name: MobilityOps acceptance

on:
  push:
    branches: [master]
  pull_request:

jobs:
  backend:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Secret scan
        uses: trufflesecurity/trufflehog@v3.79.0
        with:
          path: ./
          extra_args: --only-verified
      - name: Backend tests in isolated PostgreSQL stack
        run: sh scripts/run-isolated-tests.sh
      - name: Backend static checks
        run: |
          docker compose -p mobilityops-ci -f compose.yaml -f compose.test.yaml run --build --rm api ruff check app tests scripts
          docker compose -p mobilityops-ci -f compose.yaml -f compose.test.yaml run --rm api mypy app
      - name: Backend dependency vulnerability scan (HIGH/CRITICAL)
        uses: aquasecurity/trivy-action@0.30.0
        with:
          scan-type: fs
          scan-ref: backend
          format: table
          severity: HIGH,CRITICAL
          exit-code: "1"
          ignore-unfixed: true
      - name: Remove CI stack
        if: always()
        run: docker compose -p mobilityops-ci -f compose.yaml -f compose.test.yaml down -v --remove-orphans

  frontend:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: 22
          cache: npm
          cache-dependency-path: frontend/package-lock.json
      - name: Install locked dependencies
        working-directory: frontend
        run: npm ci --no-audit --no-fund
      - name: Typecheck and production build
        working-directory: frontend
        run: npm run build
      - name: Dependency audit
        working-directory: frontend
        run: npm audit