name: CI Verification

on:
  push:
    branches: [ main ]
  pull_request:
    branches: [ main ]

jobs:
  verify:
    name: Lint & Extension Integrity Check
    runs-on: ubuntu-latest

    steps:
      - name: Checkout Code
        uses: actions/checkout@v4

      - name: Set up Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '20'

      - name: Validate manifest.json
        run: |
          echo "🔍 Validating manifest.json syntax and schema..."
          node -e "
            const manifest = JSON.parse(require('fs').readFileSync('manifest.json', 'utf8'));
            if (manifest.manifest_version !== 3) {
              console.error('Error: Manifest version must be 3');
              process.exit(1);
            }
            if (manifest.description && manifest.description.length > 132) {
              console.error('Error: Description is too long (' + manifest.description.length + ' > 132 chars)');
              process.exit(1);
            }
            console.log('✅ manifest.json is valid (v' + manifest.version + ', description: ' + manifest.description.length + '/132 chars)');
          "

      - name: Verify Referenced Assets & Files
        run: |
          echo "🔍 Checking that all files referenced in manifest.json exist..."
          node -e "
            const fs = require('fs');
            const manifest = JSON.parse(fs.readFileSync('manifest.json', 'utf8'));
            const files = [
              manifest.background?.service_worker,
              manifest.action?.default_popup,
              ...(manifest.content_scripts?.flatMap(cs => cs.js) || []),
              ...Object.values(manifest.icons || {})
            ].filter(Boolean);

            let missing = 0;
            for (const file of files) {
              if (!fs.existsSync(file)) {
                console.error('❌ Missing file referenced in manifest:', file);
                missing++;
              } else {
                console.log('  ✓ Found:', file);
              }
            }
            if (missing > 0) process.exit(1);
            console.log('✅ All manifest files exist!');
          "

      - name: JavaScript Syntax Check
        run: |
          echo "🔍 Checking JavaScript syntax..."
          find scripts dashboard popup -name "*.js" | while read -r jsfile; do
            node --check "$jsfile"
            echo "  ✓ Syntax valid: $jsfile"
          done
          echo "✅ All JavaScript files passed syntax verification!"

      - name: Run Anti-Data-Leak Audit
        run: |
          echo "🔍 Checking repository for sensitive paths and keys..."
          ERRORS=0
          
          # Check for forbidden export data or test archives
          if find . -name "*.zip" -o -name "activities.csv" -o -name "activities.json" | grep -v ".git" | grep -q .; then
            echo "❌ Forbidden data/archive file found in repository!"
            ERRORS=$((ERRORS + 1))
          fi

          # Check for hardcoded local machine paths
          if grep -rEn "(/Users/|/home/)[a-zA-Z0-9_\.-]+" --exclude-dir=".git" --exclude-dir=".githooks" --exclude="*.log" .; then
            echo "❌ Hardcoded local path detected in source code!"
            ERRORS=$((ERRORS + 1))
          fi

          if [ "$ERRORS" -gt 0 ]; then
            echo "🚨 CI Audit failed with $ERRORS issue(s)."
            exit 1
          fi
          echo "✅ Security & data leak check passed!"

      - name: Test Package Build
        run: |
          echo "📦 Building test extension package..."
          zip -r brightwheel-exporter-test.zip . \
            -x "*.git*" \
            -x ".githooks/*" \
            -x ".github/*" \
            -x "emmy/*" \
            -x "exports/*" \
            -x "data/*" \
            -x "*.md" \
            -x "LICENSE" \
            -x "brightwheel-exporter-test.zip"
          
          echo "✅ Package built successfully:"
          unzip -l brightwheel-exporter-test.zip