name: ci

# 브랜치·PR 검증. 예전 .github/workflows/ci.yml(GitHub 원격이 없어 한 번도 실행되지 않음)에서
# 자체 호스팅 linux-builder 러너로 돌릴 수 있는 잡만 옮겼다.
#
# 옮기지 않은 잡:
#   - test-matrix의 windows/macos 칸: macOS 러너가 없고, windows 러너는 태그 릴리스 전용으로 둔다.
#   - mobile-android APK 빌드 / mobile-emulator-e2e: Android SDK + KVM 에뮬레이터가 필요하다.
#     GitLab 미러(.gitlab-ci.yml mobile-android, mobile-emulator-e2e)가 계속 담당한다.
#
# 러너 관례: actions/checkout·setup-* 없이 github.token으로 직접 fetch 한다(다른 .forgejo 워크플로와 동일).
# Deno/.NET은 scripts/ci/bootstrap-linux-toolchain.sh 가 체크섬 검증 후 설치한다.
# git clean -fdx 로 지워지지 않도록 도구 캐시는 체크아웃 밖(CI_PROJECT_DIR)에 둔다.
#
# 필요한 시크릿: 없음 (github.token 만 사용)

on:
  push:
    branches:
      - main
      - develop
      - "feature/**"
      - "fix/**"
  pull_request:
    branches:
      - main
      - develop
  workflow_dispatch:

jobs:
  quality:
    name: 정본·보안·린트·타입·테스트
    runs-on: linux-builder
    steps:
      - name: checkout
        env: { CI_TOKEN: "${{ github.token }}" }
        run: |
          proto="${GITHUB_SERVER_URL%%://*}"; host="${GITHUB_SERVER_URL#*://}"
          url="$proto://actions:${CI_TOKEN}@${host%/}/${GITHUB_REPOSITORY}.git"
          [ -d .git ] || git init -q .
          git remote remove origin 2>/dev/null || true
          git remote add origin "$url"
          git fetch -q --depth 1 origin "$GITHUB_REF"
          git checkout -q -f FETCH_HEAD
          git clean -qfdx

      - name: 도구 버전
        run: |
          echo "node $(node --version) (.nvmrc $(cat .nvmrc)) / npm $(npm --version)"

      - name: 의존성 설치
        run: npm ci

      - name: 버전·계약 정본 대조
        run: |
          npm run version:check
          npm run contract:check
          npm run release:metadata:test

      - name: 하드코딩 자격증명 검사
        run: |
          npm run security:secrets:test
          npm run security:secrets

      - name: 모바일 릴리스 경계·설정 계약
        run: |
          npm run release:mobile:boundary:test
          npm run release:mobile:config:test
          npm run release:mobile:build-config:test
          npm run release:play:assets

      - name: 린트
        run: npm run lint

      - name: 타입 검사
        run: npm run typecheck

      - name: 테스트 (Vitest)
        run: npm test

  build-validation:
    name: 워크스페이스 빌드 검증
    needs: quality
    runs-on: linux-builder
    steps:
      - name: checkout
        env: { CI_TOKEN: "${{ github.token }}" }
        run: |
          proto="${GITHUB_SERVER_URL%%://*}"; host="${GITHUB_SERVER_URL#*://}"
          url="$proto://actions:${CI_TOKEN}@${host%/}/${GITHUB_REPOSITORY}.git"
          [ -d .git ] || git init -q .
          git remote remove origin 2>/dev/null || true
          git remote add origin "$url"
          git fetch -q --depth 1 origin "$GITHUB_REF"
          git checkout -q -f FETCH_HEAD
          git clean -qfdx

      - name: 의존성 설치
        run: npm ci

      - name: 데스크톱 번들 빌드 + 렌더러 번들 검증
        run: |
          npm run build --workspace=@d3ro/desktop
          node scripts/ci/verify-desktop-renderer-bundles.mjs

      - name: 어드민 빌드
        run: npm run build --workspace=@d3ro/admin

  mobile-quality:
    name: 모바일 린트·타입·Jest
    runs-on: linux-builder
    steps:
      - name: checkout
        env: { CI_TOKEN: "${{ github.token }}" }
        run: |
          proto="${GITHUB_SERVER_URL%%://*}"; host="${GITHUB_SERVER_URL#*://}"
          url="$proto://actions:${CI_TOKEN}@${host%/}/${GITHUB_REPOSITORY}.git"
          [ -d .git ] || git init -q .
          git remote remove origin 2>/dev/null || true
          git remote add origin "$url"
          git fetch -q --depth 1 origin "$GITHUB_REF"
          git checkout -q -f FETCH_HEAD
          git clean -qfdx

      - name: 의존성 설치
        run: |
          npm ci
          npm --prefix apps/mobile-rn ci --workspaces=false

      - name: 모바일 검사
        run: |
          npm --prefix apps/mobile-rn run lint
          npm --prefix apps/mobile-rn run typecheck
          npm --prefix apps/mobile-rn run test:ci

  edge-functions:
    name: Supabase Edge Functions + Cloudflare Worker
    runs-on: linux-builder
    steps:
      - name: checkout
        env: { CI_TOKEN: "${{ github.token }}" }
        run: |
          proto="${GITHUB_SERVER_URL%%://*}"; host="${GITHUB_SERVER_URL#*://}"
          url="$proto://actions:${CI_TOKEN}@${host%/}/${GITHUB_REPOSITORY}.git"
          [ -d .git ] || git init -q .
          git remote remove origin 2>/dev/null || true
          git remote add origin "$url"
          git fetch -q --depth 1 origin "$GITHUB_REF"
          git checkout -q -f FETCH_HEAD
          git clean -qfdx

      - name: Deno 2.8.1 설치 후 검사·테스트
        shell: bash
        run: |
          set -euo pipefail
          export CI_PROJECT_DIR="${XDG_CACHE_HOME:-$HOME/.cache}/d3ro-ci"
          . scripts/ci/bootstrap-linux-toolchain.sh deno
          for entrypoint in server/supabase/functions/*/index.ts; do
            deno check --config server/supabase/functions/deno.json "$entrypoint"
          done
          deno test --config server/supabase/functions/deno.json --allow-read --allow-env server/supabase/functions
          deno check --no-config server/cloudflare-worker/src/push-drain.ts
          deno test --no-config --allow-read server/cloudflare-worker/src/push-drain.test.ts

  api-server-tests:
    name: .NET API 서버 테스트
    runs-on: linux-builder
    steps:
      - name: checkout
        env: { CI_TOKEN: "${{ github.token }}" }
        run: |
          proto="${GITHUB_SERVER_URL%%://*}"; host="${GITHUB_SERVER_URL#*://}"
          url="$proto://actions:${CI_TOKEN}@${host%/}/${GITHUB_REPOSITORY}.git"
          [ -d .git ] || git init -q .
          git remote remove origin 2>/dev/null || true
          git remote add origin "$url"
          git fetch -q --depth 1 origin "$GITHUB_REF"
          git checkout -q -f FETCH_HEAD
          git clean -qfdx

      - name: .NET 10.0.302 설치 후 테스트
        shell: bash
        run: |
          set -euo pipefail
          export CI_PROJECT_DIR="${XDG_CACHE_HOME:-$HOME/.cache}/d3ro-ci"
          . scripts/ci/bootstrap-linux-toolchain.sh dotnet
          dotnet restore apps/api-server.Tests/D3ROVoice.Api.Tests.csproj
          dotnet test apps/api-server.Tests/D3ROVoice.Api.Tests.csproj --configuration Release --no-restore -p:StaticWebAssetsEnabled=false