ci.yml

name: CI

on:
  push:
    branches: [main]
  pull_request:
    # Run on PRs to any branch (not just main)

env:
  PYTHON_VERSION: "3.13"
  NODE_VERSION: "22"

jobs:
  # Detect which paths changed
  changes:
    name: Detect Changes
    runs-on: ubuntu-latest
    outputs:
      server: ${{ steps.filter.outputs.server }}
      web: ${{ steps.filter.outputs.web }}
    steps:
      - uses: actions/checkout@v6

      - uses: dorny/paths-filter@v3
        id: filter
        with:
          filters: |
            server:
              - 'server/**'
            web:
              - 'web/**'

  # Server (Python backend) checks
  server-lint:
    name: Server - Lint & Format
    needs: changes
    if: needs.changes.outputs.server == 'true' || github.event_name == 'push'
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: server
    steps:
      - uses: actions/checkout@v6

      - name: Install uv
        uses: astral-sh/setup-uv@v4
        with:
          enable-cache: true

      - name: Set up Python
        run: uv python install ${{ env.PYTHON_VERSION }}

      - name: Install dependencies
        run: uv sync --frozen --extra k8s

      - name: Check formatting
        run: uv run ruff format --check .

      - name: Check linting
        run: uv run ruff check .

  server-typecheck:
    name: Server - Type Check
    needs: changes
    if: needs.changes.outputs.server == 'true' || github.event_name == 'push'
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: server
    steps:
      - uses: actions/checkout@v6

      - name: Install uv
        uses: astral-sh/setup-uv@v4
        with:
          enable-cache: true

      - name: Set up Python
        run: uv python install ${{ env.PYTHON_VERSION }}

      - name: Install dependencies
        run: uv sync --frozen --extra k8s

      - name: Run type checker
        run: uv run ty check osa

  server-test:
    name: Server - Test
    needs: changes
    if: needs.changes.outputs.server == 'true' || github.event_name == 'push'
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: server
    permissions:
      contents: read
      pull-requests: write
    steps:
      - uses: actions/checkout@v6

      - name: Install uv
        uses: astral-sh/setup-uv@v4
        with:
          enable-cache: true

      - name: Set up Python
        run: uv python install ${{ env.PYTHON_VERSION }}

      - name: Install dependencies
        run: uv sync --frozen --extra k8s

      - name: Run unit tests with coverage
        run: uv run pytest tests/unit -v --tb=short --cov=osa --cov-report=xml --cov-report=term-missing
        env:
          TEST: "1"

      - name: Code Coverage Summary
        uses: irongut/CodeCoverageSummary@v1.3.0
        with:
          filename: server/coverage.xml
          badge: true
          format: markdown
          output: both

      - name: Add coverage PR comment
        uses: marocchino/sticky-pull-request-comment@v2
        if: github.event_name == 'pull_request'
        with:
          path: code-coverage-results.md

  server-contract:
    name: Server - Contract Tests
    needs: changes
    if: needs.changes.outputs.server == 'true' || github.event_name == 'push'
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: server
    steps:
      - uses: actions/checkout@v6

      - name: Install uv
        uses: astral-sh/setup-uv@v4
        with:
          enable-cache: true

      - name: Set up Python
        run: uv python install ${{ env.PYTHON_VERSION }}

      - name: Install dependencies
        run: uv sync --frozen --extra k8s

      - name: Run contract tests
        run: uv run pytest tests/contract -v --tb=short

  server-integration:
    name: Server - Integration Tests
    needs: changes
    if: needs.changes.outputs.server == 'true' || github.event_name == 'push'
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: server
    services:
      postgres:
        image: postgres:16
        env:
          POSTGRES_USER: postgres
          POSTGRES_PASSWORD: osa
          POSTGRES_DB: osa_test
        ports:
          - 5432:5432
        options: >-
          --health-cmd pg_isready
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5
    steps:
      - uses: actions/checkout@v6

      - name: Install uv
        uses: astral-sh/setup-uv@v4
        with:
          enable-cache: true

      - name: Set up Python
        run: uv python install ${{ env.PYTHON_VERSION }}

      - name: Install dependencies
        run: uv sync --frozen --extra k8s

      - name: Run migrations
        run: uv run alembic upgrade head
        env:
          OSA_DATABASE__URL: postgresql+asyncpg://postgres:osa@localhost:5432/osa_test
          OSA_AUTH__JWT__SECRET: test-secret-for-integration-tests-minimum-32-chars
          TEST: "1"

      - name: Run integration tests
        run: uv run pytest tests/integration -v --tb=short -x
        env:
          OSA_DATABASE__URL: postgresql+asyncpg://postgres:osa@localhost:5432/osa_test
          OSA_AUTH__JWT__SECRET: test-secret-for-integration-tests-minimum-32-chars
          TEST: "1"

  # Build & push Docker image (main + PRs onto main, gated on all server checks)
  image:
    name: Server - Image
    needs: [changes, server-lint, server-typecheck, server-test, server-contract, server-integration]
    if: >-
      needs.changes.outputs.server == 'true' && (
        github.ref == 'refs/heads/main' ||
        (github.event_name == 'pull_request' && github.base_ref == 'main')
      )
    uses: ./.github/workflows/image.yml
    permissions:
      contents: read
      packages: write

  # Web (Next.js frontend) checks
  web-lint:
    name: Web - Lint
    needs: changes
    if: needs.changes.outputs.web == 'true' || github.event_name == 'push'
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: web
    steps:
      - uses: actions/checkout@v6

      - name: Setup pnpm
        uses: pnpm/action-setup@v4
        with:
          version: latest

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: 'pnpm'
          cache-dependency-path: web/pnpm-lock.yaml

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Run linter
        run: pnpm lint

  web-build:
    name: Web - Build
    needs: changes
    if: needs.changes.outputs.web == 'true' || github.event_name == 'push'
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: web
    steps:
      - uses: actions/checkout@v6

      - name: Setup pnpm
        uses: pnpm/action-setup@v4
        with:
          version: latest

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: 'pnpm'
          cache-dependency-path: web/pnpm-lock.yaml

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Build
        run: pnpm build