ci.yml

name: CI/CD Pipeline

on:
  push:
    branches: [ main, develop ]
  pull_request:
    branches: [ main, develop ]
  release:
    types: [ published ]

env:
  NODE_VERSION: '18'
  PYTHON_VERSION: '3.9'

jobs:
  test-node:
    name: Node.js Tests
    runs-on: ubuntu-latest
    
    steps:
    - name: Checkout code
      uses: actions/checkout@v4
      
    - name: Setup Node.js
      uses: actions/setup-node@v4
      with:
        node-version: ${{ env.NODE_VERSION }}
        cache: 'npm'
        
    - name: Install dependencies
      run: npm ci
      
    - name: Run linting
      run: npm run lint
      
    - name: Run tests
      run: npm test
      
    - name: Run CLI tests
      run: node test/test-cli.js

  test-python:
    name: Python Tests
    runs-on: ubuntu-latest
    strategy:
      matrix:
        python-version: ['3.8', '3.9', '3.10', '3.11']
        
    steps:
    - name: Checkout code
      uses: actions/checkout@v4
      
    - name: Setup Python
      uses: actions/setup-python@v4
      with:
        python-version: ${{ matrix.python-version }}
        
    - name: Cache pip dependencies
      uses: actions/cache@v3
      with:
        path: ~/.cache/pip
        key: ${{ runner.os }}-pip-${{ hashFiles('**/requirements*.txt') }}
        restore-keys: |
          ${{ runner.os }}-pip-
          
    - name: Install dependencies
      run: |
        python -m pip install --upgrade pip
        pip install -r requirements.txt
        pip install -r requirements-dev.txt
        
    - name: Run linting
      run: |
        black --check mcp_server/
        flake8 mcp_server/
        mypy mcp_server/
        
    - name: Run tests
      run: |
        pytest tests/ --cov=mcp_server --cov-report=xml --cov-report=html
        
    - name: Upload coverage to Codecov
      if: matrix.python-version == '3.9'
      uses: codecov/codecov-action@v3
      with:
        file: ./coverage.xml
        flags: python
        name: codecov-python

  integration-tests:
    name: Integration Tests
    runs-on: ubuntu-latest
    needs: [test-node, test-python]
    
    steps:
    - name: Checkout code
      uses: actions/checkout@v4
      
    - name: Setup Node.js
      uses: actions/setup-node@v4
      with:
        node-version: ${{ env.NODE_VERSION }}
        cache: 'npm'
        
    - name: Setup Python
      uses: actions/setup-python@v4
      with:
        python-version: ${{ env.PYTHON_VERSION }}
        
    - name: Install dependencies
      run: |
        npm ci
        python -m pip install --upgrade pip
        pip install -r requirements.txt
        
    - name: Run integration tests
      run: |
        npm run test:integration
        python -m pytest tests/integration/
        
    - name: Test CLI end-to-end
      run: |
        # Test basic CLI functionality
        node cli.js --help
        node cli.js --version
        
        # Test with sample document (if available)
        if [ -f "examples/sample-documents/sample.md" ]; then
          node cli.js build --base examples/sample-documents/sample.md --output ./test-output --dry-run
        fi

  security-audit:
    name: Security Audit
    runs-on: ubuntu-latest
    
    steps:
    - name: Checkout code
      uses: actions/checkout@v4
      
    - name: Setup Node.js
      uses: actions/setup-node@v4
      with:
        node-version: ${{ env.NODE_VERSION }}
        cache: 'npm'
        
    - name: Setup Python
      uses: actions/setup-python@v4
      with:
        python-version: ${{ env.PYTHON_VERSION }}
        
    - name: Install dependencies
      run: |
        npm ci
        pip install -r requirements.txt
        
    - name: Run npm audit
      run: npm audit --audit-level=moderate
      
    - name: Run Python security audit
      run: |
        pip install safety bandit
        safety check
        bandit -r mcp_server/ -f json -o bandit-report.json
        
    - name: Upload security reports
      uses: actions/upload-artifact@v3
      if: always()
      with:
        name: security-reports
        path: |
          bandit-report.json

  build-and-publish:
    name: Build and Publish
    runs-on: ubuntu-latest
    needs: [test-node, test-python, integration-tests, security-audit]
    if: github.event_name == 'release'
    
    steps:
    - name: Checkout code
      uses: actions/checkout@v4
      
    - name: Setup Node.js
      uses: actions/setup-node@v4
      with:
        node-version: ${{ env.NODE_VERSION }}
        cache: 'npm'
        registry-url: 'https://registry.npmjs.org'
        
    - name: Setup Python
      uses: actions/setup-python@v4
      with:
        python-version: ${{ env.PYTHON_VERSION }}
        
    - name: Install dependencies
      run: |
        npm ci
        python -m pip install --upgrade pip build twine
        pip install -r requirements.txt
        
    - name: Build packages
      run: |
        npm run build
        python -m build
        
    - name: Publish to NPM
      run: npm publish
      env:
        NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
        
    - name: Publish to PyPI
      run: python -m twine upload dist/*
      env:
        TWINE_USERNAME: __token__
        TWINE_PASSWORD: ${{ secrets.PYPI_TOKEN }}

  docker-build:
    name: Docker Build
    runs-on: ubuntu-latest
    needs: [test-node, test-python]
    
    steps:
    - name: Checkout code
      uses: actions/checkout@v4
      
    - name: Set up Docker Buildx
      uses: docker/setup-buildx-action@v3
      
    - name: Login to Docker Hub
      if: github.event_name == 'release'
      uses: docker/login-action@v3
      with:
        username: ${{ secrets.DOCKER_USERNAME }}
        password: ${{ secrets.DOCKER_PASSWORD }}
        
    - name: Build and push Docker image
      uses: docker/build-push-action@v5
      with:
        context: .
        platforms: linux/amd64,linux/arm64
        push: ${{ github.event_name == 'release' }}
        tags: |
          usemanusai/jaegis-ai-web-os:latest
          usemanusai/jaegis-ai-web-os:${{ github.ref_name }}
        cache-from: type=gha
        cache-to: type=gha,mode=max