name: CI

permissions:
  contents: read

concurrency:
  group: website-starter-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

on:
  push:
    branches-ignore:
      - dev
      - master
  pull_request:
    branches:
      - dev
      - master
    types:
      - opened
      - synchronize
      - reopened
      - ready_for_review

env:
  NODE_VERSION_FILE: .node-version
  TRIVY_IMAGE: aquasec/trivy:0.74.0@sha256:62b1e65e8869bc4b4c6aa4fa2b21595256c7c2f6018a9d9ad61caf87187c1969

jobs:
  changes:
    runs-on: ${{ vars.CI_RUNNER || 'ubuntu-latest' }}
    timeout-minutes: 5
    outputs:
      app: ${{ steps.detect.outputs.app }}
      security_deps: ${{ steps.detect.outputs.security_deps }}
    steps:
      - name: Checkout repository
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
        with:
          lfs: true
          fetch-depth: 0

      - name: Detect changed areas
        id: detect
        env:
          CHANGESET_BEFORE: ${{ github.event.before }}
          CHANGESET_PR_BASE_SHA: ${{ github.event.pull_request.base.sha }}
        run: sh scripts/detect-ci-changes.sh

  app:
    needs: [changes]
    if: needs.changes.outputs.app == 'true'
    runs-on: ${{ vars.CI_RUNNER || 'ubuntu-latest' }}
    timeout-minutes: 30
    env:
      APP_URL: https://example.com
    steps:
      - name: Checkout repository
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
        with:
          lfs: true

      - name: Setup Node.js
        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020
        with:
          node-version-file: ${{ env.NODE_VERSION_FILE }}

      - name: Install dependencies
        run: npm ci

      - name: Restore and update image cache
        env:
          IMAGE_CACHE_NAMESPACE: ${{ github.head_ref || github.ref_name }}
        run: sh scripts/prepare-image-cache.sh

      - name: Lint
        run: npm run lint

      - name: Test
        run: npm run test

      - name: Type check
        run: npm run typecheck

      - name: Build
        env:
          SKIP_IMAGE_OPTIMIZATION: true
        run: npm run build

      - name: E2E smoke test
        env:
          SKIP_IMAGE_OPTIMIZATION: true
        run: npm run test:e2e

  secret-scan:
    runs-on: ${{ vars.CI_RUNNER || 'ubuntu-latest' }}
    timeout-minutes: 15
    steps:
      - name: Checkout repository
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
        with:
          lfs: true

      - name: Scan repository for committed secrets
        run: sh scripts/trivy-scan.sh secret-fs .

  security-deps:
    needs: [changes]
    if: needs.changes.outputs.security_deps == 'true'
    runs-on: ${{ vars.CI_RUNNER || 'ubuntu-latest' }}
    timeout-minutes: 30
    steps:
      - name: Checkout repository
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
        with:
          lfs: true

      - name: Report app dependency vulnerabilities
        run: sh scripts/trivy-scan.sh vuln-fs .

      - name: Block high and critical app dependency vulnerabilities
        env:
          TRIVY_SEVERITY: HIGH,CRITICAL
          TRIVY_EXIT_CODE: 1
        run: sh scripts/trivy-scan.sh vuln-fs .