name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

permissions:
  contents: read

jobs:
  backend:
    name: Backend
    runs-on: ubuntu-latest
    services:
      postgres:
        image: postgres:18.4-bookworm
        env:
          POSTGRES_DB: drive_test
          POSTGRES_USER: drive
          POSTGRES_PASSWORD: drive-test-only
        ports:
          - 5432:5432
        options: >-
          --health-cmd "pg_isready -U drive -d drive_test"
          --health-interval 5s
          --health-timeout 5s
          --health-retries 10
    env:
      DRIVE_TEST_DATABASE_URL: postgres://drive:drive-test-only@127.0.0.1:5432/drive_test?sslmode=disable
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-go@v5
        with:
          go-version: "1.26.x"
          cache: true
      - name: Formatting
        run: test -z "$(gofmt -l cmd internal)"
      - name: Vet
        run: go vet ./cmd/... ./internal/...
      - name: Unit and architecture tests
        run: go test -race ./cmd/... ./internal/...

  frontend:
    name: Frontend
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: "24"
      - name: Install dependencies
        run: npm --prefix web ci
      - name: Lint, typecheck, and test
        run: npm --prefix web run check
      - name: Production build
        run: npm --prefix web run build

  contracts:
    name: Contracts and repository policy
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Validate OpenAPI
        uses: docker://redocly/cli:1.34.5
        with:
          args: lint api/openapi.yaml
      - name: Verify generated PostgreSQL repository
        run: |
          docker run --rm -v "$PWD:/src" -w /src sqlc/sqlc:1.31.1 generate
          git diff --exit-code -- internal/adapters/postgres/generated
      - name: Reject committed secrets and local data
        run: |
          test ! -e .env
          test ! -d .data

  container:
    name: Container
    runs-on: ubuntu-latest
    needs: [backend, frontend, contracts]
    steps:
      - uses: actions/checkout@v4
      - name: Build application image
        run: docker build --build-arg VERSION=${{ github.sha }} -t drive-v2:${{ github.sha }} .
      - name: Smoke application image
        run: sh scripts/smoke-image.sh drive-v2:${{ github.sha }}