ci.yml

name: CI (build & test)

# AR-04 — automated quality gates for the .NET backend and the React/Vite frontend.
# The backend job stands up a PostgreSQL service so the WebApplicationFactory integration
# tests (LV-10) actually run instead of skipping, closing the gap that let the LV-04..07
# bug class reach only manual testing.

on:
  push:
    branches: [main, develop]
  pull_request:
    branches: [main, develop]

permissions:
  contents: read

concurrency:
  group: ci-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  backend:
    name: Backend (build + test)
    runs-on: ubuntu-latest

    services:
      postgres:
        image: postgres:16
        env:
          POSTGRES_DB: evolith_tracker
          POSTGRES_USER: evolith
          POSTGRES_PASSWORD: localdev
        ports:
          - 5432:5432
        options: >-
          --health-cmd "pg_isready -U evolith -d evolith_tracker"
          --health-interval 10s
          --health-timeout 5s
          --health-retries 10

    env:
      # Matches the default connection the app + *LiveTests / integration tests expect,
      # so the DB-availability probe passes and the integration tests run for real.
      EVOLITH_TRACKER_DB: "Host=localhost;Port=5432;Database=evolith_tracker;Username=evolith;Password=localdev"
      ConnectionStrings__DefaultConnection: "Host=localhost;Port=5432;Database=evolith_tracker;Username=evolith;Password=localdev"
      # TenantProjectionDbContext (DS-07) reads MasterDataDb; unset it defaults to
      # localhost/user "postgres" and auth fails. Share the CI Postgres like local.
      ConnectionStrings__MasterDataDb: "Host=localhost;Port=5432;Database=evolith_tracker;Username=evolith;Password=localdev"
      DOTNET_NOLOGO: "true"
      DOTNET_CLI_TELEMETRY_OPTOUT: "true"

    defaults:
      run:
        working-directory: src/apps/tracker-api

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup .NET
        uses: actions/setup-dotnet@v4
        with:
          dotnet-version: "10.0.x"

      - name: Restore
        run: dotnet restore Tracker.sln

      - name: Build (0 warnings enforced)
        run: dotnet build Tracker.sln --no-restore -c Release -warnaserror

      - name: Apply EF Core migrations
        run: |
          dotnet tool install --global dotnet-ef
          export PATH="$PATH:$HOME/.dotnet/tools"
          # Two DbContexts exist (DS-07 added TenantProjectionDbContext for the
          # MasterData tenant-projection schema). `database update` is ambiguous
          # without --context. Pass --connection explicitly so both apply against
          # the CI Postgres regardless of design-time config resolution (the
          # TenantProjection context otherwise falls back to localhost/postgres).
          CI_CONN="Host=localhost;Port=5432;Database=evolith_tracker;Username=evolith;Password=localdev"
          for ctx in TrackerDbContext TenantProjectionDbContext; do
            dotnet ef database update \
              --context "$ctx" \
              --connection "$CI_CONN" \
              --project Tracker.Infrastructure \
              --startup-project Tracker.Presentation \
              --configuration Release
          done

      - name: Test
        run: dotnet test Tracker.sln --no-build -c Release --logger "trx;LogFileName=test-results.trx"

      - name: Smoke — la aplicacion arranca LIMPIA contra Postgres
        # Anadido tras la regresion del 2026-07-19: el filtro global por tenant de CD-27
        # rompio el despachador del outbox de intake y estuvo horas en `main` sin que nada lo
        # viera. CI aplicaba migraciones pero NUNCA ARRANCABA LA APLICACION, y el SQL crudo
        # no se interpreta hasta que hay un motor real detras.
        #
        # El script no se conforma con que responda: durante todo aquel fallo `/health` daba
        # 200 mientras el despachador reventaba en cada ciclo. Observa el LOG, y observa el
        # tiempo suficiente para que los procesos de fondo completen varias vueltas.
        working-directory: .
        env:
          SMOKE_CONFIG: Release
          SMOKE_OBSERVE_SECONDS: "25"
        run: bash .harness/scripts/smoke-app.sh

      - name: Upload test results
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: backend-test-results
          path: src/apps/tracker-api/**/TestResults/*.trx
          if-no-files-found: ignore

  frontend:
    name: Frontend (lint + typecheck + build)
    runs-on: ubuntu-latest

    defaults:
      run:
        working-directory: src

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: "20"
          cache: "npm"
          cache-dependency-path: src/package-lock.json

      - name: Install dependencies
        run: npm ci

      - name: Lint
        run: npx nx lint tracker-web

      - name: Typecheck
        run: npx nx typecheck tracker-web

      - name: Build
        run: npx nx build tracker-web


  gap-registry:
    name: Gap registry coherence
    runs-on: ubuntu-latest

    # Deliberadamente SIN filtro `paths`: corre en todo PR. El desorden que vigila no lo
    # introduce quien edita los ficheros del registro, sino quien CIERRA un item y actualiza
    # la fila del board olvidando la ficha — un cambio que casi siempre viene acompanado de
    # codigo. Filtrar por rutas dejaria fuera justo el caso que motivo este guardian.
    #
    # Falla el build a proposito. Un registro de gobernanza que miente sobre que esta hecho
    # dirige mal las decisiones de la semana siguiente, y un guardian que solo avisa se
    # ignora. El job tarda segundos y no necesita ni base de datos ni SDK.
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: "3.12"

      - name: Board y catalogo deben contar lo mismo
        run: python3 .harness/scripts/check-gap-registry.py