quality.yml

name: Quality Checks

on:
  push:
    branches: ['feat/*', 'master']
  pull_request:
    branches: ['master']

jobs:
  quality:
    name: Lint, Format, Typecheck, Test
    runs-on: ubuntu-latest
    timeout-minutes: 20
    permissions:
      contents: read
      checks: write # required by mikepenz/action-junit-report to post check runs
      pull-requests: write # required to post PR annotations

    services:
      postgres:
        image: postgres:18
        env:
          POSTGRES_USER: sbf
          POSTGRES_PASSWORD: sbf
          POSTGRES_DB: sbf_test
        ports:
          - 5432:5432
        options: >-
          --health-cmd pg_isready
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5

      mailpit:
        image: axllent/mailpit
        ports:
          - 1025:1025
          - 8025:8025
        env:
          MP_SMTP_AUTH_ACCEPT_ANY: 1
          MP_SMTP_AUTH_ALLOW_INSECURE: 1
        options: >-
          --health-cmd "wget -qO- http://localhost:8025/api/v1/messages || exit 1"
          --health-interval 5s
          --health-timeout 3s
          --health-retries 10

    steps:
      - uses: actions/checkout@v4

      - name: Set up Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '22'
          cache: 'npm'
          cache-dependency-path: package-lock.json

      - name: Install dependencies
        run: npm ci

      - name: Lint
        run: npm run lint

      - name: Format check
        run: npx prettier --check .

      - name: TypeScript typecheck
        run: npm run typecheck

      # Catches frontend calls whose verb no route accepts — that mismatch answers 404,
      # not 405, so it reads like a wrong URL and is easy to miss in review.
      - name: Route/method parity
        run: npm run check:routes
        env:
          TZ: UTC
          NODE_ENV: test
          APP_KEY: test-app-key-for-ci-only-123456789
          DB_HOST: 127.0.0.1
          DB_PORT: 5432
          DB_USER: sbf
          DB_PASSWORD: sbf
          DB_DATABASE: sbf_test
          SESSION_DRIVER: memory
          LOG_LEVEL: error
          SMTP_HOST: localhost
          SMTP_PORT: 1025
          OIDC_ENABLED: 'false'
          API_SECRET: test-api-secret
          APP_URL: http://localhost:3334

      - name: Run unit and functional tests
        run: node ace test --no-color
        env:
          TZ: UTC
          NODE_ENV: test
          APP_KEY: test-app-key-for-ci-only-123456789
          DB_HOST: 127.0.0.1
          DB_PORT: 5432
          DB_USER: sbf
          DB_PASSWORD: sbf
          DB_DATABASE: sbf_test
          SESSION_DRIVER: memory
          LOG_LEVEL: error
          SMTP_HOST: localhost
          SMTP_PORT: 1025
          MAILPIT_API_URL: http://localhost:8025
          OIDC_ENABLED: 'false'
          API_SECRET: test-api-secret
          APP_URL: http://localhost:3334

      - name: Verify Japa JUnit report exists
        if: always()
        run: |
          ls -la test-results || true
          test -s test-results/junit-japa.xml

      - name: Install Playwright browser
        run: npx playwright install --with-deps chromium

      - name: Run Playwright E2E tests
        run: npm run test:e2e
        env:
          MAILPIT_API_URL: http://localhost:8025

      - name: Verify Playwright JUnit report exists
        if: always()
        run: |
          ls -la test-results || true
          test -s test-results/junit-e2e.xml

      - name: Run Playwright Auth Matrix smoke tests (PR only)
        if: github.event_name == 'pull_request'
        run: npm run test:e2e:auth-matrix
        env:
          MAILPIT_API_URL: http://localhost:8025

      - name: Verify Playwright Auth Matrix JUnit report exists (PR only)
        if: always() && github.event_name == 'pull_request'
        run: |
          ls -la test-results || true
          test -s test-results/junit-e2e-auth-matrix.xml

      - name: Publish Japa test results
        uses: mikepenz/action-junit-report@v4
        if: always()
        with:
          report_paths: 'test-results/junit-japa.xml'
          check_name: 'Japa Test Results'
          require_tests: true
          require_passed_tests: true
          include_passed: true
          detailed_summary: true

      - name: Publish Playwright E2E results
        uses: mikepenz/action-junit-report@v4
        if: always()
        with:
          report_paths: 'test-results/junit-e2e.xml'
          check_name: 'Playwright E2E Results'
          require_tests: true
          require_passed_tests: true
          include_passed: true
          detailed_summary: true

      - name: Publish Playwright Auth Matrix results (PR only)
        uses: mikepenz/action-junit-report@v4
        if: always() && github.event_name == 'pull_request'
        with:
          report_paths: 'test-results/junit-e2e-auth-matrix.xml'
          check_name: 'Playwright Auth Matrix Results'
          require_tests: true
          require_passed_tests: true
          include_passed: true
          detailed_summary: true

      - name: Upload raw test result artifacts
        uses: actions/upload-artifact@v4
        if: always()
        with:
          name: test-results
          path: |
            test-results/junit-japa.xml
            test-results/junit-e2e.xml
            test-results/junit-e2e-auth-matrix.xml
            playwright-report/**
            test-results/**
            playwright-artifacts/**
          if-no-files-found: warn
          retention-days: 14