ci.yml

name: CI

on:
  push:
    branches: [ 'main' ]
  pull_request:
    branches: [ '**' ]
  workflow_call:

jobs:
  # Quick validation jobs run in parallel
  validate-commits:
    name: Validate Commits & PR
    runs-on: ubuntu-latest
    if: github.event_name == 'pull_request'

    steps:
      - name: Checkout code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          ref: ${{ github.event.pull_request.head.sha }}
          fetch-depth: 0

      - name: Setup Node.js
        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
        with:
          node-version: '20'
          cache: 'npm'

      - name: Install dependencies
        run: npm ci

      - name: Validate commit messages
        run: |
          echo "📋 Validating commit messages..."
          echo ""
          if ! npx commitlint --from ${{ github.event.pull_request.base.sha }} --to HEAD --verbose; then
            echo ""
            echo "❌ COMMIT MESSAGE VALIDATION FAILED"
            echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
            echo ""
            echo "Commit messages must follow Conventional Commits format:"
            echo ""
            echo "  <type>(<scope>): <description>"
            echo ""
            # Parse valid types and scopes from commitlint config (single node invocation)
            node -e "const c = require('./commitlint.config.cjs'); console.log('Valid types:', c.rules['type-enum'][2].join(', ')); console.log('Valid scopes (optional):', c.rules['scope-enum'][2].join(', '))"
            echo ""
            echo "Examples:"
            echo "  ✅ fix: resolve null pointer exception"
            echo "  ✅ feat(cli): add new doctor command"
            echo "  ✅ chore(deps): update dependencies"
            echo ""
            echo "See: https://www.conventionalcommits.org/"
            exit 1
          fi

      - name: Validate PR title
        env:
          PR_TITLE: ${{ github.event.pull_request.title }}
        run: |
          echo "📋 Validating PR title..."
          echo ""
          echo "PR Title: \"$PR_TITLE\""
          echo ""
          if ! echo "$PR_TITLE" | npx commitlint --verbose; then
            echo ""
            echo "❌ PR TITLE VALIDATION FAILED"
            echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
            echo ""
            echo "Your PR title: \"$PR_TITLE\""
            echo ""
            echo "PR titles must follow Conventional Commits format:"
            echo ""
            echo "  <type>(<scope>): <description>"
            echo ""
            # Parse valid types and scopes from commitlint config (single node invocation)
            node -e "const c = require('./commitlint.config.cjs'); console.log('Valid types:', c.rules['type-enum'][2].join(', ')); console.log('Valid scopes (optional):', c.rules['scope-enum'][2].join(', '))"
            echo ""
            echo "Examples based on your title:"
            echo "  ✅ fix: $PR_TITLE"
            echo "  ✅ fix(agents): $PR_TITLE"
            echo "  ✅ feat: $PR_TITLE"
            echo ""
            echo "To fix: Edit your PR title in GitHub to include the type prefix."
            echo "See: https://www.conventionalcommits.org/"
            exit 1
          fi
          echo "✅ PR title is valid!"

  secrets-detection:
    name: Secrets Detection
    runs-on: ubuntu-latest
    # Run in parallel with validate-commits (pull_request_target not supported by gitleaks-action)
    if: github.event_name == 'pull_request'

    steps:
      - name: Checkout code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          ref: ${{ github.event.pull_request.head.sha || github.sha }}
          fetch-depth: 0

      - name: Run Gitleaks
        uses: gitleaks/gitleaks-action@ff98106e4c7b2bc287b24eaf42907196329070c7 # v2.3.9
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          GITLEAKS_ENABLE_SUMMARY: true

  # Build once, share artifacts with test jobs
  build:
    name: Build
    runs-on: ubuntu-latest
    needs: [validate-commits, secrets-detection]
    if: |
      always() &&
      (needs.validate-commits.result == 'success' || needs.validate-commits.result == 'skipped') &&
      (needs.secrets-detection.result == 'success' || needs.secrets-detection.result == 'skipped')

    steps:
      - name: Checkout code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          ref: ${{ github.event.pull_request.head.sha || github.sha }}

      - name: Setup Node.js
        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
        with:
          node-version: '20'
          cache: 'npm'

      - name: Install dependencies
        run: npm ci

      - name: Check licenses
        run: npm run license-check

      - name: Lint code
        run: npm run lint

      - name: Build project
        run: npm run build

      # Upload build artifacts to share with test jobs
      - name: Upload build artifacts
        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
        with:
          name: dist
          path: dist/
          retention-days: 1

  # Test jobs run in parallel, reuse build artifacts
  test-ubuntu:
    name: Test (Ubuntu)
    runs-on: ubuntu-latest
    needs: [build]

    steps:
      - name: Checkout code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          ref: ${{ github.event.pull_request.head.sha || github.sha }}

      - name: Setup Node.js
        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
        with:
          node-version: '20'
          cache: 'npm'

      - name: Install dependencies
        run: npm ci

      # Download pre-built dist (skip build step, saves ~15-20s)
      - name: Download build artifacts
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: dist
          path: dist/

      - name: Run unit tests
        run: npm run test:unit

      - name: Run integration tests
        run: npm run test:integration

  test-windows:
    name: Test (Windows)
    runs-on: windows-latest
    needs: [build]

    steps:
      - name: Checkout code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          ref: ${{ github.event.pull_request.head.sha || github.sha }}

      - name: Setup Node.js
        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
        with:
          node-version: '20'
          cache: 'npm'

      - name: Install dependencies
        run: npm ci

      # Download pre-built dist (skip build step, saves ~25-30s on Windows)
      - name: Download build artifacts
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: dist
          path: dist/

      - name: Run unit tests
        run: npm run test:unit

      - name: Run integration tests
        run: npm run test:integration