ci.yml

name: CI

on:
  push:
    branches: [main, develop]
  pull_request:
    branches: [main, develop]

jobs:
  php-tests:
    name: PHP ${{ matrix.php }} Tests
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        php: ['8.1', '8.2', '8.3', '8.4', '8.5']

    steps:
      - name: Checkout code
        uses: actions/checkout@v7

      - name: Setup PHP
        uses: shivammathur/setup-php@v2
        with:
          php-version: ${{ matrix.php }}
          extensions: mbstring, xml, curl, json
          coverage: pcov
          tools: composer:v2

      - name: Get Composer cache directory
        id: composer-cache
        run: echo "dir=$(composer config cache-files-dir)" >> $GITHUB_OUTPUT

      - name: Cache Composer dependencies
        uses: actions/cache@v6
        with:
          path: ${{ steps.composer-cache.outputs.dir }}
          key: ${{ runner.os }}-composer-${{ hashFiles('**/composer.lock') }}
          restore-keys: |
            ${{ runner.os }}-composer-

      - name: Validate composer files
        run: composer validate --no-check-all

      - name: Install dependencies
        run: composer install --prefer-dist --no-progress

      - name: Run PHP Syntax Check
        run: |
          find . \
            -path ./vendor -prune -o \
            -path ./admin/node_modules -prune -o \
            -path ./admin/dist -prune -o \
            -path ./release -prune -o \
            -name "*.php" -print0 | xargs -0 -n1 php -l

      - name: Security audit
        # Audit production + dev dependencies. Dev deps run in CI and locally,
        # so they're still attack surface — and CVE-2026-24765 (cleared in v4.3.1)
        # lived in phpunit (a dev dep), which `--no-dev` would have hidden.
        # Composer respects `config.platform.php` (8.1.0) when evaluating advisories.
        run: composer audit

      - name: Install PHPCS and WordPress Standards
        if: matrix.php == '8.4'
        continue-on-error: true
        run: |
          composer config allow-plugins.dealerdirect/phpcodesniffer-composer-installer true
          composer require --dev wp-coding-standards/wpcs dealerdirect/phpcodesniffer-composer-installer --no-interaction

      - name: Run PHPCS
        if: matrix.php == '8.4'
        continue-on-error: true
        run: vendor/bin/phpcs --standard=phpcs.xml.dist --report=summary

      - name: Run PHPUnit
        run: vendor/bin/phpunit --testdox

      - name: Create coverage directory
        if: matrix.php == '8.4'
        run: mkdir -p coverage

      - name: Run PHPUnit with Coverage
        if: matrix.php == '8.4'
        run: vendor/bin/phpunit --coverage-clover coverage/clover.xml --coverage-text

      - name: Upload coverage to Codecov
        if: matrix.php == '8.4'
        uses: codecov/codecov-action@v7
        with:
          files: ./coverage/clover.xml
          fail_ci_if_error: false
        env:
          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}

  gutenberg-smoke:
    name: Python tests + Gutenberg e2e smoke
    runs-on: ubuntu-latest

    steps:
      - name: Checkout code
        uses: actions/checkout@v7

      - name: Setup PHP 8.1
        uses: shivammathur/setup-php@v2
        with:
          php-version: '8.1'
          extensions: mbstring, xml, curl, json
          tools: composer:v2

      - name: Get Composer cache directory
        id: composer-cache
        run: echo "dir=$(composer config cache-files-dir)" >> $GITHUB_OUTPUT

      - name: Cache Composer dependencies
        uses: actions/cache@v6
        with:
          path: ${{ steps.composer-cache.outputs.dir }}
          key: ${{ runner.os }}-composer-${{ hashFiles('**/composer.lock') }}
          restore-keys: |
            ${{ runner.os }}-composer-

      - name: Install Composer dependencies
        # Smoke harness shells out to PHP to exercise the v3 Gutenberg converter
        # against the same fixture the Python engine processes.
        run: composer install --prefer-dist --no-progress

      - name: Setup Python 3.11
        uses: actions/setup-python@v6
        with:
          python-version: '3.11'
          cache: 'pip'

      - name: Install Python package + dev extras
        run: |
          python -m pip install --upgrade pip
          pip install -e ".[dev]"

      - name: Run Python test suite
        run: pytest tests/python

      - name: Run Gutenberg e2e smoke (kitchen-sink fixture, both engines)
        # Exercises every Elementor widget category the parser produces, end-to-end
        # through Python v4 AND PHP v3. Catches fidelity gaps that targeted unit
        # tests don't reach (see PR #11 for two such bugs caught after 4.3.4 merged).
        run: python tests/smoke_gutenberg_e2e.py

      - name: Run Elementor → Bricks e2e smoke (flat format + content survival)
        run: python tests/smoke_bricks_e2e.py

      - name: Run DIVI → Gutenberg e2e smoke (content survival + block integrity)
        run: python tests/smoke_divi_e2e.py

  admin-build:
    name: Admin Build (Node ${{ matrix.node }})
    runs-on: ubuntu-latest
    strategy:
      matrix:
        node: ['20.19.0', '22.13.0', '24']

    defaults:
      run:
        working-directory: admin

    steps:
      - name: Checkout code
        uses: actions/checkout@v7

      - name: Setup Node.js
        uses: actions/setup-node@v6
        with:
          node-version: ${{ matrix.node }}
          cache: 'npm'
          cache-dependency-path: admin/package-lock.json

      - name: Install dependencies
        run: npm ci

      - name: Run ESLint
        run: npm run lint

      - name: TypeScript type check
        run: npx tsc --noEmit

      - name: Build for production
        run: npm run build

      - name: Verify build artifacts
        run: |
          test -f dist/.vite/manifest.json && echo "Manifest exists"
          test -f dist/index.html && echo "Index exists"
          ls -la dist/assets/ | head -10

      - name: Upload build artifacts
        if: matrix.node == '20.19.0'
        uses: actions/upload-artifact@v7
        with:
          name: admin-dist
          path: admin/dist/
          retention-days: 7

  release-package-smoke:
    name: Release package smoke
    runs-on: ubuntu-latest

    steps:
      - name: Checkout code
        uses: actions/checkout@v7

      - name: Setup Node.js
        uses: actions/setup-node@v6
        with:
          node-version: '20.19.0'
          cache: 'npm'
          cache-dependency-path: admin/package-lock.json

      - name: Install admin dependencies
        working-directory: admin
        run: npm ci

      - name: Build admin for production
        working-directory: admin
        run: npm run build

      - name: Build and inspect release zip
        run: ./scripts/build-release-package.sh pr-smoke

      - name: Upload release smoke artifact
        uses: actions/upload-artifact@v7
        with:
          name: development-translation-bridge-pr-smoke
          path: development-translation-bridge-pr-smoke.zip
          retention-days: 7