name: Build & Test with Secrets

on:
  push:
    branches: [main, develop]
  pull_request:
    branches: [main, develop]

env:
  # Inject secrets from Gitea Actions Secrets
  KARTSELL_POSTGRES: ${{ secrets.KARTSELL_POSTGRES }}
  KRX_API_KEY: ${{ secrets.KRX_API_KEY }}
  OPENDART_API_KEY: ${{ secrets.OPENDART_API_KEY }}
  KIS_API_KEY: ${{ secrets.KIS_API_KEY }}
  KIS_SECRET_KEY: ${{ secrets.KIS_SECRET_KEY }}

jobs:
  build:
    runs-on: ubuntu-latest

    services:
      postgres:
        image: postgres:16
        env:
          POSTGRES_USER: kartsell
          POSTGRES_PASSWORD: kartsell
          POSTGRES_DB: kartsell
        options: >-
          --health-cmd pg_isready
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5
        ports:
          - 5432:5432

    steps:
      - uses: actions/checkout@v4

      - name: Setup .NET
        uses: actions/setup-dotnet@v4
        with:
          dotnet-version: '10.0.x'

      - name: Restore dependencies
        run: dotnet restore KArtSell.sln

      - name: Build (Release)
        run: dotnet build KArtSell.sln -c Release --no-restore

      - name: Run database migrations
        run: dotnet run --project src/KArtSell.DbMigrator -c Release
        env:
          # PostgreSQL in GitHub Actions is on localhost:5432
          KARTSELL_POSTGRES: "Host=localhost;Port=5432;Database=kartsell;Username=kartsell;Password=kartsell"

      - name: Run tests
        run: dotnet test KArtSell.sln -c Release --no-build --logger "trx" --collect:"XPlat Code Coverage"
        env:
          # Use test database
          KARTSELL_POSTGRES: "Host=localhost;Port=5432;Database=kartsell;Username=kartsell;Password=kartsell"
          # Secrets available for integration tests
          KRX_API_KEY: ${{ secrets.KRX_API_KEY }}

      - name: Upload test results
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: test-results
          path: '**/TestResults/**/*.trx'

  frontend:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '22'

      - name: Install pnpm
        run: npm install -g pnpm@10

      - name: Install dependencies
        run: |
          cd frontend
          pnpm install --frozen-lockfile

      - name: Type check
        run: |
          cd frontend
          pnpm typecheck

      - name: Run tests
        run: |
          cd frontend
          pnpm test

      - name: Build
        run: |
          cd frontend
          pnpm build

      - name: E2E Tests
        run: |
          cd frontend
          pnpm exec playwright install --with-deps chromium
          pnpm e2e
        env:
          # API secrets available for E2E if needed
          KRX_API_KEY: ${{ secrets.KRX_API_KEY }}

  security-scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Verify no secrets in code
        run: |
          # Fail if credentials detected in source files
          ! grep -r "password\|api_key\|secret" src/ --include="*.cs" --include="*.ts" --include="*.tsx" | grep -v "Configuration\|Options\|secrets"

  notification:
    needs: [build, frontend]
    if: always()
    runs-on: ubuntu-latest
    steps:
      - name: Report build status
        run: |
          echo "Build Status: ${{ needs.build.result }}"
          echo "Frontend Status: ${{ needs.frontend.result }}"

          # Optional: Send to Telegram/Slack notification
          if [ "${{ needs.build.result }}" == "success" ] && [ "${{ needs.frontend.result }}" == "success" ]; then
            echo "✅ All checks passed"
          else
            echo "❌ Build failed"
            exit 1
          fi