ci.yml

name: CI Pipeline

on:
  pull_request:
    branches:
      - main
  # Also run on commits that land on main by any path (admin bypass,
  # misconfigured or not-yet-enabled branch protection), so the secret scan,
  # lint, build and tests still gate the default branch (#156).
  push:
    branches:
      - main

jobs:
  ci:
    runs-on: ubuntu-latest

    services:
      postgres:
        image: postgres:16-alpine
        env:
          POSTGRES_USER: postgres
          POSTGRES_PASSWORD: postgres
          POSTGRES_DB: mergefi
        ports:
          - 5432:5432
        options: >-
          --health-cmd pg_isready
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5

    steps:
      - name: Checkout Code
        uses: actions/checkout@v4
        with:
          # Full history so the secret scan can inspect every commit, not
          # just the working tree — a credential committed and later removed
          # is invisible to a shallow checkout (#155).
          fetch-depth: 0

      - name: Setup Node.js v24
        uses: actions/setup-node@v4
        with:
          node-version: 24
          cache: 'npm'

      - name: Scan for Hardcoded Secrets (gitleaks, full history)
        env:
          GITLEAKS_VERSION: 8.28.0
        run: |
          set -euo pipefail
          echo "Downloading gitleaks v${GITLEAKS_VERSION}..."
          curl -sSfL \
            "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz" \
            | tar -xz gitleaks
          # `gitleaks git` walks the full commit history (not just the current
          # tree) using gitleaks' maintained rule set — AWS keys, generic
          # high-entropy tokens, connection strings, webhook URLs, JWTs, etc.
          # — replacing the three hand-rolled regexes this step used to run.
          ./gitleaks git . --redact --verbose --exit-code 1
        shell: bash

      - name: Install Dependencies
        run: npm ci

      - name: Lint Code
        run: npm run lint

      - name: Build Application
        run: npm run build

      - name: Run Unit & Integration Tests
        env:
          DATABASE_URL: postgresql://postgres:postgres@localhost:5432/mergefi
          NODE_ENV: test
        run: npm run test

      - name: Run Coverage Tests
        env:
          DATABASE_URL: postgresql://postgres:postgres@localhost:5432/mergefi
          NODE_ENV: test
        run: npm run test:cov

      # The e2e specs run entirely against the local Postgres service and a
      # mocked Stellar SDK; none of them use GITHUB_CLIENT_ID/SECRET. The step
      # used to be gated on those (never-configured) secrets, so `npm run
      # test:e2e` had never actually executed in CI (#164). Run it always.
      - name: Run E2E Tests
        env:
          DATABASE_URL: postgresql://postgres:postgres@localhost:5432/mergefi
          NODE_ENV: test
        run: npm run test:e2e
        run: |
          # The e2e specs build their TestingModule from mocked providers and
          # overrideGuard(...)-stubbed auth — none drive a real passport-github2
          # handshake, so GITHUB_CLIENT_ID/SECRET were never the right gate
          # (#165). What they actually need is a reachable Postgres, which the
          # `postgres` service container above always provides.
          if [ -z "${DATABASE_URL:-}" ]; then
            echo "Skipping E2E tests: DATABASE_URL is not set."
            exit 0
          fi
          npm run test:e2e
        shell: bash