ci.yml

name: CI

on:
  pull_request:
  push:
    branches: [dev, main]
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: ci-${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  # Cancel stale PR checks, but never interrupt a push run during a deployment.
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

jobs:
  verify:
    name: Lint, typecheck, tests and build
    runs-on: ubuntu-24.04
    timeout-minutes: 15
    steps:
      - name: Check out repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7

      - name: Set up Node.js
        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7
        with:
          node-version: 24
          cache: npm

      - name: Install dependencies
        run: npm ci

      - name: Lint
        run: npm run lint

      - name: Typecheck
        run: npm run typecheck

      - name: Unit tests
        run: npm test

      - name: Deployment gate tests
        run: node --test scripts/*.test.mjs

      - name: Production build
        run: npm run build

  site-quality:
    name: Browser and SEO checks
    runs-on: ubuntu-24.04
    timeout-minutes: 30
    steps:
      - name: Check out repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7

      - name: Set up Node.js
        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7
        with:
          node-version: 24
          cache: npm

      - name: Set up .NET for browser checks
        uses: actions/setup-dotnet@0f4a354dd5547a28c70b7853dbd95d5b67886e73 # v6
        with:
          dotnet-version: 10.0.x

      - name: Install dependencies
        run: npm ci

      - name: Check desktop and mobile browser behavior
        env:
          E2E_DOTNET: '1'
        run: npm run e2e

      - name: Crawl production build and verify SEO
        run: npm run launch-check

      - name: Upload browser failure screenshots
        if: failure()
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
        with:
          name: browser-screenshots-${{ github.run_attempt }}
          path: e2e/.out/*.png
          include-hidden-files: true
          if-no-files-found: ignore
          retention-days: 7

  backend:
    name: Backend build and tests
    runs-on: ubuntu-24.04
    timeout-minutes: 15
    services:
      postgres:
        image: postgres:17-alpine
        env:
          # Fixed credentials are only for this disposable CI database.
          POSTGRES_DB: procoderji_test
          POSTGRES_USER: postgres
          POSTGRES_PASSWORD: postgres
        ports:
          - 5432:5432
        options: >-
          --health-cmd "pg_isready -U postgres -d procoderji_test"
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5
    steps:
      - name: Check out repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7

      - name: Set up .NET
        uses: actions/setup-dotnet@0f4a354dd5547a28c70b7853dbd95d5b67886e73 # v6
        with:
          dotnet-version: 10.0.x

      - name: Restore backend dependencies
        run: dotnet restore backend/ProCoderJi.slnx --locked-mode

      - name: Build backend
        run: dotnet build backend/ProCoderJi.slnx --configuration Release --no-restore

      - name: Test backend
        run: dotnet test backend/ProCoderJi.slnx --configuration Release --no-build --collect:"XPlat Code Coverage" --results-directory "$RUNNER_TEMP/backend-test-results"

      - name: Verify API coverage collection
        run: |
          python3 - "$RUNNER_TEMP/backend-test-results" <<'PY'
          import sys
          import xml.etree.ElementTree as ET
          from pathlib import Path

          reports = list(Path(sys.argv[1]).rglob("coverage.cobertura.xml"))
          covered = any(
              int(line.get("hits", "0")) > 0
              for report in reports
              for package in ET.parse(report).findall("./packages/package")
              if package.get("name") == "ProCoderJi.Api"
              for line in package.findall(".//line")
          )
          if not covered:
              raise SystemExit("Coverage collection did not record executed ProCoderJi.Api lines.")
          print("Coverage collection recorded executed ProCoderJi.Api lines.")
          PY

      - name: Verify PostgreSQL migrations
        # Validates the PostgreSQL schema path; Google sign-in needs separate live checks.
        env:
          ASPNETCORE_ENVIRONMENT: Development
          Database__Provider: Postgres
          ConnectionStrings__Platform: 'Host=localhost;Port=5432;Database=procoderji_test;Username=postgres;Password=postgres'
          PublicOrigin: http://localhost:3000
        run: dotnet run --project backend/src/ProCoderJi.Api --configuration Release --no-build --no-launch-profile -- --migrate

  deploy:
    name: Deploy checked branch
    permissions:
      contents: read
      deployments: write
    needs: [verify, site-quality, backend]
    if: github.event_name == 'push' && github.repository == 'procoderji-com/procoderji' && (github.ref == 'refs/heads/dev' || github.ref == 'refs/heads/main')
    runs-on: ubuntu-24.04
    timeout-minutes: 20
    environment:
      name: ${{ github.ref_name == 'main' && 'production' || 'staging' }}
      url: ${{ vars.PUBLIC_ORIGIN }}
    concurrency:
      group: deploy-${{ github.ref_name }}
      cancel-in-progress: false
    steps:
      - name: Check out checked commit
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          persist-credentials: false

      - name: Set up Node.js
        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7
        with:
          node-version: 24

      - name: Install deployment CLI
        run: npm install --global vercel@65.14.0

      - name: Deploy backend, verify storage, then deploy frontend
        env:
          VERCEL_ORG_ID: ${{ vars.VERCEL_ORG_ID }}
          VERCEL_FRONTEND_PROJECT_ID: ${{ vars.VERCEL_FRONTEND_PROJECT_ID }}
          VERCEL_BACKEND_PROJECT_ID: ${{ vars.VERCEL_BACKEND_PROJECT_ID }}
          PUBLIC_ORIGIN: ${{ vars.PUBLIC_ORIGIN }}
          BACKEND_ORIGIN: ${{ vars.BACKEND_ORIGIN }}
          VERCEL_FRONTEND_TOKEN: ${{ secrets.VERCEL_FRONTEND_TOKEN }}
          VERCEL_BACKEND_TOKEN: ${{ secrets.VERCEL_BACKEND_TOKEN }}
        run: node scripts/deploy-vercel.mjs