test.yml

name: Test Suite

on:
  push:
    branches: [main, develop]
    paths:
      - 'api/**'
      - '.github/workflows/test.yml'
  pull_request:
    branches: [main, develop]
    paths:
      - 'api/**'
      - '.github/workflows/test.yml'

jobs:
  test:
    runs-on: ubuntu-latest

    services:
      postgres:
        image: postgres:15-alpine
        env:
          POSTGRES_USER: test
          POSTGRES_PASSWORD: test
          POSTGRES_DB: screencraft_test
        ports:
          - 5432:5432
        options: >-
          --health-cmd pg_isready
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5

      redis:
        image: redis:7-alpine
        ports:
          - 6379:6379
        options: >-
          --health-cmd "redis-cli ping"
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5

      minio:
        image: minio/minio:latest
        ports:
          - 9000:9000
        env:
          MINIO_ROOT_USER: minioadmin
          MINIO_ROOT_PASSWORD: minioadmin
        options: >-
          --health-cmd "curl -f http://localhost:9000/minio/health/live"
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '20'
          cache: 'npm'
          cache-dependency-path: api/package-lock.json

      - name: Install dependencies
        run: cd api && npm ci

      - name: Generate Prisma client
        run: cd api && npx prisma generate

      - name: Run database migrations
        run: cd api && npx prisma migrate deploy
        env:
          DATABASE_URL: postgresql://test:test@localhost:5432/screencraft_test

      - name: Run unit tests
        run: cd api && npm run test:unit
        env:
          NODE_ENV: test
          DATABASE_URL: postgresql://test:test@localhost:5432/screencraft_test
          REDIS_HOST: localhost
          REDIS_PORT: 6379
          MINIO_ENDPOINT: localhost
          MINIO_PORT: 9000
          MINIO_ACCESS_KEY: minioadmin
          MINIO_SECRET_KEY: minioadmin

      - name: Run integration tests
        run: cd api && npm run test:integration
        env:
          NODE_ENV: test
          DATABASE_URL: postgresql://test:test@localhost:5432/screencraft_test
          REDIS_HOST: localhost
          REDIS_PORT: 6379
          MINIO_ENDPOINT: localhost
          MINIO_PORT: 9000
          MINIO_ACCESS_KEY: minioadmin
          MINIO_SECRET_KEY: minioadmin

      - name: Run tests with coverage
        run: cd api && npm run test:coverage
        env:
          NODE_ENV: test
          DATABASE_URL: postgresql://test:test@localhost:5432/screencraft_test
          REDIS_HOST: localhost
          REDIS_PORT: 6379
          MINIO_ENDPOINT: localhost
          MINIO_PORT: 9000
          MINIO_ACCESS_KEY: minioadmin
          MINIO_SECRET_KEY: minioadmin

      - name: Upload coverage report
        uses: codecov/codecov-action@v4
        with:
          files: ./api/coverage/lcov.info
          flags: api
          fail_ci_if_error: false
          token: ${{ secrets.CODECOV_TOKEN }}

      - name: Upload coverage artifacts
        uses: actions/upload-artifact@v4
        with:
          name: coverage-report
          path: api/coverage/
          retention-days: 7

  lint:
    runs-on: ubuntu-latest

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '20'
          cache: 'npm'
          cache-dependency-path: api/package-lock.json

      - name: Install dependencies
        run: cd api && npm ci

      - name: Type check
        run: cd api && npx tsc --noEmit

  # H-15: Security audit job
  security:
    runs-on: ubuntu-latest

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '20'
          cache: 'npm'
          cache-dependency-path: api/package-lock.json

      - name: Install dependencies
        run: cd api && npm ci

      - name: Run npm audit (API)
        run: cd api && npm audit --audit-level=high --omit=dev
        continue-on-error: true

      - name: Run npm audit (Web)
        run: cd web && npm audit --audit-level=high --omit=dev
        continue-on-error: true

      - name: Check for known vulnerabilities with Snyk
        uses: snyk/actions/node@master
        continue-on-error: true
        env:
          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
        with:
          args: --severity-threshold=high --file=api/package.json

  build:
    runs-on: ubuntu-latest
    needs: [test, lint]

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '20'
          cache: 'npm'
          cache-dependency-path: api/package-lock.json

      - name: Install dependencies
        run: cd api && npm ci

      - name: Build project
        run: cd api && npm run build

      - name: Upload build artifacts
        uses: actions/upload-artifact@v4
        with:
          name: dist
          path: api/dist/
          retention-days: 7

  # L-04: SBOM Generation for supply chain security
  sbom:
    runs-on: ubuntu-latest
    needs: [build]

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '20'
          cache: 'npm'
          cache-dependency-path: api/package-lock.json

      - name: Install dependencies
        run: cd api && npm ci

      # Generate SBOM in CycloneDX format
      - name: Generate SBOM for API
        uses: CycloneDX/gh-node-module-generatebom@v1
        with:
          path: ./api
          output: ./api-sbom.json

      # Generate SBOM for Web
      - name: Generate SBOM for Web
        uses: CycloneDX/gh-node-module-generatebom@v1
        with:
          path: ./web
          output: ./web-sbom.json

      - name: Upload API SBOM
        uses: actions/upload-artifact@v4
        with:
          name: sbom-api
          path: ./api-sbom.json
          retention-days: 90

      - name: Upload Web SBOM
        uses: actions/upload-artifact@v4
        with:
          name: sbom-web
          path: ./web-sbom.json
          retention-days: 90

      # Validate SBOM format
      - name: Validate SBOM
        run: |
          echo "SBOM generated successfully"
          echo "API SBOM size: $(wc -c < ./api-sbom.json) bytes"
          echo "Web SBOM size: $(wc -c < ./web-sbom.json) bytes"