ci.yml

name: CI

on:
  pull_request:
    branches: [main]
  push:
    branches: [main]

jobs:
  python-checks:
    name: Python Checks
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5

      - name: Set up Python 3.11
        uses: actions/setup-python@v5
        with:
          python-version: "3.11"

      - name: Install dependencies
        run: |
          pip install -r backend/requirements.txt \
                      -r agent/requirements.txt \
                      -r requirements-dev.txt

      - name: Check formatting (black)
        run: ./scripts/format-python.sh

      - name: Lint (flake8 + pylint)
        run: ./scripts/lint-python.sh

      - name: Security scan (bandit)
        run: ./scripts/security-python.sh

      - name: Backend unit tests with coverage
        run: ./scripts/test-backend.sh
        env:
          BYPASS_AUTH: "true"

      - name: Upload backend coverage
        uses: actions/upload-artifact@v5
        if: always()
        with:
          name: backend-coverage
          path: coverage/backend/

      - name: Host Daemon unit tests with coverage
        run: ./scripts/test-daemon.sh

      - name: Upload daemon coverage
        uses: actions/upload-artifact@v5
        if: always()
        with:
          name: daemon-coverage
          path: coverage/daemon/

  frontend-checks:
    name: Frontend Checks
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5

      - name: Set up Node 22
        uses: actions/setup-node@v5
        with:
          node-version: "22"

      - name: Install dependencies
        run: cd frontend && npm ci

      - name: Check formatting (prettier)
        run: ./scripts/format-frontend.sh

      - name: Lint (eslint)
        run: ./scripts/lint-frontend.sh

      - name: Type check (tsc)
        run: ./scripts/typecheck-frontend.sh

      - name: Build
        run: ./scripts/build-frontend.sh

      - name: Unit tests with coverage
        run: ./scripts/test-frontend.sh

      - name: Upload frontend coverage
        uses: actions/upload-artifact@v5
        if: always()
        with:
          name: frontend-coverage
          path: coverage/frontend/

      - name: Security audit (npm audit)
        run: ./scripts/security-frontend.sh
        continue-on-error: true

  secret-detection:
    name: Secret Detection
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5
        with:
          fetch-depth: 0

      - name: Run gitleaks
        uses: gitleaks/gitleaks-action@v2
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  e2e-tests:
    name: E2E Tests
    runs-on: ubuntu-latest
    needs: python-checks
    steps:
      - uses: actions/checkout@v5

      - name: Set up Python 3.11
        uses: actions/setup-python@v5
        with:
          python-version: "3.11"

      - name: Install dependencies
        run: |
          pip install -r backend/requirements.txt \
                      -r agent/requirements.txt \
                      -r requirements-dev.txt

      - name: Run E2E tests
        run: ./scripts/test-e2e.sh
        env:
          BYPASS_AUTH: "true"

  coverage-summary:
    name: Coverage Summary
    runs-on: ubuntu-latest
    needs: [python-checks, frontend-checks]
    if: always()
    steps:
      - uses: actions/checkout@v5

      - name: Download all coverage artifacts
        uses: actions/download-artifact@v5
        with:
          path: coverage/

      - name: Generate coverage summary table
        run: |
          python3 << 'PYEOF'
          import json, os

          def read_cov(path):
              """Read a coverage JSON and return (covered, total)."""
              if not os.path.isfile(path):
                  return None, None
              with open(path) as f:
                  data = json.load(f)
              t = data.get("totals", {})
              stmts = t.get("num_statements", 0)
              covered = t.get("covered_lines", 0)
              return covered, stmts

          def read_frontend_cov(path):
              """Read vitest v8 coverage-summary.json."""
              if not os.path.isfile(path):
                  return None, None
              with open(path) as f:
                  data = json.load(f)
              t = data.get("total", {}).get("lines", {})
              total = int(t.get("total", 0))
              covered = int(t.get("covered", 0))
              if total == 0:
                  return None, None
              return covered, total

          def pct(covered, total):
              return (covered / total * 100) if total else 0

          rows = []
          grand_covered = grand_total = 0

          # Backend
          c, t = read_cov("coverage/backend-coverage/coverage.json")
          if c is not None:
              rows.append(("Backend (backend/app)", c, t))
              grand_covered += c
              grand_total += t

          # Daemon
          c, t = read_cov("coverage/daemon-coverage/coverage.json")
          if c is not None:
              rows.append(("Host Daemon (agent)", c, t))
              grand_covered += c
              grand_total += t

          # Frontend (json-summary reporter output)
          c, t = read_frontend_cov(
              "coverage/frontend-coverage/coverage-summary.json"
          )
          if c is not None:
              rows.append(("Frontend (src)", c, t))
              grand_covered += c
              grand_total += t

          lines = [
              "## Test Coverage Summary",
              "",
              "| Component | Covered / Total | Percent |",
              "|-----------|-----------------|---------|",
          ]
          for name, covered, total in rows:
              lines.append(
                  f"| {name} | {covered}/{total}"
                  f" | {pct(covered, total):.1f}% |"
              )
          lines.append(
              f"| **Total** | **{grand_covered}/{grand_total}**"
              f" | **{pct(grand_covered, grand_total):.1f}%** |"
          )

          summary_path = os.environ.get(
              "GITHUB_STEP_SUMMARY", "/dev/null"
          )
          with open(summary_path, "a") as f:
              f.write("\n".join(lines) + "\n")

          # Also print to stdout
          print("\n".join(lines))
          PYEOF

  container-builds:
    name: Container Builds
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5

      - name: Build backend container
        run: |
          podman build --no-cache -t agent-dashboard-backend \
            -f backend/Containerfile .

      - name: Build frontend container
        run: |
          podman build --no-cache -t agent-dashboard-frontend \
            -f frontend/Containerfile .

      - name: Generate agent daemon Containerfile
        run: |
          pip install -q pyyaml jinja2
          python3 agent/generate_containerfile.py

      - name: Build agent daemon container
        run: |
          podman build --no-cache -t agent-dashboard-daemon \
            -f agent/Containerfile agent/
        timeout-minutes: 15