# SPDX-FileCopyrightText: 2026 Progmasoft <support@progmasoft.com>
# SPDX-License-Identifier: AGPL-3.0-or-later WITH AdditionRef-Progmasoft-Patent-Grant-1.1

name: CI

on:
  push:
    branches: [main]
  pull_request:

permissions:
  contents: read

concurrency:
  group: website-${{ github.ref }}
  cancel-in-progress: true

jobs:
  frontend:
    runs-on: windows-latest
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: 24
          cache: npm
          cache-dependency-path: frontend/package-lock.json
      - run: npm ci
        working-directory: frontend
      - run: npm audit --audit-level=moderate
        working-directory: frontend
      - run: npm run check
        working-directory: frontend
      - run: npm run test:coverage
        working-directory: frontend
      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: website-frontend-coverage
          path: frontend/coverage/lcov.info
          if-no-files-found: error
          retention-days: 1
      - run: npm run format:check
        working-directory: frontend
      - run: npm run build
        working-directory: frontend

  backend:
    runs-on: ubuntu-latest
    timeout-minutes: 25
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5
        with:
          dotnet-version: 10.0.x
          cache: true
          cache-dependency-path: "**/packages.lock.json"
      # The build is the documentation gate: GenerateDocumentationFile with
      # warnings as errors fails on a public declaration without its comment.
      - run: dotnet restore Progmasoft.Tala.Website.slnx --locked-mode
      - run: dotnet build Progmasoft.Tala.Website.slnx --configuration Release --no-restore
      - run: dotnet test --project backend/Progmasoft.Tala.Website.Api.Tests/Progmasoft.Tala.Website.Api.Tests.csproj --configuration Release --no-build --coverlet --coverlet-output-format cobertura --results-directory TestResults
      - run: dotnet publish backend/Progmasoft.Tala.Website.Api/Progmasoft.Tala.Website.Api.csproj --configuration Release --no-restore --output publish
      # Documentation gate. DocFX builds the API reference with every warning
      # as an error; the coverage check then fails when a namespace, type or
      # member of the reference has no description.
      - run: dotnet tool restore
      - run: dotnet docfx Documents/api/docfx.json --warningsAsErrors
      - run: dotnet run Documents/api/CheckDocumentation.cs -- Documents/api
      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: website-backend-coverage
          path: TestResults/coverage.cobertura.xml
          if-no-files-found: error
          retention-days: 1

  frontend-coverage:
    # Fork PRs cannot receive the OIDC token required for Codecov uploads.
    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
    needs: frontend
    runs-on: ubuntu-latest
    timeout-minutes: 10
    permissions:
      contents: read
      id-token: write
    steps:
      # Keep OIDC-capable jobs isolated from package install/build scripts.
      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: website-frontend-coverage
          path: coverage/frontend
      - uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
        with:
          use_oidc: true
          files: coverage/frontend/lcov.info
          flags: website-frontend
          fail_ci_if_error: true

  backend-coverage:
    # Fork PRs cannot receive the OIDC token required for Codecov uploads.
    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
    needs: backend
    runs-on: ubuntu-latest
    timeout-minutes: 10
    permissions:
      contents: read
      id-token: write
    steps:
      # Keep OIDC-capable jobs isolated from the backend build.
      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: website-backend-coverage
          path: coverage/backend
      - uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
        with:
          use_oidc: true
          files: coverage/backend/coverage.cobertura.xml
          flags: website-backend
          fail_ci_if_error: true

  dependency-review:
    if: github.event_name == 'pull_request'
    runs-on: windows-latest
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - uses: actions/dependency-review-action@2031cfc080254a8a887f58cffee85186f0e49e48 # v4.9.0