name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

jobs:
  # Cheap, and guards a file no maintainer runs. The published deployment file is
  # generated from docker-compose.yml; when they were maintained separately the
  # published one silently lost the NetFlow port, every poller tunable and the
  # Redis memory ceiling, and it took an outside report to notice (#121).
  compose:
    name: Deployment files in sync
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - uses: actions/setup-node@v7
        with:
          node-version: '20'
      - name: Check docker-compose.ghcr.yml is current
        run: node scripts/generate-ghcr-compose.mjs --check

  frontend:
    name: Frontend — Lint, Type-check & Build
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: frontend

    steps:
      - uses: actions/checkout@v7

      - name: Set up Node.js
        uses: actions/setup-node@v7
        with:
          node-version: '20'
          cache: 'npm'
          cache-dependency-path: frontend/package-lock.json

      - name: Install dependencies
        run: npm ci

      - name: Lint
        run: npm run lint

      - name: Type-check
        run: npx tsc --noEmit

      - name: Build
        run: npm run build

  backend:
    name: Backend — Lint, Type-check & Build
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: backend

    steps:
      - uses: actions/checkout@v7

      - name: Set up Node.js
        uses: actions/setup-node@v7
        with:
          node-version: '20'
          cache: 'npm'
          cache-dependency-path: backend/package-lock.json

      - name: Install dependencies
        run: npm ci

      - name: Lint
        run: npm run lint

      - name: Type-check
        run: npx tsc --noEmit

      - name: Build
        run: npm run build

  audit:
    name: Security Audit
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v7

      - name: Set up Node.js
        uses: actions/setup-node@v7
        with:
          node-version: '20'

      # Audit production dependencies only (dev/build tooling isn't in the shipped
      # image: the backend installs with --omit=dev and the frontend ships a static
      # build). audit-ci lets us fail on high+ prod advisories while allowlisting
      # ones that don't apply.
      #
      # Allowlisted:
      #   GHSA-qwww-vcr4-c8h2 — React Router "RSC Mode CSRF Bypass". This is a
      #   client-side SPA (BrowserRouter); we don't use RSC mode, and there is no
      #   forward-compatible fix for react-router-dom 7.x (only a downgrade).
      - name: Audit frontend dependencies
        run: npx --yes audit-ci@^7 --high --skip-dev --allowlist GHSA-qwww-vcr4-c8h2
        working-directory: frontend

      - name: Audit backend dependencies
        run: npx --yes audit-ci@^7 --high --skip-dev
        working-directory: backend