ai_agent/.github/workflows/ci.yml

name: CI

on:
  push:
    branches: [main, master]
  pull_request:
    branches: [main, master]

jobs:
  lint:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Install uv
        uses: astral-sh/setup-uv@v4
        with:
          version: "latest"

      - name: Set up Python
        run: uv python install 3.13

      - name: Install dependencies
        run: uv sync --directory backend --dev

      - name: Run ruff check
        run: uv run --directory backend ruff check app tests cli

      - name: Run ruff format check
        run: uv run --directory backend ruff format app tests cli --check

      - name: Run ty
        run: uv run --directory backend ty check

  test:
    runs-on: ubuntu-latest
    services:
      postgres:
        image: postgres:16-alpine
        env:
          POSTGRES_USER: postgres
          POSTGRES_PASSWORD: postgres
          POSTGRES_DB: test_db
        ports:
          - 5432:5432
        options: >-
          --health-cmd pg_isready
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5
      redis:
        image: redis:7-alpine
        ports:
          - 6379:6379
        options: >-
          --health-cmd "redis-cli ping"
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5

    steps:
      - uses: actions/checkout@v4

      - name: Install uv
        uses: astral-sh/setup-uv@v4
        with:
          version: "latest"

      - name: Set up Python
        run: uv python install 3.13

      - name: Install dependencies
        run: uv sync --directory backend --dev

      - name: Run tests
        run: uv run --directory backend pytest tests/ -v --cov=app --cov-report=xml
        env:
          POSTGRES_HOST: localhost
          POSTGRES_PORT: 5432
          POSTGRES_USER: postgres
          POSTGRES_PASSWORD: postgres
          POSTGRES_DB: test_db
          REDIS_HOST: localhost
          REDIS_PORT: 6379

      - name: Upload coverage to Codecov
        uses: codecov/codecov-action@v4
        with:
          files: ./backend/coverage.xml
          fail_ci_if_error: false

  test-frontend:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Setup Bun
        uses: oven-sh/setup-bun@v2

      - name: Install dependencies
        run: bun install --frozen-lockfile
        working-directory: frontend

      - name: Run lint
        run: bun run lint
        working-directory: frontend

      - name: Run type check
        run: bun run type-check
        working-directory: frontend

      - name: Run unit tests with coverage
        run: bun run test:coverage
        working-directory: frontend

      - name: Install Playwright browsers
        run: bunx playwright install --with-deps
        working-directory: frontend

      - name: Run E2E tests
        run: bun run test:e2e
        working-directory: frontend
        env:
          CI: true

  security:
    name: Security Scan
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Install uv
        uses: astral-sh/setup-uv@v4
        with:
          version: "latest"

      - name: Set up Python
        run: uv python install 3.13

      - name: Install dependencies
        run: uv sync --directory backend --dev

      - name: Install pip-audit
        run: uv pip install pip-audit

      - name: Run pip-audit
        run: uv run pip-audit --require-hashes=false --progress-spinner=off
        working-directory: backend

  docker:
    runs-on: ubuntu-latest
    needs: [lint, test]
    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
    steps:
      - uses: actions/checkout@v4

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Build Docker image
        uses: docker/build-push-action@v6
        with:
          context: ./backend
          push: false
          load: true
          tags: ai_agent:latest
          cache-from: type=gha
          cache-to: type=gha,mode=max

      - name: Run Trivy vulnerability scanner
        uses: aquasecurity/trivy-action@v0.36.0
        with:
          image-ref: ai_agent:latest
          format: table
          exit-code: 0
          severity: CRITICAL,HIGH