ruby.yml

name: Github Testing

on:
  push:
    branches: [main]
  pull_request:

env:
  BUNDLE_DEPLOYMENT: "1"
  BUNDLE_WITHOUT: "development:staging:production"

jobs:
  test:
    services:
      postgres:
        image: postgres:18
        ports: ["5432:5432"]
        env:
          POSTGRES_PASSWORD: postgres
          POSTGRES_USERNAME: postgres
        options: --health-cmd pg_isready --health-interval 10s --health-timeout 5s --health-retries 5

    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-24.04]
        ruby: ['3.4.4']
    runs-on: ${{ matrix.os }}
    steps:
      - uses: actions/checkout@v6

      - name: Set up Ruby
        uses: ruby/setup-ruby@v1
        with:
          ruby-version: ${{ matrix.ruby }}
          bundler-cache: true

      - name: Verify gems match this PR lockfile
        run: |
          echo "Ruby: $(ruby -v)"
          echo "Bundler: $(bundle -v)"
          bundle env
          bundle check
          echo "Installed gems from Gemfile.lock:"
          bundle list

      - name: Run Tests
        env:
          PG_DATABASE: postgres
          PG_HOST: localhost
          PG_USER: postgres
          PG_PASSWORD: postgres
          PG_PORT: ${{ job.services.postgres.ports[5432] }}
          RAILS_ENV: test
          COVERAGE: true
          DISABLE_SPRING: 1
        run: |
          cp config/application.yml.sample config/application.yml
          bundle exec rake db:create db:migrate
          bundle exec rails assets:precompile
          bundle exec rspec

      - name: Upload Capybara screenshots
        if: failure() && hashFiles('tmp/capybara/**') != ''
        uses: actions/upload-artifact@v7
        with:
          name: capybara-screenshots
          path: tmp/capybara
        
      - name: Install qlty CLI
        run: |
          curl -LSs https://qlty.sh | bash
          echo "${HOME}/.qlty/bin" >> $GITHUB_PATH

      - name: Upload coverage to Qlty
        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
        env:
          QLTY_COVERAGE_TOKEN: ${{ secrets.QLTY_COVERAGE_TOKEN }}
        run: |
          if [ -z "${QLTY_COVERAGE_TOKEN:-}" ]; then
            echo "QLTY_COVERAGE_TOKEN is missing; skipping upload" >&2
            exit 0
          fi
          if [ -d "coverage" ]; then
            echo "Coverage directory found:"
            ls -la coverage/
            if [ -f "coverage/lcov.info" ]; then
              echo "Found LCOV info file, uploading to qlty..."
              qlty coverage publish --format=lcov coverage/lcov.info
            elif [ -d "coverage/lcov" ]; then
              echo "Found LCOV directory, combining files..."
              cat coverage/lcov/*.lcov > coverage/coverage.lcov
              qlty coverage publish --format=lcov coverage/coverage.lcov
            elif [ -f "coverage/coverage.lcov" ]; then
              qlty coverage publish --format=lcov coverage/coverage.lcov
            else
              echo "No LCOV coverage file found. Available files:"
              find coverage/ -type f -name "*.lcov" -o -name "*.info" -o -name "*.json" -o -name "*.xml"
              echo "Please check what coverage format your test runner generates"
              exit 1
            fi
          else
            echo "No coverage directory found. Skipping coverage upload."
            echo "This is normal if coverage is not configured or tests failed."
          fi

  security_scan:
    runs-on: ubuntu-24.04
    strategy:
      fail-fast: false
      matrix:
        ruby: ['3.4.4']
    steps:
      - uses: actions/checkout@v6
      - name: Set up Ruby
        uses: ruby/setup-ruby@v1
        with:
          ruby-version: ${{ matrix.ruby }}
          bundler-cache: true
      - name: Verify gems match this PR lockfile
        run: |
          bundle check
          bundle list
      - name: Scan for security vulnerabilities
        run: |
          cp config/application.yml.sample config/application.yml
          bin/importmap audit
          bundle exec bundler-audit --update
          bin/brakeman --no-pager --format json --output brakeman-report.json
          bin/brakeman --no-pager --format html --output brakeman-report.html
        continue-on-error: true
      - name: Upload security scan results
        if: always()
        uses: actions/upload-artifact@v7
        with:
          name: security-scan-results
          path: |
            brakeman-report.json
            brakeman-report.html