name: CI Quality Checks & Tests

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

jobs:
  backend-test:
    name: Go Lint & Unit Tests
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Set up Go
        uses: actions/setup-go@v5
        with:
          go-version: '1.22'
          cache: true

      - name: Verify Formatting (gofmt)
        run: |
          UNFORMATTED=$(gofmt -l internal/ cmd/)
          if [ -n "$UNFORMATTED" ]; then
            echo "Unformatted files found:"
            echo "$UNFORMATTED"
            exit 1
          fi

      - name: Run Go Vet
        run: go vet ./...

      - name: Run Go Unit Tests
        run: go test -v ./...

  frontend-build:
    name: Frontend Typecheck & Build
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Set up Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '20'
          cache: 'npm'
          cache-dependency-path: web/package-lock.json

      - name: Install Frontend Dependencies
        working-directory: web
        run: npm ci || npm install

      - name: TypeScript Check & Vite Build
        working-directory: web
        run: npm run build

  security-scan:
    name: Gitleaks Secret Detection
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Run Gitleaks Scan
        uses: gitleaks/gitleaks-action@v2
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}