name: 🔍 PR Checks

on:
  pull_request:
    branches: [ main, master ]
    paths:
      - 'server/**'
      - '.github/workflows/**'

jobs:
  # ==========================================
  # Lint and Test
  # ==========================================
  lint-and-test:
    runs-on: ubuntu-latest

    steps:
    - name: 📥 Checkout repository
      uses: actions/checkout@v4

    - name: ⬢ Setup Node.js
      uses: actions/setup-node@v4
      with:
        node-version: '20'
        cache: 'npm'
        cache-dependency-path: server/api/package-lock.json

    - name: 📦 Install dependencies
      working-directory: ./server/api
      run: |
        npm ci

    - name: 🔍 Lint code
      working-directory: ./server/api
      run: |
        npm run lint || echo "No lint script, skipping"

    - name: 🧪 Run tests
      working-directory: ./server/api
      run: |
        npm test || echo "No test script, skipping"

  # ==========================================
  # Build Test
  # ==========================================
  build-test:
    runs-on: ubuntu-latest

    steps:
    - name: 📥 Checkout repository
      uses: actions/checkout@v4

    - name: 🐳 Set up Docker Buildx
      uses: docker/setup-buildx-action@v3

    - name: 🔨 Build Docker image (test only)
      uses: docker/build-push-action@v5
      with:
        context: ./server/api
        push: false
        load: true
        tags: nanaxe-api:test
        cache-from: type=gha

    - name: 🧪 Test Docker image
      run: |
        docker run --rm nanaxe-api:test node --version
        docker run --rm nanaxe-api:test npm --version

    - name: 🔍 Scan for vulnerabilities
      uses: aquasecurity/trivy-action@master
      with:
        image-ref: nanaxe-api:test
        format: 'table'
        exit-code: '0'
        ignore-unfixed: true
        vuln-type: 'os,library'
        severity: 'CRITICAL,HIGH'

  # ==========================================
  # Docker Compose Validation
  # ==========================================
  compose-validation:
    runs-on: ubuntu-latest

    steps:
    - name: 📥 Checkout repository
      uses: actions/checkout@v4

    - name: 🐳 Validate Docker Compose
      working-directory: ./server
      run: |
        docker compose config

    - name: 🔍 Check for secrets
      uses: trufflesecurity/trufflehog@main
      with:
        path: ./
        base: main
        head: HEAD
        extra_args: --debug --only-verified