pr-validation.yml

name: Pull Request Validation

on:
  pull_request:
    types: [opened, synchronize, reopened]
    branches: [ main, develop ]
  workflow_dispatch:

env:
  RUBY_VERSION: '4.0.1'
  NODE_VERSION: '24'
  POSTGRES_VERSION: '18'
  REDIS_VERSION: '8'

jobs:
  # Parallel job for different test types
  test:
    name: ${{ matrix.test-type }} Tests
    runs-on: ubuntu-latest
    timeout-minutes: 30
    
    strategy:
      fail-fast: false
      matrix:
        test-type: [unit, integration]
    
    services:
      postgres:
        image: postgres:18
        env:
          POSTGRES_PASSWORD: postgres
          POSTGRES_DB: streamsource_test
        options: >-
          --health-cmd pg_isready
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5
        ports:
          - 5432:5432
      
      redis:
        image: redis:8
        options: >-
          --health-cmd "redis-cli ping"
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5
        ports:
          - 6379:6379

    steps:
    - name: Checkout code
      uses: actions/checkout@v5
      with:
        fetch-depth: 0

    - name: Cache Ruby dependencies
      uses: actions/cache@v4
      with:
        path: |
          ~/.bundle
          vendor/bundle
        key: ${{ runner.os }}-gems-${{ hashFiles('**/Gemfile.lock') }}
        restore-keys: |
          ${{ runner.os }}-gems-

    - name: Set up Ruby
      uses: ruby/setup-ruby@v1
      with:
        ruby-version: ${{ env.RUBY_VERSION }}
        bundler-cache: true
    
    - name: Cache Node dependencies
      uses: actions/cache@v4
      with:
        path: |
          ~/.cache/yarn
          node_modules
        key: ${{ runner.os }}-node-${{ hashFiles('**/yarn.lock') }}
        restore-keys: |
          ${{ runner.os }}-node-

    - name: Setup Node
      uses: actions/setup-node@v6
      with:
        node-version: ${{ env.NODE_VERSION }}
        cache: 'yarn'
    
    - name: Install dependencies
      run: |
        yarn install --frozen-lockfile --prefer-offline

    - name: Run Ruby lint
      run: bundle exec rubocop

    - name: Run JavaScript lint
      run: yarn lint:js

    - name: Build assets
      run: |
        yarn build
        yarn build:css
    
    - name: Setup test database
      env:
        RAILS_ENV: test
        DATABASE_URL: postgres://postgres:postgres@localhost:5432/streamsource_test
        REDIS_URL: redis://localhost:6379/1
      run: |
        bundle exec rails db:create
        bundle exec rails db:schema:load
    
    - name: Run ${{ matrix.test-type }} tests
      env:
        RAILS_ENV: test
        DATABASE_URL: postgres://postgres:postgres@localhost:5432/streamsource_test
        REDIS_URL: redis://localhost:6379/1
      run: |
        case "${{ matrix.test-type }}" in
          unit)
            UNIT_DIRS="spec/models spec/serializers"
            if [ -d "spec/lib" ]; then
              UNIT_DIRS="$UNIT_DIRS spec/lib"
            fi
            if [ -d "spec/services" ]; then
              UNIT_DIRS="$UNIT_DIRS spec/services"
            fi
            bundle exec rspec $UNIT_DIRS --format progress --format RspecJunitFormatter --out tmp/rspec-unit.xml
            ;;
          integration)
            INTEGRATION_DIRS=""
            if [ -d "spec/requests" ]; then
              INTEGRATION_DIRS="$INTEGRATION_DIRS spec/requests"
            fi
            if [ -d "spec/controllers" ]; then
              INTEGRATION_DIRS="$INTEGRATION_DIRS spec/controllers"
            fi
            if [ -z "$INTEGRATION_DIRS" ]; then
              echo "No integration specs found. Skipping."
              exit 0
            fi
            bundle exec rspec $INTEGRATION_DIRS --format progress --format RspecJunitFormatter --out tmp/rspec-integration.xml
            ;;
          # system tests removed for now
        esac
    
    - name: Upload test results
      uses: actions/upload-artifact@v4
      if: always()
      with:
        name: test-results-${{ matrix.test-type }}
        path: tmp/rspec-*.xml
        retention-days: 30

  # Linting and code quality
  lint:
    name: Code Quality
    runs-on: ubuntu-latest
    timeout-minutes: 15
    
    steps:
    - name: Checkout code
      uses: actions/checkout@v5
      with:
        fetch-depth: 0

    - name: Cache Ruby dependencies
      uses: actions/cache@v4
      with:
        path: |
          ~/.bundle
          vendor/bundle
        key: ${{ runner.os }}-gems-${{ hashFiles('**/Gemfile.lock') }}
        restore-keys: |
          ${{ runner.os }}-gems-

    - name: Set up Ruby
      uses: ruby/setup-ruby@v1
      with:
        ruby-version: ${{ env.RUBY_VERSION }}
        bundler-cache: true
    
    - name: Cache Node dependencies
      uses: actions/cache@v4
      with:
        path: |
          ~/.cache/yarn
          node_modules
        key: ${{ runner.os }}-node-${{ hashFiles('**/yarn.lock') }}
        restore-keys: |
          ${{ runner.os }}-node-

    - name: Setup Node
      uses: actions/setup-node@v6
      with:
        node-version: ${{ env.NODE_VERSION }}
        cache: 'yarn'
    
    - name: Install dependencies
      run: |
        yarn install --frozen-lockfile --prefer-offline
    
    - name: Run RuboCop
      run: |
        bundle exec rubocop --format github --format json --out rubocop-report.json
    
    - name: Run ESLint
      run: |
        yarn run lint --format json --output-file eslint-report.json
    
    - name: Upload linting reports
      uses: actions/upload-artifact@v4
      if: always()
      with:
        name: linting-reports
        path: |
          rubocop-report.json
          eslint-report.json
        retention-days: 30

  # Security scanning
  security:
    name: Security Scan
    runs-on: ubuntu-latest
    timeout-minutes: 15
    
    steps:
    - name: Checkout code
      uses: actions/checkout@v5
      with:
        fetch-depth: 0

    - name: Cache Ruby dependencies
      uses: actions/cache@v4
      with:
        path: |
          ~/.bundle
          vendor/bundle
        key: ${{ runner.os }}-gems-${{ hashFiles('**/Gemfile.lock') }}
        restore-keys: |
          ${{ runner.os }}-gems-

    - name: Set up Ruby
      uses: ruby/setup-ruby@v1
      with:
        ruby-version: ${{ env.RUBY_VERSION }}
        bundler-cache: true
    
    - name: Run security analysis
      run: |
        echo "🔍 Running comprehensive security analysis..."
        
        # Static Application Security Testing (SAST)
        bundle exec brakeman -q -w2 --format json --output brakeman-report.json
        
        # Dependency vulnerability scanning
        bundle exec bundler-audit check --update --format json --output bundler-audit-report.json
        
        # Display results
        echo "Brakeman security scan completed"
        if [ -f brakeman-report.json ]; then
          BRAKEMAN_WARNINGS=$(jq '.warnings | length' brakeman-report.json)
          echo "Brakeman found $BRAKEMAN_WARNINGS potential issues"
          if [ "$BRAKEMAN_WARNINGS" -gt 0 ]; then
            echo "::warning::Brakeman found $BRAKEMAN_WARNINGS security warnings"
          fi
        fi
        
        echo "Bundler audit completed"
        if [ -f bundler-audit-report.json ]; then
          BUNDLER_VULNS=$(jq '.vulnerabilities | length' bundler-audit-report.json)
          echo "Bundler audit found $BUNDLER_VULNS vulnerabilities"
          if [ "$BUNDLER_VULNS" -gt 0 ]; then
            echo "::error::Bundler audit found $BUNDLER_VULNS vulnerabilities"
            exit 1
          fi
        fi
    
    - name: Upload security reports
      uses: actions/upload-artifact@v4
      if: always()
      with:
        name: security-reports
        path: |
          brakeman-report.json
          bundler-audit-report.json
        retention-days: 30

  # Collect and report results
  results:
    name: Test Results Summary
    runs-on: ubuntu-latest
    needs: [test, lint, security]
    if: always()
    
    steps:
    - name: Download all artifacts
      uses: actions/download-artifact@v7
      with:
        path: artifacts
    
    - name: Generate test summary
      run: |
        echo "# 📊 PR Validation Summary" >> $GITHUB_STEP_SUMMARY
        echo "" >> $GITHUB_STEP_SUMMARY
        
        echo "## Test Results" >> $GITHUB_STEP_SUMMARY
        echo "| Test Type | Status |" >> $GITHUB_STEP_SUMMARY
        echo "|-----------|--------|" >> $GITHUB_STEP_SUMMARY
        
        # Check test results
        for test_type in unit integration; do
          if [ -f "artifacts/test-results-${test_type}/rspec-${test_type}.xml" ]; then
            echo "| $test_type | ✅ Passed |" >> $GITHUB_STEP_SUMMARY
          else
            echo "| $test_type | ❌ Failed |" >> $GITHUB_STEP_SUMMARY
          fi
        done
        
        echo "" >> $GITHUB_STEP_SUMMARY
        echo "## Code Quality" >> $GITHUB_STEP_SUMMARY
        
        # Check linting results
        if [ -f "artifacts/linting-reports/rubocop-report.json" ]; then
          echo "- ✅ RuboCop: Code style checks passed" >> $GITHUB_STEP_SUMMARY
        else
          echo "- ❌ RuboCop: Code style issues found" >> $GITHUB_STEP_SUMMARY
        fi
        
        echo "" >> $GITHUB_STEP_SUMMARY
        echo "## Security" >> $GITHUB_STEP_SUMMARY
        
        # Check security results
        if [ -f "artifacts/security-reports/brakeman-report.json" ]; then
          echo "- ✅ Security scan completed" >> $GITHUB_STEP_SUMMARY
        else
          echo "- ❌ Security scan failed" >> $GITHUB_STEP_SUMMARY
        fi
        
        echo "" >> $GITHUB_STEP_SUMMARY
        echo "---" >> $GITHUB_STEP_SUMMARY
        echo "🔗 [View detailed results](https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }})" >> $GITHUB_STEP_SUMMARY
    
    - name: Comment on PR
      uses: actions/github-script@v8
      if: github.event_name == 'pull_request'
      with:
        github-token: ${{ secrets.GITHUB_TOKEN }}
        script: |
          const { data: comments } = await github.rest.issues.listComments({
            owner: context.repo.owner,
            repo: context.repo.repo,
            issue_number: context.issue.number,
          });
          
          const botComment = comments.find(comment => 
            comment.user.login === 'github-actions[bot]' && 
            comment.body.includes('PR Validation Summary')
          );
          
          const fs = require('fs');

          const unitPassed = fs.existsSync('artifacts/test-results-unit/rspec-unit.xml');
          const integrationPassed = fs.existsSync('artifacts/test-results-integration/rspec-integration.xml');
          const lintPassed = fs.existsSync('artifacts/linting-reports/rubocop-report.json') &&
            fs.existsSync('artifacts/linting-reports/eslint-report.json');
          const securityPassed = fs.existsSync('artifacts/security-reports/brakeman-report.json') &&
            fs.existsSync('artifacts/security-reports/bundler-audit-report.json');

          const allPassed = unitPassed && integrationPassed && lintPassed && securityPassed;
          const statusText = allPassed ? '✅ All checks passed' : '❌ Some checks failed';

          const summary = `## 🤖 PR Validation Summary
          
          **Status**: ${statusText}
          
          ### Test Results
          - **Unit Tests**: ${unitPassed ? '✅ Passed' : '❌ Failed'}
          - **Integration Tests**: ${integrationPassed ? '✅ Passed' : '❌ Failed'}
          
          ### Code Quality
          - **Linting**: ${lintPassed ? '✅ Passed' : '❌ Failed'}
          - **Security**: ${securityPassed ? '✅ Passed' : '❌ Failed'}
          
          [View detailed results](https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }})
          `;
          
          if (botComment) {
            await github.rest.issues.updateComment({
              owner: context.repo.owner,
              repo: context.repo.repo,
              comment_id: botComment.id,
              body: summary
            });
          } else {
            await github.rest.issues.createComment({
              owner: context.repo.owner,
              repo: context.repo.repo,
              issue_number: context.issue.number,
              body: summary
            });
          }