ci.yml

name: CI

on:
  push:
    branches: ["main", "master"]
  pull_request:

permissions:
  contents: read

jobs:
  backend-quality:
    name: Backend Quality
    runs-on: ubuntu-latest

    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Set up Python
        uses: actions/setup-python@v6
        with:
          python-version: "3.12"

      - name: Install backend dependencies
        working-directory: backend
        run: |
          python -m pip install --upgrade pip
          pip install -r requirements-dev.txt

      - name: Validate Python importability
        working-directory: backend
        run: |
          python -m compileall app main.py

      - name: Run infra-free unit tests
        working-directory: backend
        run: |
          # Fast gate: tests that need no external services.
          pytest -q tests/test_acl_unit.py tests/test_production_security.py

      - name: Type check (mypy, non-blocking baseline)
        working-directory: backend
        continue-on-error: true
        run: |
          mypy app main.py --ignore-missing-imports --no-error-summary || true

  backend-integration:
    name: Backend Integration (security gate)
    runs-on: ubuntu-latest

    # Pin the connection config to the docker-compose defaults so the job does
    # not depend on a backend/.env (absent in CI) or any ambient runner env.
    env:
      ENVIRONMENT: development
      DB_HOST: localhost
      DB_PORT: "5432"
      DB_NAME: ragdb
      DB_USER: raguser
      DB_PASSWORD: ragpass
      MILVUS_HOST: localhost
      MILVUS_PORT: "19530"
      MINIO_ENDPOINT: localhost:9000
      MINIO_ACCESS_KEY: minioadmin
      MINIO_SECRET_KEY: minioadmin
      REDIS_URL: redis://localhost:6379/0
      REDIS_BACKEND: redis://localhost:6379/1

    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Set up Python
        uses: actions/setup-python@v6
        with:
          python-version: "3.12"

      - name: Start infrastructure (Postgres, Milvus, MinIO, Redis)
        run: |
          docker compose up -d
          echo "Waiting for containers to become healthy..."
          for i in $(seq 1 40); do
            healthy=$(docker compose ps --format '{{.Name}} {{.Status}}' | grep -c 'healthy' || true)
            echo "t=$((i*5))s healthy=$healthy/6"
            if [ "$healthy" -ge 6 ]; then echo "all healthy"; break; fi
            sleep 5
          done
          docker compose ps

      - name: Install backend dependencies
        working-directory: backend
        run: |
          python -m pip install --upgrade pip
          pip install -r requirements-dev.txt

      - name: Initialize databases and storage
        working-directory: backend
        run: |
          export PATH="$(python -c 'import sys,os;print(os.path.dirname(sys.executable))'):$PATH"
          python -m scripts.setup.setup_postgres
          python -m scripts.setup.setup_minio
          python -m scripts.setup.setup_milvus

      - name: Run full default unit suite (with infra available)
        working-directory: backend
        run: |
          pytest -q

      - name: Run security-critical integration suites (no external API needed)
        working-directory: backend
        env:
          RUN_INTEGRATION_TESTS: "1"
        run: |
          # ACL canary (leak prevention) + data-service connectivity.
          # These require live infra but no OpenAI key.
          pytest -q \
            tests/test_acl_canary.py \
            tests/test_postgres_connection.py \
            tests/test_minio_connection.py

      - name: Show infra logs on failure
        if: failure()
        run: docker compose logs --tail=80

  frontend-quality:
    name: Frontend Quality
    runs-on: ubuntu-latest

    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Set up Node
        uses: actions/setup-node@v6
        with:
          node-version: "20"
          cache: npm
          cache-dependency-path: frontend/package-lock.json

      - name: Install frontend dependencies
        working-directory: frontend
        run: npm ci

      - name: Type check
        working-directory: frontend
        run: npx tsc --noEmit

      - name: Lint
        working-directory: frontend
        run: npm run lint

      - name: Unit tests
        working-directory: frontend
        run: npm run test

      - name: Build
        working-directory: frontend
        run: npm run build

  dependency-audit:
    name: Dependency Audit (non-blocking)
    runs-on: ubuntu-latest
    continue-on-error: true

    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Set up Python
        uses: actions/setup-python@v6
        with:
          python-version: "3.12"

      - name: pip-audit (backend)
        continue-on-error: true
        run: |
          python -m pip install --upgrade pip pip-audit
          pip-audit -r backend/requirements.txt || true

      - name: npm audit (frontend)
        continue-on-error: true
        working-directory: frontend
        run: npm audit --audit-level=high || true