ci.yml

name: CI

on:
  push:
    branches: [ main ]
  pull_request:
    branches: [ main ]

jobs:
  build-and-test-js-python:
    name: build-and-test-js-python (24.x, ${{ matrix.python-version }})
    runs-on: ubuntu-latest
    strategy:
      matrix:
        node-version: [24.15.0]
        python-version: [3.11]
    steps:
      - name: Checkout
        uses: actions/checkout@v7
        with:
          fetch-depth: 0

      - name: Setup Python (early)
        uses: actions/setup-python@v7
        with:
          python-version: ${{ matrix.python-version }}

      - name: Install canonical Python test dependencies
        run: |
          python -m pip install --upgrade pip
          python -m pip install -r backend/python/requirements-test.txt

      - name: Setup Node.js
        uses: actions/setup-node@v7
        with:
          node-version: ${{ matrix.node-version }}
          cache: 'npm'

      - name: Cache node modules
        uses: actions/cache@v6
        with:
          path: |
            **/node_modules
          key: ${{ runner.os }}-node-${{ matrix.node-version }}-${{ hashFiles('**/package-lock.json', '**/package.json') }}
          restore-keys: |
            ${{ runner.os }}-node-${{ matrix.node-version }}-

      - name: Install root npm dependencies
        run: npm ci

      - name: Install frontend dependencies
        working-directory: frontend
        run: npm ci

      - name: Run JS runtime tests
        run: npm run test:node

      - name: Build frontend
        working-directory: frontend
        run: npm run build

      - name: Typecheck frontend
        working-directory: frontend
        run: npm run typecheck

      - name: Secret Scan (Gitleaks)
        uses: gitleaks/gitleaks-action@v3
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Node audit (advisory)
        run: |
          echo "ADVISORY ONLY: this audit is non-blocking by design."
          if ! npm audit --audit-level=moderate; then
            echo "npm audit reported findings or returned a non-zero exit code."
          fi

      - name: Validate public demo readiness
        run: npm run validate:public-demo

  rust-tests:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v7

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@stable

      - name: Run cargo tests
        working-directory: backend/rust
        run: cargo test --locked --all

      - name: Cargo audit (advisory)
        run: |
          echo "ADVISORY ONLY: this audit is non-blocking by design."
          if ! cargo install --locked cargo-audit; then
            echo "cargo-audit installation failed; leaving this advisory audit non-blocking."
            exit 0
          fi
          cd backend/rust
          if ! cargo audit; then
            echo "cargo audit reported findings or returned a non-zero exit code."
          fi