name: CI

on:
  push:
  pull_request:

permissions:
  contents: read

concurrency:
  group: ci-${{ github.ref }}
  cancel-in-progress: true

jobs:
  quality:
    runs-on: ubuntu-latest
    timeout-minutes: 20
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: "3.13"
      - name: Install uv
        run: python -m pip install --disable-pip-version-check uv==0.10.0
      - name: Sync locked dependencies
        run: uv sync --frozen --all-groups
      - name: Install Chromium for mandatory browser tests
        run: uv run playwright install --with-deps chromium
      - name: Secret scan
        uses: trufflesecurity/trufflehog@v3.79.0
        with:
          path: ./
          extra_args: --only-verified
      - name: Scan project dependencies and lockfiles (high/critical)
        uses: aquasecurity/trivy-action@v0.30.0
        with:
          scan-type: fs
          scan-ref: .
          format: table
          severity: HIGH,CRITICAL
          exit-code: "1"
          ignore-unfixed: true
      - name: Verify repository
        env:
          DJANGO_SECRET_KEY: ci-only-not-production-secret
          DJANGO_DEBUG: "1"
          DATABASE_URL: ""
          CELERY_TASK_ALWAYS_EAGER: "1"
          IMAP_ENABLED: "0"
          OLLAMA_ENABLED: "0"
        run: ./scripts/codex_verify.sh
      - name: Upload browser failure artifacts
        if: failure()
        uses: actions/upload-artifact@v4
        with:
          name: browser-failure-artifacts
          path: artifacts/browser-tests/
          if-no-files-found: ignore

  container:
    runs-on: ubuntu-latest
    timeout-minutes: 20
    needs: quality
    steps:
      - uses: actions/checkout@v4
      - name: Build production image
        run: docker build --pull --tag vacatureradar:ci .
      - name: Scan container image for high/critical vulnerabilities
        uses: aquasecurity/trivy-action@v0.30.0
        with:
          image-ref: vacatureradar:ci
          format: table
          severity: HIGH,CRITICAL
          exit-code: "1"
          ignore-unfixed: true
      - name: Generate CycloneDX software bill of materials
        uses: aquasecurity/trivy-action@v0.30.0
        with:
          image-ref: vacatureradar:ci
          format: cyclonedx
          output: vacatureradar-sbom.cdx.json
          scan-type: image
      - name: Upload software bill of materials
        uses: actions/upload-artifact@v4
        with:
          name: vacatureradar-sbom
          path: vacatureradar-sbom.cdx.json
      - name: Inspect image configuration
        run: docker image inspect vacatureradar:ci > /tmp/image-inspect.json