JavaScript syntax (backend)
        run: |
          echo "Checking backend JS files..."
          find src -name '*.js' -not -path '*__tests__*' -exec node --check {} \;
          echo "All backend files OK"

      - name: Validate JavaScript syntax (frontend)
        run: |
          echo "Checking frontend JS files..."
          for f in public/js/*.js public/js/pages/*.js public/js/components/*.js public/js/i18n/*.js; do
            node --check "$f" || exit 1
          done
          echo "All frontend files OK"

      - name: Lint (ESLint)
        # v7.7.0: enforce 0 warnings / 0 errors. CONTRIBUTING.md tells contributors
        # `npm run lint` must be clean — without this step, that promise was on the honor system.
        run: npm run lint

      - name: Run tests
        id: tests
        run: |
          # Capture Jest output, extract counts, and expose as step outputs so
          # the Summary step below can report accurate numbers instead of a
          # hardcoded string that rotted across releases pre-v6.15.0.
          set -o pipefail
          npm test 2>&1 | tee /tmp/jest.out
          TEST_LINE=$(grep -oE 'Tests:\s+.*(passed|skipped|failed)' /tmp/jest.out | tail -1 || echo "")
          PASSED=$(echo "$TEST_LINE" | grep -oE '[0-9]+ passed' | head -1 | grep -oE '[0-9]+' || echo "0")
          SKIPPED=$(echo "$TEST_LINE" | grep -oE '[0-9]+ skipped' | head -1 | grep -oE '[0-9]+' || echo "0")
          echo "passed=$PASSED" >> "$GITHUB_OUTPUT"
          echo "skipped=$SKIPPED" >> "$GITHUB_OUTPUT"
        env:
          APP_SECRET: ci-test-secret-key-not-for-production
          ENCRYPTION_KEY: ci-test-encryption-key-32-chars-min
          APP_ENV: test
          # v6.9.2: live Cloudflare smoke test. Skipped when secret absent.
          # Provision: Repo Settings → Secrets → Actions → CLOUDFLARE_TEST_TOKEN
          # (scoped token, `User:Read` only — no Zone or DNS permissions needed).
          CLOUDFLARE_TEST_TOKEN: ${{ secrets.CLOUDFLARE_TEST_TOKEN }}

      - name: Validate i18n completeness
        run: |
          node -e "
            global.window = {};
            global.localStorage = { getItem: ()=>null, setItem: ()=>{} };
            eval(require('fs').readFileSync('public/js/i18n.js', 'utf8'));
            const i18n = window.i18n;
            const langFiles = require('fs').readdirSync('public/js/i18n')
              .filter(f => f.endsWith('.js') && f !== 'TEMPLATE.js');
            for (const f of langFiles) {
              eval(require('fs').readFileSync('public/js/i18n/' + f, 'utf8'));
            }
            console.log('Languages:', i18n.languages.map(l => l.code).join(', '));
            const enKeys = JSON.stringify(i18n._translations.en).match(/\"[^\"]+\":/g)?.length || 0;
            console.log('EN keys: ~' + enKeys);
            if (enKeys < 100) { console.error('ERROR: EN translation seems incomplete'); process.exit(1); }
            console.log('i18n validation passed');
          "

      - name: Summary
        if: always()
        run: |
          echo "### CI Results" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "- Node.js syntax: ✅ (backend + frontend)" >> $GITHUB_STEP_SUMMARY
          echo "- Lint (ESLint): ✅" >> $GITHUB_STEP_SUMMARY
          echo "- Tests: ✅ (${{ steps.tests.outputs.passed || 'unknown' }} passed, ${{ steps.tests.outputs.skipped || '0' }} skipped — 100% passing)" >> $GITHUB_STEP_SUMMARY
          echo "- Security audit: ✅" >> $GITHUB_STEP_SUMMARY
          echo "- i18n: ✅ (11 languages)" >> $GITHUB_STEP_SUMMARY
          echo "- Dependencies: installed" >> $GITHUB_STEP_SUMMARY