telecom-platform/.github/workflows/ci.yml

name: CI

on:
  push:
    branches: [main, develop]
  pull_request:
    branches: [main, develop]

jobs:
  api-server-test:
    name: API Server Tests
    runs-on: ubuntu-latest
    services:
      postgres:
        image: postgres:15
        env:
          POSTGRES_USER: test_user
          POSTGRES_PASSWORD: test_password
          POSTGRES_DB: test_db
        ports:
          - 5432:5432
        options: >-
          --health-cmd pg_isready
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5

    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Setup Go
        uses: actions/setup-go@v5
        with:
          go-version: '1.23'
          cache: true
          cache-dependency-path: apps/api-server/go.sum

      - name: Install dependencies
        working-directory: apps/api-server
        run: go mod download

      - name: Run linter
        working-directory: apps/api-server
        run: |
          go install github.com/golangci/golangci-lint/cmd/golangci-lint@latest
          golangci-lint run --timeout 5m || true

      - name: Run tests
        working-directory: apps/api-server
        env:
          DB_HOST: localhost
          DB_PORT: 5432
          DB_USER: test_user
          DB_PASSWORD: test_password
          DB_NAME: test_db
        run: |
          go test -v -race -coverprofile=coverage.out ./...

      - name: Upload coverage
        uses: codecov/codecov-action@v4
        with:
          files: apps/api-server/coverage.out
          flags: api-server
        continue-on-error: true

      - name: Build API server
        working-directory: apps/api-server
        run: go build -o bin/api-server ./cmd/server.go

  web-dashboard-test:
    name: Web Dashboard Tests
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '20'

      - name: Setup pnpm
        uses: pnpm/action-setup@v4
        with:
          version: 9

      - name: Get pnpm store directory
        id: pnpm-cache
        shell: bash
        run: |
          echo "STORE_PATH=$(pnpm store path)" >> $GITHUB_OUTPUT

      - name: Setup pnpm cache
        uses: actions/cache@v4
        with:
          path: ${{ steps.pnpm-cache.outputs.STORE_PATH }}
          key: ${{ runner.os }}-pnpm-store-${{ hashFiles('**/pnpm-lock.yaml') }}
          restore-keys: |
            ${{ runner.os }}-pnpm-store-

      - name: Install dependencies
        working-directory: apps/web-dashboard
        run: pnpm install --frozen-lockfile

      - name: Run linter
        working-directory: apps/web-dashboard
        run: pnpm run lint || true

      - name: Run type check
        working-directory: apps/web-dashboard
        run: npx tsc --noEmit || true

      - name: Build
        working-directory: apps/web-dashboard
        run: pnpm run build

  docker-build:
    name: Docker Build
    runs-on: ubuntu-latest
    needs: [api-server-test, web-dashboard-test]
    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Build API server image
        uses: docker/build-push-action@v5
        with:
          context: ./apps/api-server
          push: false
          tags: telecom-platform/api-server:latest
          cache-from: type=gha
          cache-to: type=gha,mode=max

      - name: Build web dashboard image
        uses: docker/build-push-action@v5
        with:
          context: ./apps/web-dashboard
          push: false
          tags: telecom-platform/web-dashboard:latest
          cache-from: type=gha
          cache-to: type=gha,mode=max

  security-scan:
    name: Security Scan
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Run Trivy vulnerability scanner
        uses: aquasecurity/trivy-action@master
        with:
          scan-type: 'fs'
          scan-ref: '.'
          format: 'sarif'
          output: 'trivy-results.sarif'
        continue-on-error: true

      - name: Upload Trivy scan results
        uses: github/codeql-action/upload-sarif@v3
        if: always()
        with:
          sarif_file: 'trivy-results.sarif'
        continue-on-error: true