ci.yml

name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

env:
  MIX_ENV: test
  ELIXIR_VERSION: "1.19.5"
  OTP_VERSION: "28.4.1"
  NODE_VERSION: "24"

jobs:
  test:
    name: Unit Tests
    runs-on: ubuntu-latest

    services:
      postgres:
        image: postgres:17
        env:
          POSTGRES_PASSWORD: postgres
          POSTGRES_DB: aludel_test
        options: >-
          --health-cmd pg_isready
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5
        ports:
          - 5432:5432

    steps:
      - name: Checkout code
        uses: actions/checkout@v7

      - name: Validate Docker Compose security defaults
        run: |
          cp .env.example .env
          if docker compose config --quiet 2>/dev/null; then
            echo "Docker Compose accepted a blank database password"
            exit 1
          fi
          POSTGRES_PASSWORD=ci-only-password docker compose config --quiet

      - name: Setup Elixir
        uses: ./.github/actions/setup-elixir
        with:
          elixir-version: ${{ env.ELIXIR_VERSION }}
          otp-version: ${{ env.OTP_VERSION }}

      - name: Setup Node.js
        uses: ./.github/actions/setup-node
        with:
          node-version: ${{ env.NODE_VERSION }}

      - name: Check formatting
        run: mix format --check-formatted

      - name: Compile (test)
        run: mix compile --warnings-as-errors

      - name: Build assets
        run: mix assets.build

      - name: Run frontend tests
        working-directory: assets
        run: npm test

      - name: Create and migrate database
        run: mix ecto.create && mix ecto.migrate

      - name: Run tests with coverage
        run: mix coveralls.json

      - name: Test standalone application
        working-directory: standalone
        run: mix deps.get && mix compile --warnings-as-errors && mix test --no-start

      # Only upload coverage when the PR can access repository secrets.
      # Dependabot and fork PRs should not fail CI on the upload step.
      - name: Upload coverage to Codecov
        if: github.event_name != 'pull_request' || (github.event.pull_request.head.repo.full_name == github.repository && github.actor != 'dependabot[bot]')
        uses: codecov/codecov-action@v7
        with:
          files: ./cover/excoveralls.json
          flags: elixir
          fail_ci_if_error: false
        env:
          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}

  credo:
    name: Code Quality (Credo)
    runs-on: ubuntu-latest

    steps:
      - name: Checkout code
        uses: actions/checkout@v7

      - name: Setup Elixir
        uses: ./.github/actions/setup-elixir
        with:
          elixir-version: ${{ env.ELIXIR_VERSION }}
          otp-version: ${{ env.OTP_VERSION }}

      - name: Compile (dev)
        run: MIX_ENV=dev mix compile

      - name: Run Credo
        run: mix credo --strict

  quality-gates:
    name: Package Quality Gates
    runs-on: ubuntu-latest

    steps:
      - name: Checkout code
        uses: actions/checkout@v7

      - name: Setup Elixir
        uses: ./.github/actions/setup-elixir
        with:
          elixir-version: ${{ env.ELIXIR_VERSION }}
          otp-version: ${{ env.OTP_VERSION }}

      - name: Check compile dependency cycles
        run: mix xref graph --format cycles --label compile-connected --fail-above 0

      - name: Check duplicate code budget
        run: mix quality.ex_dna

      - name: Check documentation coverage
        run: mix doctor --raise

      - name: Build documentation
        env:
          MIX_ENV: dev
        run: mix docs

  dialyzer:
    name: Static Analysis (Dialyzer)
    runs-on: ubuntu-latest

    steps:
      - name: Checkout code
        uses: actions/checkout@v7

      - name: Setup Elixir
        uses: ./.github/actions/setup-elixir
        with:
          elixir-version: ${{ env.ELIXIR_VERSION }}
          otp-version: ${{ env.OTP_VERSION }}

      - name: Restore PLT cache
        uses: actions/cache@v6
        with:
          path: priv/plts
          key: ${{ runner.os }}-dialyzer-v2-${{ env.OTP_VERSION }}-${{ env.ELIXIR_VERSION }}-${{ hashFiles('**/mix.lock') }}
          restore-keys: |
            ${{ runner.os }}-dialyzer-v2-${{ env.OTP_VERSION }}-${{ env.ELIXIR_VERSION }}-

      - name: Compile (dev)
        run: MIX_ENV=dev mix compile

      - name: Run Dialyzer
        run: mix dialyzer

  unused-deps:
    name: Check Unused Dependencies
    runs-on: ubuntu-latest

    steps:
      - name: Checkout code
        uses: actions/checkout@v7

      - name: Setup Elixir
        uses: ./.github/actions/setup-elixir
        with:
          elixir-version: ${{ env.ELIXIR_VERSION }}
          otp-version: ${{ env.OTP_VERSION }}

      - name: Check for unused dependencies
        run: mix deps.unlock --check-unused