OwnCord/.github/workflows/ci.yml

name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main, dev]

# Cancel in-progress runs for the same branch/PR
concurrency:
  group: ci-${{ github.ref }}
  cancel-in-progress: true

jobs:
  server-build-test:
    name: Server Build & Test
    runs-on: windows-latest
    defaults:
      run:
        working-directory: Server/
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

      - uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
        with:
          go-version: "1.25"
          cache-dependency-path: Server/go.sum

      - name: Build server
        run: go build -o chatserver.exe -ldflags "-s -w" .

      - name: Go vulnerability check
        run: go install golang.org/x/vuln/cmd/govulncheck@v1.1.4 && govulncheck ./...

      - name: Run tests with race detection and coverage
        run: go test -race ./... -coverprofile=coverage.out -cover

      - name: Run tests with deadlock detection
        run: go test -tags deadlock -count=1 ./...

      - name: Upload Go coverage
        if: always()
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          name: go-coverage
          path: Server/coverage.out
          retention-days: 7

      - name: Lint
        uses: golangci/golangci-lint-action@4afd733a84b2f1a21f7c2e8a0e49adb3c0f2dbb6 # v9.0.0
        with:
          version: v2.11.3
          working-directory: Server/

  client-check:
    name: Client Typecheck & Test
    runs-on: windows-latest
    defaults:
      run:
        working-directory: Client/tauri-client/
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
        with:
          node-version: 20
          cache: npm
          cache-dependency-path: Client/tauri-client/package-lock.json

      - name: Install npm dependencies
        run: npm ci

      - name: Security audit (npm)
        run: npm audit --audit-level=high

      - name: Oxlint (fast correctness checks)
        run: npx oxlint src/

      - name: TypeScript check
        run: npx tsc --noEmit

      - name: ESLint (type-aware rules)
        run: npx eslint src/

      - name: Prettier format check
        run: npx prettier --check "src/**/*.ts" "tests/**/*.ts"

      - name: Knip (unused code & deps)
        run: npx knip || true

      - name: Run unit tests with coverage
        run: npx vitest run --coverage --reporter=default

      - name: Upload client coverage
        if: always()
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          name: client-coverage
          path: Client/tauri-client/coverage/
          retention-days: 7

  # Full Tauri build only on PRs to main (expensive: ~15 min x2 multiplier)
  tauri-build:
    name: Tauri Full Build
    needs: client-check
    if: github.event_name == 'pull_request' && github.base_ref == 'main'
    runs-on: windows-latest
    defaults:
      run:
        working-directory: Client/tauri-client/
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
        with:
          node-version: 20
          cache: npm
          cache-dependency-path: Client/tauri-client/package-lock.json

      - name: Install Rust
        uses: dtolnay/rust-toolchain@b3b07ba8b418998c39fb20f53e18c1f174353f26 # stable
        with:
          components: clippy

      - name: Rust cache
        uses: swatinem/rust-cache@9d47c6ad4b02e050fd481d890b2ea34778fd09d6 # v2.7.8
        with:
          workspaces: Client/tauri-client/src-tauri

      - name: Install npm dependencies
        run: npm ci

      - name: Install tauri-typegen
        run: cargo install tauri-typegen@0.1.3 --quiet

      - name: Generate TypeScript IPC bindings
        working-directory: Client/tauri-client/
        run: cargo tauri-typegen generate

      - name: Clippy lint (Rust)
        working-directory: Client/tauri-client/src-tauri/
        run: cargo clippy -- -D warnings

      - name: Security audit (Rust dependencies)
        working-directory: Client/tauri-client/src-tauri/
        run: |
          cargo install cargo-audit@0.21.2 --quiet
          cargo audit

      - name: Build Tauri app
        env:
          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
        run: npm run tauri build