ci.yml

name: CI

on:
  push:
    branches: [main, develop]
    tags: ['v*']
  pull_request:
    branches: [main]

jobs:
  typecheck:
    name: Type Check
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: 20
          cache: 'npm'

      - name: Install dependencies
        run: npm ci

      - name: Type check (main process)
        run: npx tsc -p tsconfig.main.json --noEmit

      - name: Type check (renderer)
        run: npx tsc --noEmit

  test:
    name: Test
    runs-on: ${{ matrix.os }}
    strategy:
      matrix:
        os: [ubuntu-latest, macos-latest]
        node-version: [20]
    steps:
      - uses: actions/checkout@v4

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: ${{ matrix.node-version }}
          cache: 'npm'

      - name: Install dependencies
        run: npm ci

      - name: Run tests with coverage
        run: npx vitest run --coverage

      - name: Upload coverage
        if: matrix.os == 'ubuntu-latest'
        uses: actions/upload-artifact@v4
        with:
          name: coverage-report
          path: coverage/
          retention-days: 7

  lint:
    name: Lint
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: 20
          cache: 'npm'

      - name: Install dependencies
        run: npm ci

      - name: Lint
        run: npm run lint --if-present

  build:
    name: Build (${{ matrix.os }})
    needs: [typecheck, test]
    runs-on: ${{ matrix.os }}
    strategy:
      matrix:
        os: [ubuntu-latest, macos-latest, windows-latest]
    steps:
      - uses: actions/checkout@v4

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: 20
          cache: 'npm'

      - name: Install dependencies
        run: npm ci

      - name: Build main process
        run: npm run build:main

      - name: Build renderer
        run: npm run build:renderer

  security:
    name: Security Audit
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: 20
          cache: 'npm'

      - name: Install dependencies
        run: npm ci

      - name: Security audit
        run: npm audit --production --audit-level=high
        continue-on-error: true

      - name: Check for sensitive data patterns
        run: |
          if grep -rn "sk-ant-\|sk-[a-zA-Z0-9]\{20,\}\|AIza[a-zA-Z0-9]\{30,\}" src/ --include="*.ts" --include="*.tsx" \
            --exclude="*sensitive-data-detector*" \
            --exclude="*SettingsModal*" \
            --exclude="*SettingsPage*" \
            --exclude="*SetupWizard*" \
            --exclude-dir="__tests__" \
            | grep -v 'placeholder' | grep -v 'pattern:'; then
            echo "::error::Potential API key found in source code!"
            exit 1
          fi
          echo "No sensitive data patterns found."

  docker-rag:
    name: Docker RAG Stack
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Build RAG server image
        run: docker build -t mingly-rag-server ./rag-server

      - name: Validate docker-compose
        run: docker compose config --quiet

  release:
    name: Release (${{ matrix.os }})
    if: startsWith(github.ref, 'refs/tags/v')
    needs: [build, security]
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        os: [macos-latest, windows-latest, ubuntu-latest]
    permissions:
      contents: write
    steps:
      - uses: actions/checkout@v4

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: 20
          cache: 'npm'

      - name: Install Linux build dependencies
        if: runner.os == 'Linux'
        run: |
          sudo apt-get update
          sudo apt-get install -y rpm

      - name: Install dependencies
        run: npm ci

      - name: Build
        run: npm run build

      - name: Package and publish Electron app
        run: npx electron-builder --publish always
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          # Code signing is disabled until certificates are configured.
          # To enable: add CSC_LINK, CSC_KEY_PASSWORD, APPLE_ID,
          # APPLE_APP_SPECIFIC_PASSWORD, APPLE_TEAM_ID secrets in GitHub.
          CSC_IDENTITY_AUTO_DISCOVERY: false

      - name: Generate checksums (macOS/Linux)
        if: runner.os != 'Windows'
        run: |
          cd release
          for f in *.dmg *.zip *.AppImage *.deb; do
            [ -f "$f" ] && shasum -a 256 "$f" >> checksums-sha256.txt
          done
        continue-on-error: true

      - name: Generate checksums (Windows)
        if: runner.os == 'Windows'
        shell: pwsh
        run: |
          cd release
          Get-ChildItem -Filter *.exe | ForEach-Object {
            $hash = (Get-FileHash $_.FullName -Algorithm SHA256).Hash
            "$hash  $($_.Name)" | Out-File -Append checksums-sha256.txt
          }
        continue-on-error: true

      - name: Upload release artifacts
        uses: actions/upload-artifact@v4
        with:
          name: release-${{ matrix.os }}
          path: |
            release/*.dmg
            release/*.zip
            release/*.exe
            release/*.AppImage
            release/*.deb
            release/checksums-sha256.txt
          retention-days: 30