name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

permissions:
  contents: read

jobs:
  backend:
    name: Backend
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-go@v5
        with:
          go-version: "1.26.x"
          cache: true
      - name: Formatting
        run: test -z "$(gofmt -l cmd internal)"
      - name: Vet
        run: go vet ./cmd/... ./internal/...
      - name: Unit and architecture tests
        run: go test -race ./cmd/... ./internal/...

  frontend:
    name: Frontend
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: "24"
      - name: Install dependencies
        run: npm --prefix web ci
      - name: Lint, typecheck, and test
        run: npm --prefix web run check
      - name: Production build
        run: npm --prefix web run build

  contracts:
    name: Contracts and repository policy
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Validate OpenAPI
        uses: docker://redocly/cli:1.34.5
        with:
          args: lint api/openapi.yaml
      - name: Reject committed secrets and local data
        run: |
          test ! -e .env
          test ! -d .data

  container:
    name: Container
    runs-on: ubuntu-latest
    needs: [backend, frontend, contracts]
    steps:
      - uses: actions/checkout@v4
      - name: Build application image
        run: docker build --build-arg VERSION=${{ github.sha }} -t drive-v2:${{ github.sha }} .