ci.yml

name: Kagibi CI

on:
  push:
    branches: [ "main", "master" ]
  pull_request:
    branches: [ "main", "master" ]

jobs:
  # Job pour le Backend (Go)
  backend-test:
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: ./backend
    env:
      GOTOOLCHAIN: local

    services:
      postgres:
        image: postgres:16
        env:
          POSTGRES_DB: kagibi_test
          POSTGRES_USER: test
          POSTGRES_PASSWORD: testpassword
        ports:
          - 5432:5432
        options: >-
          --health-cmd pg_isready
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5

      redis:
        image: redis:7-alpine
        ports:
          - 6379:6379
        options: >-
          --health-cmd "redis-cli ping"
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5

    steps:
    - uses: actions/checkout@v3

    - name: Set up Go
      uses: actions/setup-go@v4
      with:
        go-version: '1.25.4'
        cache-dependency-path: backend/go.sum

    - name: Install dependencies
      run: go mod download

    - name: Verify Code Formatting
      run: |
        if [ -n "$(gofmt -l .)" ]; then
          echo "Code is not formatted. Please run 'go fmt ./...'"
          exit 1
        fi

    - name: Run Unit Tests
      # Exécute les tests unitaires (Middleware, Utils, Handlers, Models)
      run: go test -v ./utils/... ./middleware/... ./handlers/auth/... ./handlers/folders/... ./pkg/...

    - name: Run Tests with Coverage
      run: |
        go test -v ./utils/... -coverprofile coverage.out -covermode atomic
        go test -v ./middleware/... -coverprofile coverage_middleware.out -covermode atomic

    - name: Upload Coverage
      uses: codecov/codecov-action@v3
      with:
        file: ./backend/coverage.out
        flags: backend
      continue-on-error: true

    - name: Build Backend
      # Vérifie que le code compile correctement
      run: go build -v .

  # Job pour les tests d'intégration Backend
  backend-integration:
    runs-on: ubuntu-latest
    needs: backend-test

    services:
      postgres:
        image: postgres:16
        env:
          POSTGRES_DB: kagibi_test
          POSTGRES_USER: test
          POSTGRES_PASSWORD: testpassword
        ports:
          - 5432:5432
        options: >-
          --health-cmd pg_isready
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5

      redis:
        image: redis:7-alpine
        ports:
          - 6379:6379
        options: >-
          --health-cmd "redis-cli ping"
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5

    steps:
    - uses: actions/checkout@v3

    - name: Set up Go
      uses: actions/setup-go@v4
      with:
        go-version: '1.25.4'

    - name: Run Integration Tests
      working-directory: ./backend
      env:
        TEST_DB_HOST: localhost
        TEST_DB_PORT: 5432
        TEST_DB_USER: test
        TEST_DB_PASSWORD: testpassword
        TEST_DB_NAME: kagibi_test
        TEST_REDIS_HOST: localhost
        TEST_REDIS_PORT: 6379
      run: |
        go mod download
        go test -v ./... -tags=integration -timeout 10m

  # Job pour le Frontend (Vue.js)
  frontend-test:
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: ./frontend

    steps:
    - uses: actions/checkout@v3

    - name: Set up Node.js
      uses: actions/setup-node@v3
      with:
        node-version: '22'
        cache: 'npm'
        cache-dependency-path: frontend/package-lock.json

    - name: Install dependencies
      run: npm ci

    - name: Run Linter
      run: npm run lint --if-present || echo "No linter configured"

    - name: Run Unit Tests
      run: npm run test -- --run

    - name: Run Tests with Coverage
      run: npm run test -- --run --coverage || npm run test -- --run

    - name: Upload Coverage
      if: success()
      uses: codecov/codecov-action@v3
      with:
        file: ./frontend/coverage/coverage-final.json
        flags: frontend
      continue-on-error: true

    - name: Build Frontend
      run: npm run build

    - name: Check Build Size
      run: |
        echo "Build size:"
        du -sh dist/
        
  # Job pour les tests E2E
  e2e-tests:
    runs-on: ubuntu-latest
    needs: [backend-test, frontend-test]

    services:
      postgres:
        image: postgres:16
        env:
          POSTGRES_DB: kagibi_test
          POSTGRES_USER: test
          POSTGRES_PASSWORD: testpassword
        ports:
          - 5432:5432
        options: >-
          --health-cmd pg_isready
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5

      redis:
        image: redis:7-alpine
        ports:
          - 6379:6379

    steps:
    - uses: actions/checkout@v3

    - name: Set up Go
      uses: actions/setup-go@v4
      with:
        go-version: '1.25.4'

    - name: Set up Node.js
      uses: actions/setup-node@v3
      with:
        node-version: '22'

    - name: Install Backend Dependencies
      working-directory: ./backend
      run: go mod download

    - name: Install Frontend Dependencies
      working-directory: ./frontend
      run: npm ci

    - name: Build Frontend
      working-directory: ./frontend
      run: npm run build

    - name: Start Backend Server
      working-directory: ./backend
      env:
        DATABASE_URL: postgres://test:testpassword@localhost:5432/kagibi_test
        REDIS_URL: redis://localhost:6379
        JWT_SECRET: test-secret-key-for-ci
        EMAIL_ENCRYPTION_KEY: "0000000000000000000000000000000000000000000000000000000000000000"
        PORT: 8080
      run: |
        go build -o server .
        ./server &
        echo $! > server.pid
        sleep 5

    - name: Health Check
      run: |
        curl -f http://localhost:8080/health || exit 1

    - name: Stop Backend Server
      if: always()
      working-directory: ./backend
      run: |
        if [ -f server.pid ]; then
          kill $(cat server.pid) || true
        fi

  # Job pour l'audit de sécurité
  security-audit:
    runs-on: ubuntu-latest

    steps:
    - uses: actions/checkout@v3

    - name: Set up Go
      uses: actions/setup-go@v4
      with:
        go-version: '1.25.4'

    - name: Set up Node.js
      uses: actions/setup-node@v3
      with:
        node-version: '22'

    - name: Run Go Security Scan (gosec)
      working-directory: ./backend
      run: |
        go install github.com/securego/gosec/v2/cmd/gosec@latest
        gosec -fmt=json -out=gosec-report.json ./... || true

    - name: Run npm audit
      working-directory: ./frontend
      run: |
        npm audit --audit-level=moderate || echo "npm audit found vulnerabilities"

    - name: Check for hardcoded secrets
      run: |
        # Rechercher des mots de passe/secrets en dur (pas les variables nommées "password")
        echo "🔍 Checking for hardcoded credentials..."
        
        # Pattern pour trouver des secrets en dur (éviter les faux positifs)
        # Chercher: password = "valeur", PASSWORD="valeur", etc. mais pas password = ref(''), type="password", etc.
        if grep -rE '(password|secret|api_key|private_key|token)\s*[=:]\s*["\047][a-zA-Z0-9!@#$%^&*()_+\-=\[\]{};:,.<>?/]{8,}["\047]' \
           --include="*.go" --include="*.js" --include="*.vue" --include="*.ts" . | \
           grep -v "test" | \
           grep -v "example" | \
           grep -v "_test.go" | \
           grep -v ".spec.js" | \
           grep -v "type=\"password\"" | \
           grep -v "type='password'" | \
           grep -v "placeholder=" | \
           grep -v "ref('')" | \
           grep -v "ref(\"\")" | \
           grep -v "binding:" | \
           grep -v "json:" | \
           grep -v "// " | \
           grep -v "github.com" | \
           grep -v "sslmode=disable"; then
          echo "⚠️ Potential hardcoded credentials found!"
          exit 1
        fi
        
        echo "✅ No hardcoded credentials detected"

    - name: Check for exposed API keys
      run: |
        echo "🔍 Checking for exposed API keys..."
        
        # Chercher des clés API exposées (longues chaînes alphanumériques)
        if grep -rE '(api_key|apikey|access_key|secret_key)\s*[=:]\s*["\047][a-zA-Z0-9]{32,}["\047]' \
           --include="*.go" --include="*.js" --include="*.vue" --include="*.ts" . | \
           grep -v "test" | \
           grep -v "example" | \
           grep -v "binding:" | \
           grep -v "json:" | \
           grep -v "// "; then
          echo "⚠️ Potential exposed API keys found!"
          exit 1
        fi
        
        echo "✅ No exposed API keys detected"

  # Job pour vérifier la qualité du code
  code-quality:
    runs-on: ubuntu-latest

    steps:
    - uses: actions/checkout@v3

    - name: Set up Go
      uses: actions/setup-go@v4
      with:
        go-version: '1.25.4'

    - name: Install dependencies
      working-directory: ./backend
      run: go mod download

    - name: Run go vet
      working-directory: ./backend
      run: |
        # Vérifier les sous-packages testés uniquement
        go vet ./handlers/auth/... ./handlers/folders/... ./middleware/... ./pkg/... ./utils/...

    - name: Run staticcheck
      working-directory: ./backend
      run: |
        go install honnef.co/go/tools/cmd/staticcheck@latest
        staticcheck ./handlers/auth/... ./handlers/folders/... ./middleware/... ./pkg/... ./utils/... || echo "⚠️ Staticcheck warnings found (non-blocking)"

    - name: Check for TODO/FIXME comments
      run: |
        echo "📝 Checking for TODO/FIXME comments..."
        grep -rn "TODO\|FIXME" --include="*.go" --include="*.js" --include="*.vue" . || echo "No TODO/FIXME found"