name: MobilityOps acceptance

on:
  push:
    branches: [master]
  pull_request:

jobs:
  backend:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Secret scan
        uses: trufflesecurity/trufflehog@v3.79.0
        with:
          path: ./
          extra_args: --only-verified
      - name: Backend tests in isolated PostgreSQL stack
        run: sh scripts/run-isolated-tests.sh
      - name: Backend static checks
        run: |
          docker compose -p mobilityops-ci -f compose.yaml -f compose.test.yaml run --build --rm api ruff check app tests scripts
          docker compose -p mobilityops-ci -f compose.yaml -f compose.test.yaml run --rm api mypy app
      - name: Backend dependency vulnerability scan (HIGH/CRITICAL)
        uses: aquasecurity/trivy-action@v0.30.0
        with:
          scan-type: fs
          scan-ref: backend
          format: table
          severity: HIGH,CRITICAL
          exit-code: "1"
          ignore-unfixed: true
      - name: Remove CI stack
        if: always()
        run: docker compose -p mobilityops-ci -f compose.yaml -f compose.test.yaml down -v --remove-orphans

  frontend:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: 22
          cache: npm
          cache-dependency-path: frontend/package-lock.json
      - name: Install locked dependencies
        working-directory: frontend
        run: npm ci --no-audit --no-fund
      - name: Lint (tsc + ESLint with react-hooks and jsx-a11y)
        working-directory: frontend
        run: npm run lint
      - name: Typecheck and production build
        working-directory: frontend
        run: npm run build
      - name: Dependency audit
        working-directory: frontend
        run: npm audit --audit-level=high

  e2e:
    # The five-minute Playwright demo is part of the definition of done
    # (docs/14-testing-and-acceptance.md); run it against the real Compose stack.
    runs-on: ubuntu-latest
    needs: [backend, frontend]
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: 22
          cache: npm
          cache-dependency-path: frontend/package-lock.json
      - name: Start the demo stack
        run: |
          cp .env.example .env
          docker compose -p mobilityops-e2e up --build -d db api web
          for attempt in $(seq 1 60); do
            if curl -fsS http://localhost:1228/health/ready >/dev/null 2>&1; then break; fi
            sleep 2
          done
          curl -fsS http://localhost:1228/health/ready
          docker compose -p mobilityops-e2e exec -T api python -m app.cli seed --reset
      - name: Install Playwright
        working-directory: frontend
        run: |
          npm ci --no-audit --no-fund
          npx playwright install --with-deps chromium
      - name: Run browser acceptance suite
        working-directory: frontend
        env:
          MOBILITYOPS_PUBLIC_URL: http://localhost:1228
        run: npx playwright test
      - name: Upload Playwright report
        if: failure()
        uses: actions/upload-artifact@v3
        with:
          name: playwright-report
          path: frontend/playwright-report
      - name: Stack logs on failure
        if: failure()
        run: docker compose -p mobilityops-e2e logs --tail=200 api web
      - name: Remove e2e stack
        if: always()
        run: docker compose -p mobilityops-e2e down -v --remove-orphans