# QA-001: main/test/dev 合并门禁 — go vet、短测、迁移校验、前端测试
name: CI

on:
  push:
    branches: [dev, test, main]
  pull_request:
    branches: [dev, test, main]

jobs:
  go-vet:
    runs-on: ubuntu-latest
    services:
      postgres:
        image: pgvector/pgvector:pg16
        env:
          POSTGRES_USER: app
          POSTGRES_PASSWORD: ci_secret_db_pass
          POSTGRES_DB: agent_system_ci
        options: >-
          --health-cmd "pg_isready -U app -d agent_system_ci"
          --health-interval 5s
          --health-timeout 5s
          --health-retries 20
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-go@v5
        with:
          go-version: "1.27.1"
          cache-dependency-path: go.sum

      - name: go vet
        run: go vet ./...

      - name: migration gate
        env:
          TEST_DATABASE_URL: postgres://app:ci_secret_db_pass@postgres:5432/agent_system_ci?sslmode=disable
        run: go test -count=1 -run TestMigrationGate ./internal/db/...


      - name: arch-check (block cleared kinds)
        run: ./scripts/arch-check.sh --mode block

      - name: go test (short, required since 2026-09-29)
        env:
          TEST_DATABASE_URL: postgres://app:ci_secret_db_pass@postgres:5432/agent_system_ci?sslmode=disable
        run: go test -short -timeout 20m ./...

      - name: secrets scan (tracked files)
        run: |
          bad=$(git ls-files | grep -Ei '(^|/)(\.env|.*\.(pem|key|p12|sqlite|sqlite3))$' || true)
          if [ -n "$bad" ]; then echo "tracked secret-like files:"; echo "$bad"; exit 1; fi


  backup-restore-drill:
    runs-on: ubuntu-latest
    services:
      postgres:
        image: pgvector/pgvector:pg16
        env:
          POSTGRES_USER: app
          POSTGRES_PASSWORD: ci_secret_db_pass
          POSTGRES_DB: agent_system_ci
        options: >-
          --health-cmd "pg_isready -U app -d agent_system_ci"
          --health-interval 5s
          --health-timeout 5s
          --health-retries 20
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-go@v5
        with:
          go-version: "1.27.1"
          cache-dependency-path: go.sum

      - name: install postgresql client
        run: sudo apt-get update && sudo apt-get install -y postgresql-client

      - name: migrate and seed schema
        env:
          TEST_DATABASE_URL: postgres://app:ci_secret_db_pass@postgres:5432/agent_system_ci?sslmode=disable
        run: go test -count=1 -run TestMigrationGate ./internal/db/...

      - name: pg_dump backup
        env:
          PGPASSWORD: ci_secret_db_pass
        run: |
          pg_dump -h postgres -U app -d agent_system_ci -Fc -f /tmp/system_ci.dump
          pg_restore --list /tmp/system_ci.dump >/dev/null

      - name: restore to fresh database and re-run migrations
        env:
          PGPASSWORD: ci_secret_db_pass
          TEST_DATABASE_URL: postgres://app:ci_secret_db_pass@postgres:5432/agent_system_ci_restore?sslmode=disable
        run: |
          psql -h postgres -U app -d postgres -c "DROP DATABASE IF EXISTS agent_system_ci_restore;"
          psql -h postgres -U app -d postgres -c "CREATE DATABASE agent_system_ci_restore;"
          pg_restore -h postgres -U app -d agent_system_ci_restore --no-owner --no-privileges /tmp/system_ci.dump
          go test -count=1 -run 'TestMigrationGate|TestPhase5_BackupRestoreMigration_PG' ./internal/db/... ./internal/server/...

  web:
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: web
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-node@v4
        with:
          node-version: "22"
          cache: npm
          cache-dependency-path: web/package-lock.json

      - name: npm ci
        run: npm ci

      - name: npm test
        run: npm test

      - name: npm build
        run: npm run build