ci.yml

name: CI

on:
  pull_request:
    branches: [main]
  push:
    branches: [main]

jobs:
  lint-and-typecheck:
    name: Lint & Typecheck
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: 22
          cache: npm
      - id: cache-node-modules
        uses: actions/cache@v4
        with:
          path: node_modules
          key: ${{ runner.os }}-node_modules-${{ hashFiles('package-lock.json') }}
      - if: steps.cache-node-modules.outputs.cache-hit != 'true'
        run: npm ci
      - run: npm run lint
      - run: npm run typecheck

  test:
    name: Test
    runs-on: ubuntu-latest
    services:
      postgres:
        image: postgres:16
        env:
          POSTGRES_USER: chainlearn_test
          POSTGRES_PASSWORD: test_password
          POSTGRES_DB: chainlearn_test
        ports: ["5432:5432"]
        options: >-
          --health-cmd pg_isready
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5
      redis:
        image: redis:7-alpine
        ports: ["6379:6379"]
    env:
      DATABASE_URL: postgresql://chainlearn_test:test_password@localhost:5432/chainlearn_test
      REDIS_URL: redis://localhost:6379
      JWT_SECRET: test-secret-key-that-is-at-least-64-characters-long-for-testing-purposes-only
      STELLAR_NETWORK: testnet
      STELLAR_HORIZON_URL: https://horizon-testnet.stellar.org
      STELLAR_SOROBAN_RPC_URL: https://soroban-testnet.stellar.org
      STELLAR_PLATFORM_SECRET: ${{ (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) && secrets.STELLAR_PLATFORM_SECRET || '' }}
      STELLAR_QUIZ_CONTRACT_ID: CB6Q2YKQQHH7GV7CU5RZDYM5S5OE2GABYLG5IY6YO5XLBAALBQKXYB53
      STELLAR_REWARD_CONTRACT_ID: CBAKHFY4SIBRIVYH2Y2QDUIUZPGYGS4B26YBHC6RLV5QZ7OHH5FOF55T
      STELLAR_CREDENTIAL_CONTRACT_ID: CD4ZJWLPGYLCYR7G5DZQ4EJWVMMF5VXU5Z2ECRSKGWV6GBV5S3F52K7
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: 22
          cache: npm
      - id: cache-node-modules
        uses: actions/cache@v4
        with:
          path: node_modules
          key: ${{ runner.os }}-node_modules-${{ hashFiles('package-lock.json') }}
      - if: steps.cache-node-modules.outputs.cache-hit != 'true'
        run: npm ci
      - run: npm run db:generate
      - run: npm run db:migrate
      # Coverage thresholds live in vitest.config.ts — vitest exits non-zero
      # when any of them regress, so this step is the quality gate.
      - name: Run tests with coverage
        run: npm test -- --coverage
      - name: Upload coverage report
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: coverage
          path: coverage/
          retention-days: 14
          if-no-files-found: error

  docker-build:
    name: Docker Build
    runs-on: ubuntu-latest
    needs: lint-and-typecheck
    steps:
      - uses: actions/checkout@v4
      - uses: docker/setup-buildx-action@v3
      - uses: docker/build-push-action@v6
        with:
          context: .
          push: false
          tags: chainlearn-api:ci