ci.yml

name: CI Pipeline

on:
  pull_request:
    branches:
      - main
      - develop
  push:
    branches:
      - main
      - develop

jobs:
  build:
    name: Build and Prepare Environment
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@v6
        with:
          fetch-depth: 0

      - name: Use Node.js
        uses: actions/setup-node@v6
        with:
          node-version: 24
          cache: "npm"

      - name: Cache node_modules
        id: cache
        uses: actions/cache@v4
        with:
          path: node_modules/
          key: node-modules-${{ hashFiles('package-lock.json') }}

      - name: Install dependencies
        if: steps.cache.outputs.cache-hit != 'true'
        run: npm ci

      - name: Create .env
        run: |
          printf "JWT_SECRET=${{ secrets.JWT_SECRET }}\n\
              NEXTAUTH_SECRET=${{ secrets.NEXTAUTH_SECRET }}\n\
              CLOUDINARY_CLOUD_NAME=${{ secrets.CLOUDINARY_CLOUD_NAME }}\n\
              CLOUDINARY_API_KEY=${{ secrets.CLOUDINARY_API_KEY }}\n\
              CLOUDINARY_API_SECRET=${{ secrets.CLOUDINARY_API_SECRET }}\n\
              RESEND_API_KEY=${{ secrets.RESEND_API_KEY }}\n\
              INVITE_REQUEST_SENDER_EMAIL=${{ secrets.INVITE_REQUEST_SENDER_EMAIL }}\n\
              RESET_PASSWORD_EMAIL=${{ secrets.RESET_PASSWORD_EMAIL }}\n\
              CONTACT_SENDER_EMAIL=${{ secrets.CONTACT_SENDER_EMAIL }}\n\
              INVITE_REQUEST_RECEIVER_EMAIL=${{ secrets.INVITE_REQUEST_RECEIVER_EMAIL }}\n" > .env

      - name: Build project
        run: npm run build

      - name: Upload node_modules
        uses: actions/upload-artifact@v7
        with:
          name: node-modules
          path: node_modules/
          retention-days: 1

  lint:
    name: Lint Codebase
    runs-on: ubuntu-latest
    needs: build
    steps:
      - name: Checkout repository
        uses: actions/checkout@v6
        with:
          fetch-depth: 0

      - name: Use Node.js
        uses: actions/setup-node@v6
        with:
          node-version: 24

      - name: Restore node_modules
        id: cache
        uses: actions/cache@v4
        with:
          path: node_modules/
          key: node-modules-${{ hashFiles('package-lock.json') }}

      - name: Install dependencies
        if: steps.cache.outputs.cache-hit != 'true'
        run: npm ci

      - name: Run Lint
        run: npm run lint

  test:
    name: Run Tests (Jest)
    runs-on: ubuntu-latest
    needs: build
    steps:
      - name: Checkout repository
        uses: actions/checkout@v6
        with:
          fetch-depth: 0

      - name: Use Node.js
        uses: actions/setup-node@v6
        with:
          node-version: 24

      - name: Restore node_modules
        id: cache
        uses: actions/cache@v4
        with:
          path: node_modules/
          key: node-modules-${{ hashFiles('package-lock.json') }}

      - name: Install dependencies
        if: steps.cache.outputs.cache-hit != 'true'
        run: npm ci

      - name: Run Tests
        run: npm run test

  coverage:
    name: Run Tests with Coverage
    runs-on: ubuntu-latest
    needs: test
    steps:
      - name: Checkout repository
        uses: actions/checkout@v6
        with:
          fetch-depth: 0

      - name: Use Node.js
        uses: actions/setup-node@v6
        with:
          node-version: 24

      - name: Restore node_modules
        id: cache
        uses: actions/cache@v4
        with:
          path: node_modules/
          key: node-modules-${{ hashFiles('package-lock.json') }}

      - name: Install dependencies
        if: steps.cache.outputs.cache-hit != 'true'
        run: npm ci

      - name: Run Tests with Coverage
        run: |
          npx jest --coverage \
          --coverageThreshold='{"global":{"branches":60,"functions":60,"lines":60,"statements":60}}'

      - name: Upload coverage report
        uses: actions/upload-artifact@v7
        with:
          name: coverage-report
          path: coverage/

      # SonarCloud runs in a separate "SonarCloud" workflow (workflow_run) so it
      # has access to SONAR_TOKEN even for pull requests from forks. Persist the
      # PR context here so that workflow can decorate the correct pull request.
      - name: Save PR metadata
        if: ${{ github.event_name == 'pull_request' }}
        run: |
          mkdir -p pr-meta
          echo "${{ github.event.pull_request.number }}" > pr-meta/number
          echo "${{ github.event.pull_request.head.ref }}" > pr-meta/head_ref
          echo "${{ github.event.pull_request.base.ref }}" > pr-meta/base_ref

      - name: Upload PR metadata
        if: ${{ github.event_name == 'pull_request' }}
        uses: actions/upload-artifact@v7
        with:
          name: pr-metadata
          path: pr-meta/

  audit:
    name: Audit Dependencies
    runs-on: ubuntu-latest
    needs: build
    steps:
      - name: Checkout repository
        uses: actions/checkout@v6
        with:
          fetch-depth: 0

      - name: Use Node.js
        uses: actions/setup-node@v6
        with:
          node-version: 24

      - name: Restore node_modules
        id: cache
        uses: actions/cache@v4
        with:
          path: node_modules/
          key: node-modules-${{ hashFiles('package-lock.json') }}

      - name: Install dependencies
        if: steps.cache.outputs.cache-hit != 'true'
        run: npm ci

      - name: Audit dependencies
        run: npm audit --audit-level=high