name: CI

on:
  pull_request:
  push:
    branches: [main]

jobs:
  quality:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: 22
      - uses: pnpm/action-setup@v4
        with:
          version: 9
      - uses: actions/setup-python@v5
        with:
          python-version: "3.12"
      - name: Install frontend deps
        run: pnpm install --frozen-lockfile=false
      - name: Install backend deps
        run: |
          sudo apt-get update
          sudo apt-get install -y --no-install-recommends fonts-dejavu-core
          pip install -r apps/api/requirements-dev.txt
      - name: Sync WESP UI parity
        run: bash scripts/materialize-wesp-static.sh
      - name: Lint
        run: pnpm lint
      - name: Types
        run: pnpm typecheck
      - name: Mypy
        working-directory: apps/api
        run: python -m mypy app
      - name: Frontend tests with coverage
        run: pnpm --filter web test:ci
      - name: Backend tests with coverage
        working-directory: apps/api
        run: python -m pytest --cov=app --cov-fail-under=90
      - name: Security scan (python deps)
        run: pip-audit
      - name: Bandit scan
        run: bandit -q -r apps/api/app
      - name: Security scan (node deps)
        run: pnpm audit --audit-level high
      - name: Gitleaks scan
        run: docker run --rm -v "$PWD:/repo" zricethezav/gitleaks:latest detect --source=/repo --no-git -v
      - name: Install Playwright browsers
        run: pnpm --filter web exec playwright install chromium
      - name: E2E smoke
        run: pnpm --filter web e2e