ci.yml

name: CI/CD

on:
  push:
    branches: [ main, develop, 'codex/**' ]
  pull_request:
    branches: [ main ]
  release:
    types: [ published ]

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

env:
  NODE_VERSION: '22.20.0'
  BUN_VERSION: '1.3.0'

jobs:
  test:
    name: Test
    runs-on: ubuntu-latest
    
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        
      - name: Setup Bun
        uses: oven-sh/setup-bun@v2
        with:
          bun-version: ${{ env.BUN_VERSION }}
          
      - name: Setup Bun cache
        uses: actions/cache@v4
        with:
          path: ~/.bun/install/cache
          key: ${{ runner.os }}-bun-${{ hashFiles('**/bun.lockb') }}
          restore-keys: |
            ${{ runner.os }}-bun-
            
      - name: Install dependencies
        run: bun install --frozen-lockfile
        
      - name: Install Chrome for Puppeteer
        if: runner.os == 'Linux'
        run: |
          sudo apt-get update
          sudo apt-get install -y chromium-browser
        
      - name: Configure Puppeteer
        if: runner.os == 'Linux'
        run: echo "PUPPETEER_EXECUTABLE_PATH=/usr/bin/chromium-browser" >> $GITHUB_ENV
        
      - name: Type check
        run: bun run typecheck
        
      - name: Build packages
        run: bun run build
        
      - name: Run tests
        run: bun run test:coverage
        
      - name: Upload coverage reports
        uses: codecov/codecov-action@v5
        with:
          files: ./coverage/lcov.info
          flags: unittests
          name: codecov-umbrella
          fail_ci_if_error: false

  lint:
    name: Lint & Format
    runs-on: ubuntu-latest
    
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        
      - name: Setup Bun
        uses: oven-sh/setup-bun@v2
        with:
          bun-version: ${{ env.BUN_VERSION }}
          
      - name: Setup Bun cache
        uses: actions/cache@v4
        with:
          path: ~/.bun/install/cache
          key: ${{ runner.os }}-bun-${{ hashFiles('**/bun.lockb') }}
          restore-keys: |
            ${{ runner.os }}-bun-
            
      - name: Install dependencies
        run: bun install --frozen-lockfile
        
      - name: Check formatting
        run: bun run format:check
        continue-on-error: true
        
      - name: Run linter
        run: bun run lint:check

  cli-integration:
    name: CLI Integration Tests
    runs-on: ubuntu-latest
    
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        
      - name: Setup Bun
        uses: oven-sh/setup-bun@v2
        with:
          bun-version: ${{ env.BUN_VERSION }}
          
      - name: Install dependencies
        run: bun install --frozen-lockfile
        
      - name: Build packages
        run: bun run build
        
      - name: Test CLI - Parse
        run: node cli/dist/osf.js parse examples/v0.5_spec_example.osf
        
      - name: Test CLI - Lint
        run: node cli/dist/osf.js lint examples/v0.5_spec_example.osf
        
      - name: Test CLI - Format
        run: node cli/dist/osf.js format examples/v0.5_spec_example.osf
        
      - name: Test CLI - Render HTML
        run: node cli/dist/osf.js render examples/v0.5_spec_example.osf --format html
        
      - name: Test CLI - Export Markdown
        run: node cli/dist/osf.js export examples/v0.5_spec_example.osf --target md
        
      - name: Test CLI - Export JSON
        run: node cli/dist/osf.js export examples/v0.5_spec_example.osf --target json
        
      - name: Test CLI - Help
        run: node cli/dist/osf.js --help
        
      - name: Test CLI - Version
        run: node cli/dist/osf.js --version

  security:
    name: Security Scan
    runs-on: ubuntu-latest
    
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        
      - name: Setup Bun
        uses: oven-sh/setup-bun@v2
        with:
          bun-version: ${{ env.BUN_VERSION }}
          
      - name: Install dependencies
        run: bun install --frozen-lockfile
        
      - name: Run security audit
        run: npm audit
        continue-on-error: true
        
      - name: Run Semgrep security scan
        uses: returntocorp/semgrep-action@v1
        with:
          config: auto
        continue-on-error: true

  compatibility:
    name: Node.js Compatibility
    runs-on: ${{ matrix.os }}
    
    strategy:
      matrix:
        os: [ubuntu-latest, windows-latest, macos-latest]
        node-version: ['18.x', '20.x', '22.x']
        
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        
      - name: Setup Bun
        uses: oven-sh/setup-bun@v2
        with:
          bun-version: ${{ env.BUN_VERSION }}
          
      - name: Install dependencies
        run: bun install --frozen-lockfile
        
      - name: Install Puppeteer Chrome browser
        if: runner.os == 'Linux'
        run: |
          sudo apt-get update
          sudo apt-get install -y chromium-browser
        
      - name: Configure Puppeteer
        if: runner.os == 'Linux'
        run: echo "PUPPETEER_EXECUTABLE_PATH=/usr/bin/chromium-browser" >> $GITHUB_ENV
        
      - name: Build packages
        run: bun run build
        
      - name: Run tests
        run: bun run test

  publish:
    name: Publish to NPM
    runs-on: ubuntu-latest
    needs: [test, lint, cli-integration, security]
    if: github.event_name == 'release' && github.event.action == 'published'
    
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        
      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION }}
          registry-url: 'https://registry.npmjs.org'
          
      - name: Setup Bun
        uses: oven-sh/setup-bun@v2
        with:
          bun-version: ${{ env.BUN_VERSION }}
          
      - name: Install dependencies
        run: bun install --frozen-lockfile
        
      - name: Build packages
        run: bun run build
        
      - name: Verify package versions
        run: |
          echo "Checking package versions..."
          PARSER_VERSION=$(node -p "require('./parser/package.json').version")
          CLI_VERSION=$(node -p "require('./cli/package.json').version")
          echo "Parser version: $PARSER_VERSION"
          echo "CLI version: $CLI_VERSION"
          echo "Release tag: ${{ github.event.release.tag_name }}"
        
      - name: Run final tests
        run: bun run test
        
      - name: Publish Parser to NPM
        run: |
          cd parser
          echo "Publishing omniscript-parser..."
          npm publish --access public --dry-run
          npm publish --access public
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
          
      - name: Publish CLI to NPM
        run: |
          cd cli
          echo "Publishing omniscript-cli..."
          npm publish --access public --dry-run
          npm publish --access public
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
          
      - name: Verify published packages
        run: |
          echo "Verifying published packages..."
          sleep 30  # Wait for npm registry to update
          npm info omniscript-parser
          npm info omniscript-cli

  release-assets:
    name: Build Release Assets
    runs-on: ubuntu-latest
    needs: [test, lint, cli-integration]
    if: github.event_name == 'release' && github.event.action == 'published'
    
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        
      - name: Setup Bun
        uses: oven-sh/setup-bun@v2
        with:
          bun-version: ${{ env.BUN_VERSION }}
          
      - name: Install dependencies
        run: bun install --frozen-lockfile
        
      - name: Build packages
        run: bun run build
        
      - name: Create CLI bundle
        run: |
          mkdir -p release/osf-cli
          cp -r cli/dist release/osf-cli/
          cp cli/package.json release/osf-cli/
          cp README.md release/osf-cli/
          cp LICENSE release/osf-cli/
          
      - name: Create archives
        run: |
          cd release
          tar -czf osf-cli-${{ github.event.release.tag_name }}.tar.gz osf-cli/
          zip -r osf-cli-${{ github.event.release.tag_name }}.zip osf-cli/
          
      - name: Upload release assets
        uses: actions/upload-release-asset@v1
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        with:
          upload_url: ${{ github.event.release.upload_url }}
          asset_path: ./release/osf-cli-${{ github.event.release.tag_name }}.tar.gz
          asset_name: osf-cli-${{ github.event.release.tag_name }}.tar.gz
          asset_content_type: application/gzip
          
      - name: Upload release assets (zip)
        uses: actions/upload-release-asset@v1
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        with:
          upload_url: ${{ github.event.release.upload_url }}
          asset_path: ./release/osf-cli-${{ github.event.release.tag_name }}.zip
          asset_name: osf-cli-${{ github.event.release.tag_name }}.zip
          asset_content_type: application/zip