ci.yml

# ------------------------------------------------------------------------------
# CI for Paperless (https://github.com/ANcpLua/Paperless)
# Backend: NUKE + MTP v2 + xUnit v3, coverage via MTP CodeCoverage extension.
# Frontends: PaperlessUI.Blazor (built via .NET), PaperlessUI.Angular + .React
#            (built via pnpm; lint + build only — full E2E lives elsewhere).
# ------------------------------------------------------------------------------

name: ci

on:
    push:
        branches:
            - main
            - 'feature/*'
    pull_request:
        branches:
            - main

# Cancel superseded runs on PRs (developer is iterating; only the latest push matters).
# Never cancel push-to-main runs — release/tag pipelines must complete.
concurrency:
    group: ci-${{ github.workflow }}-${{ github.ref }}
    cancel-in-progress: ${{ github.event_name == 'pull_request' }}

# Least-privilege defaults; individual jobs/steps escalate if they truly need it.
permissions:
    contents: read
    actions: read
    checks: write           # codecov / test-result annotations
    pull-requests: write    # codecov PR comments

env:
    DOTNET_NOLOGO: true
    DOTNET_CLI_TELEMETRY_OPTOUT: true
    DOTNET_SKIP_FIRST_TIME_EXPERIENCE: true
    DOCKER_HOST: unix:///var/run/docker.sock
    TESTCONTAINERS_RYUK_DISABLED: false

jobs:
    backend:
        name: Build & Test (backend)
        runs-on: ubuntu-latest

        steps:
            -   name: Checkout
                uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
                with:
                    fetch-depth: 0

            -   name: Setup .NET 10
                uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5
                with:
                    global-json-file: global.json

            -   name: Cache NuGet packages
                uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
                with:
                    path: |
                        .nuke/temp
                        ~/.nuget/packages
                    key: ${{ runner.os }}-nuget-${{ hashFiles('**/global.json', '**/*.csproj', '**/Directory.Packages.props') }}

            -   name: Install OCR dependencies
                run: |
                    sudo apt-get update
                    sudo apt-get install -y ghostscript tesseract-ocr tesseract-ocr-eng

            -   name: Unit tests
                run: ./build.sh UnitTests

            -   name: Integration tests
                run: ./build.sh IntegrationTests

            -   name: Coverage (Cobertura via MTP)
                run: ./build.sh Coverage

            # This is the only coverage check that can fail a push to main. Codecov's
            # project/patch statuses are configured non-informational in codecov.yml, but
            # main has no required status checks, and commits land here by direct push —
            # so nothing enforces them. Thresholds sit below the current 97.0% line /
            # 91.1% branch to catch regressions, not to ratchet; raise them deliberately.
            -   name: Coverage gate + markdown summary
                run: ./build.sh ReportCoverage --coverage-min-line 95 --coverage-min-branch 75 --coverage-format markdown --coverage-exclude-generated-param true

            -   name: Upload coverage artifacts
                if: always()
                uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
                with:
                    name: coverage
                    path: Artifacts/coverage/
                    if-no-files-found: warn

            -   name: Upload coverage to Codecov
                if: always()
                uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v6
                with:
                    files: ./Artifacts/coverage/PaperlessREST.Tests/coverage.cobertura.xml,./Artifacts/coverage/PaperlessServices.Tests/coverage.cobertura.xml
                    flags: backend
                    name: codecov-backend
                    fail_ci_if_error: false
                    verbose: true

            -   name: Upload test results
                if: always()
                uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
                with:
                    name: test-results
                    path: TestResults/
                    if-no-files-found: warn

            # PaperlessUI.Blazor is in Paperless.slnx, so it's compiled as part
            # of the NUKE build above — no separate step needed. Its Dockerfile +
            # paperless-blazor compose service serve it behind nginx at /.

    frontend-angular:
        name: Build (PaperlessUI.Angular)
        runs-on: ubuntu-latest
        defaults:
            run:
                working-directory: PaperlessUI.Angular
        steps:
            -   uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
            -   name: Activate pnpm via corepack
                run: |
                    corepack enable
                    corepack prepare pnpm@10.30.2 --activate
            -   uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
                with:
                    node-version: 22
                    cache: pnpm
                    cache-dependency-path: PaperlessUI.Angular/pnpm-lock.yaml
            -   run: pnpm install --frozen-lockfile
            -   run: pnpm run build  # ng build defaults to production
            # `ng test` needs a real browser; opt-in only — wire later via Playwright/Karma headless.

    frontend-react:
        name: Build (PaperlessUI.React)
        runs-on: ubuntu-latest
        defaults:
            run:
                working-directory: PaperlessUI.React
        steps:
            -   uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
            -   name: Activate pnpm via corepack
                run: |
                    corepack enable
                    corepack prepare pnpm@10.30.2 --activate
            -   uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
                with:
                    node-version: 22
                    cache: pnpm
                    cache-dependency-path: PaperlessUI.React/pnpm-lock.yaml
            -   run: pnpm install --frozen-lockfile
            -   run: pnpm run build