name: ci

on:
  pull_request:
  push:
    branches:
      - main

permissions:
  contents: read

jobs:
  quality:
    runs-on: ubuntu-latest
    timeout-minutes: 20
    services:
      mysql:
        image: mysql:8.4.8
        env:
          MYSQL_DATABASE: lehuo_test
          MYSQL_USER: lehuo
          MYSQL_PASSWORD: ci-test-only
          MYSQL_ROOT_PASSWORD: ci-root-test-only
        ports:
          - 3306:3306
        options: >-
          --health-cmd="mysqladmin ping -h 127.0.0.1 -u root -pci-root-test-only --silent"
          --health-interval=10s
          --health-timeout=5s
          --health-retries=10
    env:
      APP_ENV: test
      DATABASE_URL: mysql://lehuo:ci-test-only@127.0.0.1:3306/lehuo_test
      TEST_DATABASE_URL: mysql://lehuo:ci-test-only@127.0.0.1:3306/lehuo_test
      SESSION_TOKEN_PEPPER: ci-test-session-token-pepper-2026
      AUDIT_IP_HASH_KEY: ci-test-audit-ip-hash-key-2026
      FIELD_ENCRYPTION_KEY: CwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCws=
      ADMIN_WEB_ORIGIN: http://localhost:5173
      ADMIN_COOKIE_SECURE: 'false'
      WECHAT_APP_ID: ci-test-app-id
      WECHAT_APP_SECRET: ci-test-app-secret
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Set up pnpm
        uses: pnpm/action-setup@v4
        with:
          version: 11.13.1

      - name: Set up Node.js
        uses: actions/setup-node@v4
        with:
          node-version: 24
          cache: pnpm

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Validate formatting
        run: pnpm format:check

      - name: Lint
        run: pnpm lint

      - name: Typecheck
        run: pnpm typecheck

      - name: Unit tests
        run: pnpm test:unit

      - name: Integration tests
        run: pnpm test:integration

      - name: Build
        run: pnpm build

      - name: Validate Docker Compose
        run: docker compose --env-file .env.example config --quiet

      - name: Dependency audit
        run: pnpm audit --registry=https://registry.npmjs.org --audit-level high