ci.yml

name: CI

on:
  pull_request:
    branches: [main]
  push:
    branches: [main]

jobs:
  lint-and-typecheck:
    name: Lint & Typecheck
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: 22
          cache: npm
      - id: cache-node-modules
        uses: actions/cache@v4
        with:
          path: node_modules
          key: ${{ runner.os }}-node_modules-${{ hashFiles('package-lock.json') }}
      - if: steps.cache-node-modules.outputs.cache-hit != 'true'
        run: npm ci
      - run: npm run lint
      - run: npm run typecheck

  security:
    name: Security Scan
    runs-on: ubuntu-latest
    permissions:
      actions: read
      contents: read
      security-events: write
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: 22
          cache: npm
      - id: cache-node-modules
        uses: actions/cache@v4
        with:
          path: node_modules
          key: ${{ runner.os }}-node_modules-${{ hashFiles('package-lock.json') }}
      - if: steps.cache-node-modules.outputs.cache-hit != 'true'
        run: npm ci
      - name: Run npm audit
        # Report-only: surfaces high/critical advisories without failing CI on
        # pre-existing transitive vulnerabilities that have no available fix.
        run: npm audit --audit-level=high
        continue-on-error: true
      - name: Initialize CodeQL
        uses: github/codeql-action/init@v3
        with:
          languages: javascript-typescript
      - name: Run CodeQL analysis
        uses: github/codeql-action/analyze@v3

  test:
    name: Test
    runs-on: ubuntu-latest
    services:
      postgres:
        image: postgres:16
        env:
          POSTGRES_USER: chainlearn_test
          POSTGRES_PASSWORD: test_password
          POSTGRES_DB: chainlearn_test
        ports: ["5432:5432"]
        options: >-
          --health-cmd pg_isready
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5
      redis:
        image: redis:7
        ports:
          - 6379:6379
        options: >-
          --health-cmd "redis-cli ping"
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5
    env:
      NODE_ENV: test
      DATABASE_URL: postgresql://chainlearn_test:test_password@localhost:5432/chainlearn_test
      REDIS_URL: redis://localhost:6379
      JWT_SECRET: test-secret-key-that-is-at-least-64-characters-long-for-testing-purposes-only
      STELLAR_NETWORK: testnet
      STELLAR_HORIZON_URL: https://horizon-testnet.stellar.org
      STELLAR_SOROBAN_RPC_URL: https://soroban-testnet.stellar.org
      STELLAR_PLATFORM_SECRET: SBZVMB74Z76QZ3ZQY6ADDING6S5AIJWXE3MVRULCNPG7ZBJRYUX3CBNN
      STELLAR_QUIZ_CONTRACT_ID: CB6Q2YKQQHH7GV7CU5RZDYM5S5OE2GABYLG5IY6YO5XLBAALBQKXYB53
      STELLAR_REWARD_CONTRACT_ID: CBAKHFY4SIBRIVYH2Y2QDUIUZPGYGS4B26YBHC6RLV5QZ7OHH5FOF55T
      STELLAR_CREDENTIAL_CONTRACT_ID: CD4ZJWLPGYLCYR7G5DZQ4EJWVMMF5VXU5Z2ECRSKGWV6GBV5S3F52K7
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: 22
          cache: npm
      - id: cache-node-modules
        uses: actions/cache@v4
        with:
          path: node_modules
          key: ${{ runner.os }}-node_modules-${{ hashFiles('package-lock.json') }}
      - if: steps.cache-node-modules.outputs.cache-hit != 'true'
        run: npm ci
      - run: npm run db:generate
      - run: npm run db:migrate
      # Coverage thresholds live in vitest.config.ts — vitest exits non-zero
      # when any of them regress, so this step is the quality gate.
      - name: Run tests with coverage
        run: npm test -- --coverage
      - name: Upload coverage report
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: coverage
          path: coverage/
          retention-days: 14
          if-no-files-found: error

  docker-build:
    name: Docker Build
    runs-on: ubuntu-latest
    needs: lint-and-typecheck
    steps:
      - uses: actions/checkout@v4
      - uses: docker/setup-buildx-action@v3
      - uses: docker/build-push-action@v6
        with:
          context: .
          push: false
          tags: chainlearn-api:ci
          cache-from: type=gha
          cache-to: type=gha,mode=max