ci.yml

name: CI

on:
  push:
    branches: [main, "feature/*", "fix/*"]
  pull_request:
    branches: [main]
  workflow_dispatch:

# Cancel in-progress runs for the same branch / PR
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

env:
  MIX_ENV: test
  OTP_VERSION: "29.0"
  ELIXIR_VERSION: "1.20.1"

jobs:
  # ── Linux: full CI quality gate ─────────────────────────────────────
  linux:
    name: "Linux · Elixir 1.20.1 · OTP 29.0"
    runs-on: ubuntu-latest
    timeout-minutes: 20
    steps:
      - uses: actions/checkout@v4

      - name: Set up Elixir
        uses: erlef/setup-beam@v1
        with:
          otp-version: ${{ env.OTP_VERSION }}
          elixir-version: ${{ env.ELIXIR_VERSION }}

      - name: Cache build artifacts
        uses: actions/cache@v4
        with:
          path: |
            _build
            deps
            priv/plts
          key: ${{ runner.os }}-mix-${{ hashFiles('**/mix.lock') }}
          restore-keys: |
            ${{ runner.os }}-mix-
            ${{ runner.os }}-

      - name: Install dependencies
        run: mix deps.get

      - name: Compile (warnings-as-errors)
        # We intentionally don't pass --all-warnings: that flag treats
        # third-party dep warnings (hpax bitstring ops, yamerl's
        # deprecated catch, etc.) as errors. We only want to enforce
        # warnings-as-errors on our own code, which `mix compile
        # --warnings-as-errors` already does.
        run: mix compile --warnings-as-errors

      - name: Check formatting
        run: mix format --check-formatted

      - name: Credo (strict)
        run: mix credo --strict

      - name: Audit dependencies for CVEs
        run: mix deps.audit

      - name: Check for unused dependencies
        run: mix deps.unlock --check-unused

      - name: xref (no orphan modules)
        run: mix xref graph --label compile-connected --fail-above 0

      - name: Dialyzer
        run: mix ci.dialyzer
        timeout-minutes: 15

      - name: Run tests with coverage
        # mix test --cover runs the tests once and produces both
        # the Elixir coverage report (cover/*.html) and the
        # excoveralls JSON (cover/excoveralls.json via tool: ExCoveralls).
        # The strict threshold check is disabled (threshold: 0 in
        # mix.exs) until CLI integration tests are added.
        run: mix test --cover

      - name: Post coverage to Codecov
        # Push the JSON to codecov.io using their bash uploader. This
        # is the path recommended by excoveralls for Codecov.
        #
        # Requires CODECOV_TOKEN in repo Settings -> Secrets -> Actions.
        # Get the token at https://codecov.io/gh/gilbertwong96/ado_cli
        # -> Settings -> Upload Token. The bash uploader reads it from
        # the CODECOV_TOKEN env var.
        #
        # Skip the step if the secret is not set. We don't fail the
        # build over missing coverage uploads — coverage is still
        # available as an action artifact download.
        env:
          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
        run: |
          if [ -z "$CODECOV_TOKEN" ]; then
            echo "::notice::CODECOV_TOKEN not set — skipping Codecov upload."
            echo "Add it at https://codecov.io/gh/gilbertwong96/ado_cli"
            echo "to enable the coverage badge."
            exit 0
          fi
          curl -Os https://uploader.codecov.io/latest/linux/codecov
          chmod +x codecov
          ./codecov --token "$CODECOV_TOKEN" --file ./cover/excoveralls.json
        continue-on-error: true

      - name: Upload coverage artifact
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: coverage-linux
          path: cover/excoveralls.json
          retention-days: 30

  # ── macOS: smoke test (the CLI is cross-compiled via Burrito) ──────
  macos:
    name: "macOS · Elixir 1.20.1"
    runs-on: macos-latest
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@v4

      - name: Set up Elixir
        uses: erlef/setup-beam@v1
        with:
          otp-version: ${{ env.OTP_VERSION }}
          elixir-version: ${{ env.ELIXIR_VERSION }}

      - name: Cache build artifacts
        uses: actions/cache@v4
        with:
          path: |
            _build
            deps
            priv/plts
          key: ${{ runner.os }}-mix-${{ hashFiles('**/mix.lock') }}
          restore-keys: |
            ${{ runner.os }}-mix-
            ${{ runner.os }}-

      - name: Install dependencies
        run: mix deps.get

      - name: Build escript
        run: mix escript.build

      - name: "Smoke test: --help works"
        run: "./ado --help"


      - name: "Smoke test: whoami with no auth returns friendly error"
        run: |
          rm -f "$HOME/.ado_cli/config.json"
          ./ado whoami || true

      - name: "Smoke test: logout is idempotent"
        run: ./ado logout

      - name: Run tests
        run: mix test

  # ── Summary job — gate merge on all green ───────────────────────────
  ci-status:
    name: CI Status
    if: always()
    needs: [linux, macos]
    runs-on: ubuntu-latest
    steps:
      - name: Fail if any matrix job failed
        if: needs.linux.result != 'success' || needs.macos.result != 'success'
        run: |
          echo "Linux result: ${{ needs.linux.result }}"
          echo "macOS result: ${{ needs.macos.result }}"
          exit 1