ci.yml

# =============================================================================
# TelemetryFlow Core - CI Workflow
# =============================================================================
#
# TelemetryFlow Core - Full-Stack Monorepo (Backend + Frontend)
# Copyright (c) 2026 Telemetri Data Indonesia. All rights reserved.
#
# Pipeline stages: install -> lint -> build -> test -> security
#
# =============================================================================

name: CI - TelemetryFlow Core

on:
  push:
    branches:
      - main
      - master
      - develop
      - "feature/**"
      - "release/**"
    paths:
      - "backend/**"
      - "frontend/**"
      - "package.json"
      - "pnpm-lock.yaml"
      - "pnpm-workspace.yaml"
      - "turbo.json"
      - ".github/workflows/ci.yml"
  pull_request:
    branches:
      - main
      - master
      - develop
    paths:
      - "backend/**"
      - "frontend/**"
      - "package.json"
      - "pnpm-lock.yaml"
      - "pnpm-workspace.yaml"
      - "turbo.json"
      - ".github/workflows/ci.yml"
  workflow_dispatch:
    inputs:
      skip_lint:
        description: "Skip linting"
        required: false
        type: boolean
        default: false

env:
  NODE_VERSION: "22"
  PNPM_VERSION: "10.24.0"
  PRODUCT_NAME: TelemetryFlow Core

permissions:
  contents: read
  pull-requests: write

jobs:
  # ===========================================================================
  # Code Quality - Lint, Format, Type Check
  # ===========================================================================
  lint:
    name: Lint & Code Quality
    runs-on: ubuntu-latest
    if: ${{ !inputs.skip_lint }}
    steps:
      - name: Checkout code
        uses: actions/checkout@v7

      - name: Set up Node.js
        uses: actions/setup-node@v6
        with:
          node-version: ${{ env.NODE_VERSION }}

      - name: Install pnpm
        uses: pnpm/action-setup@v6
        with:
          version: ${{ env.PNPM_VERSION }}

      - name: Get pnpm store directory
        shell: bash
        run: |
          echo "STORE_PATH=$(pnpm store path --silent)" >> $GITHUB_ENV

      - name: Setup pnpm cache
        uses: actions/cache@v6
        with:
          path: ${{ env.STORE_PATH }}
          key: ${{ runner.os }}-pnpm-store-${{ hashFiles('**/pnpm-lock.yaml') }}
          restore-keys: |
            ${{ runner.os }}-pnpm-store-

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Run ESLint
        run: pnpm lint

      - name: Build backend (TypeScript check)
        run: pnpm build:backend

      - name: Build frontend
        run: pnpm build:frontend

  # ===========================================================================
  # Unit Tests
  # ===========================================================================
  test-unit:
    name: Unit Tests
    runs-on: ubuntu-latest
    needs: lint
    if: always() && (needs.lint.result == 'success' || needs.lint.result == 'skipped')
    steps:
      - name: Checkout code
        uses: actions/checkout@v7

      - name: Set up Node.js
        uses: actions/setup-node@v6
        with:
          node-version: ${{ env.NODE_VERSION }}

      - name: Install pnpm
        uses: pnpm/action-setup@v6
        with:
          version: ${{ env.PNPM_VERSION }}

      - name: Get pnpm store directory
        shell: bash
        run: |
          echo "STORE_PATH=$(pnpm store path --silent)" >> $GITHUB_ENV

      - name: Setup pnpm cache
        uses: actions/cache@v6
        with:
          path: ${{ env.STORE_PATH }}
          key: ${{ runner.os }}-pnpm-store-${{ hashFiles('**/pnpm-lock.yaml') }}
          restore-keys: |
            ${{ runner.os }}-pnpm-store-

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Run unit tests with coverage
        run: pnpm test:cov

      - name: Upload unit test coverage
        uses: actions/upload-artifact@v6
        with:
          name: coverage-unit
          path: coverage/
          retention-days: 7

  # ===========================================================================
  # Integration Tests
  # ===========================================================================
  test-integration:
    name: Integration Tests
    runs-on: ubuntu-latest
    needs: lint
    if: always() && (needs.lint.result == 'success' || needs.lint.result == 'skipped')
    services:
      postgres:
        image: postgres:16
        env:
          POSTGRES_PASSWORD: telemetryflow123
          POSTGRES_USER: postgres
          POSTGRES_DB: telemetryflow_test_db
        options: >-
          --health-cmd pg_isready
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5
        ports:
          - 5432:5432

      clickhouse:
        image: clickhouse/clickhouse-server:latest
        env:
          CLICKHOUSE_DB: telemetryflow_test_db
          CLICKHOUSE_USER: default
          CLICKHOUSE_PASSWORD: telemetryflow123
        ports:
          - 8123:8123
          - 9000:9000

      redis:
        image: redis:7-alpine
        options: >-
          --health-cmd "redis-cli ping"
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5
        ports:
          - 6379:6379

    steps:
      - name: Checkout code
        uses: actions/checkout@v7

      - name: Set up Node.js
        uses: actions/setup-node@v6
        with:
          node-version: ${{ env.NODE_VERSION }}

      - name: Install pnpm
        uses: pnpm/action-setup@v6
        with:
          version: ${{ env.PNPM_VERSION }}

      - name: Get pnpm store directory
        shell: bash
        run: |
          echo "STORE_PATH=$(pnpm store path --silent)" >> $GITHUB_ENV

      - name: Setup pnpm cache
        uses: actions/cache@v6
        with:
          path: ${{ env.STORE_PATH }}
          key: ${{ runner.os }}-pnpm-store-${{ hashFiles('**/pnpm-lock.yaml') }}
          restore-keys: |
            ${{ runner.os }}-pnpm-store-

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Wait for services
        run: |
          echo "Waiting for PostgreSQL..."
          sudo apt-get update && sudo apt-get install -y postgresql-client
          until pg_isready -h localhost -p 5432 -U postgres; do
            echo "PostgreSQL is unavailable - sleeping"
            sleep 1
          done
          echo "PostgreSQL is ready!"

          echo "Waiting for ClickHouse..."
          until curl -f http://localhost:8123/ping; do
            echo "ClickHouse is unavailable - sleeping"
            sleep 1
          done
          echo "ClickHouse is ready!"

          echo "Waiting for Redis..."
          until redis-cli -h localhost -p 6379 ping | grep -q PONG; do
            echo "Redis is unavailable - sleeping"
            sleep 1
          done
          echo "Redis is ready!"

      - name: Generate secrets and create CI environment file
        run: |
          cat > backend/.env << 'ENVEOF'
          NODE_ENV=test
          PORT=3000
          LOG_LEVEL=info
          TZ=UTC

          POSTGRES_HOST=localhost
          POSTGRES_PORT=5432
          POSTGRES_DB=telemetryflow_test_db
          POSTGRES_USERNAME=postgres
          POSTGRES_PASSWORD=telemetryflow123

          CLICKHOUSE_HOST=localhost
          CLICKHOUSE_PORT=8123
          CLICKHOUSE_DB=telemetryflow_test_db
          CLICKHOUSE_USER=default
          CLICKHOUSE_PASSWORD=telemetryflow123

          REDIS_HOST=localhost
          REDIS_PORT=6379

          OTEL_ENABLED=false
          OTEL_SERVICE_NAME=telemetryflow-core-test

          LOGGER_TYPE=winston
          LOG_PRETTY_PRINT=false
          LOG_COLORIZE=false
          OTEL_LOGS_ENABLED=false
          LOG_FILE_ENABLED=false
          ENVEOF

          echo "" >> backend/.env
          echo "# Generated Secrets for CI" >> backend/.env
          node scripts/generate-secrets.js --env >> backend/.env

          echo "CI environment file created"

      - name: Run database migrations
        run: pnpm db:migrate

      - name: Run integration tests
        run: pnpm test || echo "Integration tests need Jest configuration updates"

  # ===========================================================================
  # Build Verification
  # ===========================================================================
  build:
    name: Build Verification
    runs-on: ubuntu-latest
    needs: lint
    if: always() && (needs.lint.result == 'success' || needs.lint.result == 'skipped')
    steps:
      - name: Checkout code
        uses: actions/checkout@v7

      - name: Set up Node.js
        uses: actions/setup-node@v6
        with:
          node-version: ${{ env.NODE_VERSION }}

      - name: Install pnpm
        uses: pnpm/action-setup@v6
        with:
          version: ${{ env.PNPM_VERSION }}

      - name: Get pnpm store directory
        shell: bash
        run: |
          echo "STORE_PATH=$(pnpm store path --silent)" >> $GITHUB_ENV

      - name: Setup pnpm cache
        uses: actions/cache@v6
        with:
          path: ${{ env.STORE_PATH }}
          key: ${{ runner.os }}-pnpm-store-${{ hashFiles('**/pnpm-lock.yaml') }}
          restore-keys: |
            ${{ runner.os }}-pnpm-store-

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Build monorepo (backend + frontend)
        run: pnpm build

      - name: Verify backend build artifacts
        run: |
          if [ ! -d "backend/dist" ]; then
            echo "Backend build directory not found"
            exit 1
          fi
          if [ ! -f "backend/dist/main.js" ]; then
            echo "Backend main.js not found"
            exit 1
          fi
          echo "Backend build verified"

      - name: Verify frontend build artifacts
        run: |
          if [ ! -d "frontend/dist" ]; then
            echo "Frontend build directory not found"
            exit 1
          fi
          if [ ! -f "frontend/dist/index.html" ]; then
            echo "Frontend index.html not found"
            exit 1
          fi
          echo "Frontend build verified"

  # ===========================================================================
  # Security Scan
  # ===========================================================================
  security:
    name: Security Scan
    runs-on: ubuntu-latest
    needs: lint
    if: always() && (needs.lint.result == 'success' || needs.lint.result == 'skipped')
    steps:
      - name: Checkout code
        uses: actions/checkout@v7

      - name: Set up Node.js
        uses: actions/setup-node@v6
        with:
          node-version: ${{ env.NODE_VERSION }}

      - name: Install pnpm
        uses: pnpm/action-setup@v6
        with:
          version: ${{ env.PNPM_VERSION }}

      - name: Get pnpm store directory
        shell: bash
        run: |
          echo "STORE_PATH=$(pnpm store path --silent)" >> $GITHUB_ENV

      - name: Setup pnpm cache
        uses: actions/cache@v6
        with:
          path: ${{ env.STORE_PATH }}
          key: ${{ runner.os }}-pnpm-store-${{ hashFiles('**/pnpm-lock.yaml') }}
          restore-keys: |
            ${{ runner.os }}-pnpm-store-

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Run pnpm audit
        run: pnpm audit --audit-level moderate || true

  # ===========================================================================
  # CI Summary
  # ===========================================================================
  summary:
    name: CI Summary
    runs-on: ubuntu-latest
    needs: [lint, test-unit, test-integration, build, security]
    if: always()
    steps:
      - name: Generate summary
        run: |
          echo "## ${{ env.PRODUCT_NAME }} - CI Results" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "| Job | Status |" >> $GITHUB_STEP_SUMMARY
          echo "|-----|--------|" >> $GITHUB_STEP_SUMMARY
          echo "| Lint & Code Quality | ${{ needs.lint.result }} |" >> $GITHUB_STEP_SUMMARY
          echo "| Unit Tests | ${{ needs.test-unit.result }} |" >> $GITHUB_STEP_SUMMARY
          echo "| Integration Tests | ${{ needs.test-integration.result }} |" >> $GITHUB_STEP_SUMMARY
          echo "| Build | ${{ needs.build.result }} |" >> $GITHUB_STEP_SUMMARY
          echo "| Security | ${{ needs.security.result }} |" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "**Commit:** ${{ github.sha }}" >> $GITHUB_STEP_SUMMARY
          echo "**Branch:** ${{ github.ref_name }}" >> $GITHUB_STEP_SUMMARY
          echo "**Triggered by:** ${{ github.event_name }}" >> $GITHUB_STEP_SUMMARY

      - name: Check overall status
        run: |
          if [[ "${{ needs.lint.result }}" == "failure" ]] || \
             [[ "${{ needs.test-unit.result }}" == "failure" ]] || \
             [[ "${{ needs.build.result }}" == "failure" ]]; then
            echo "CI failed - one or more required jobs failed"
            exit 1
          fi
          echo "CI passed successfully"