portal/.gitea/workflows/ci.yaml

# CI for TypeScript / Next.js services on Gitea Actions.
# `shared` always runs; `test`/`e2e`/`image` activate when package.json lands.
name: ci

on:
  pull_request:
    branches: [main]
  push:
    branches: [main]

env:
  COSIGN_KEY: ${{ secrets.COSIGN_KEY }}
  COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}

jobs:
  shared:
    runs-on: docker
    steps:
      - uses: actions/checkout@v4
        with: { fetch-depth: 0 }

      - name: commitlint (PR only)
        if: github.event_name == 'pull_request'
        shell: bash
        env:
          BASE_SHA: ${{ github.event.pull_request.base.sha }}
          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
        run: |
          set -euo pipefail
          pattern='^(feat|fix|docs|chore|refactor|test|perf|build|ci|revert)(\([a-z0-9_/.-]+\))?!?: .{1,72}$'
          bad=0
          while IFS= read -r subject; do
            if ! [[ "$subject" =~ $pattern ]]; then
              echo "::error::Commit subject does not match Conventional Commits: $subject"
              bad=$((bad+1))
            fi
          done < <(git log --format=%s "${BASE_SHA}..${HEAD_SHA}")
          if [ "$bad" -gt 0 ]; then
            echo "::error::$bad commit(s) failed commitlint."
            exit 1
          fi
          echo "commitlint: OK"

      - name: gitleaks
        shell: bash
        run: |
          set -euo pipefail
          GL_VERSION=8.18.4
          curl -fsSL "https://github.com/gitleaks/gitleaks/releases/download/v${GL_VERSION}/gitleaks_${GL_VERSION}_linux_x64.tar.gz" \
            | tar -xz -C /tmp gitleaks
          /tmp/gitleaks detect --source . --no-banner --redact --verbose --exit-code 1

      - name: trivy fs scan
        shell: bash
        run: |
          set -euo pipefail
          TRIVY_VERSION=0.70.0
          curl -fsSL "https://github.com/aquasecurity/trivy/releases/download/v${TRIVY_VERSION}/trivy_${TRIVY_VERSION}_Linux-64bit.tar.gz" \
            | tar -xz -C /tmp trivy
          /tmp/trivy fs --severity HIGH,CRITICAL --exit-code 1 --no-progress --skip-dirs node_modules,target,dist .

  test:
    runs-on: docker

    steps:
      - uses: actions/checkout@v4

      - uses: pnpm/action-setup@v4
        with: { version: 9 }

      - uses: actions/setup-node@v4
        with:
          node-version: '20'
          cache: pnpm

      - run: pnpm install --frozen-lockfile
      - run: pnpm lint
      - run: pnpm typecheck
      # `pnpm test` already includes --coverage via the package.json script.
      - run: pnpm test
      - name: coverage gate
        run: |
          node -e "const c=require('./coverage/coverage-summary.json').total.lines.pct; if (c<70) { console.error('coverage', c, '< 70%'); process.exit(1) }"
      - name: build
        env:
          # Required at build-time by Auth.js. Replaced by Infisical-sourced
          # secret in stage/prod via Orca env injection (M5.1+).
          AUTH_SECRET: ci-build-dummy-${{ github.sha }}
        run: pnpm build

  e2e:
    needs: test
    runs-on: docker
    # Two gates: playwright.config.ts must exist + the repo variable
    # RUN_E2E must be 'true'. Until stage.breakpilot.com is up (M1.2 +
    # M0.3), the e2e job is opt-in. Locally, devs run `make e2e` against
    # their own dev stack.
    if: hashFiles('playwright.config.ts','playwright.config.js') != '' && github.event_name == 'push' && github.ref == 'refs/heads/main' && vars.RUN_E2E == 'true'
    steps:
      - uses: actions/checkout@v4
      - uses: pnpm/action-setup@v4
        with: { version: 9 }
      - uses: actions/setup-node@v4
        with: { node-version: '20', cache: pnpm }
      - run: pnpm install --frozen-lockfile
      - run: pnpm exec playwright install --with-deps chromium
      - run: pnpm e2e
        env:
          PLAYWRIGHT_BASE_URL: ${{ vars.STAGE_PORTAL_BASE_URL }}
          PLAYWRIGHT_APEX_URL: ${{ vars.STAGE_PORTAL_APEX_URL }}
          PLAYWRIGHT_TEST_USER: ${{ secrets.STAGE_TEST_USER }}
          PLAYWRIGHT_TEST_PASS: ${{ secrets.STAGE_TEST_PASS }}

  image:
    # Builds the portal image and ships it through the same path every
    # other service in orca-infra uses: push :latest + :sha-<sha> to
    # repo.breakpilot.com, then POST a github-style payload to the
    # orca webhook so the master pulls and redeploys the portal services.
    needs: [shared, test]
    # NOTE: no hashFiles() here — at job level it evaluates BEFORE checkout
    # against an empty workspace, so the old condition was always false and
    # this job silently never ran (deployment sat on a June-10 image).
    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
    runs-on: docker
    # The runner's default job container has no docker CLI, so
    # docker/login-action + docker/build-push-action die with "Unable to
    # locate executable file: docker" (proven by tenant-registry run 5441).
    # Same pattern as the proven breakpilot-compliance build-push-deploy.yml:
    # run in docker:27-cli and use plain docker commands.
    container: docker:27-cli
    steps:
      - name: Checkout
        run: |
          apk add --no-cache git curl openssl
          git clone --depth 1 --branch ${GITHUB_REF_NAME} $(echo ${GITHUB_SERVER_URL} | sed -E "s#^(https?://)#\1ci:${{ secrets.GITHUB_TOKEN }}@#")/${GITHUB_REPOSITORY}.git .

      - name: Login
        env:
          REGISTRY_USER: ${{ secrets.REGISTRY_USER }}
          REGISTRY_PASS: ${{ secrets.REGISTRY_PASS }}
        run: echo "$REGISTRY_PASS" | docker login repo.breakpilot.com -u "$REGISTRY_USER" --password-stdin

      - name: Build + push
        run: |
          set -eu
          docker build \
            -t repo.breakpilot.com/breakpilot/portal:latest \
            -t repo.breakpilot.com/breakpilot/portal:sha-${GITHUB_SHA} \
            .
          docker push repo.breakpilot.com/breakpilot/portal:latest
          docker push repo.breakpilot.com/breakpilot/portal:sha-${GITHUB_SHA}

      - name: sign image (cosign)
        run: |
          { command -v cosign >/dev/null 2>&1 || curl -sSfLo /usr/local/bin/cosign https://github.com/sigstore/cosign/releases/download/v2.4.3/cosign-linux-amd64 || wget -qO /usr/local/bin/cosign https://github.com/sigstore/cosign/releases/download/v2.4.3/cosign-linux-amd64; } || echo "::warning::cosign fetch failed"
          chmod +x /usr/local/bin/cosign 2>/dev/null || true
          cosign sign --yes --key env://COSIGN_KEY repo.breakpilot.com/breakpilot/portal:latest || echo "::warning::cosign failed"

      - name: trigger orca redeploy
        # Signs the POST with HMAC-SHA256 over the JSON body using the
        # secret orca generated when the webhook was registered. Orca's
        # endpoint is publicly reachable on the master, so the signature
        # gates who can fire a deploy. Plain http like the proven
        # compliance trigger-orca job (the endpoint does not serve TLS).
        env:
          ORCA_WEBHOOK_SECRET: ${{ secrets.ORCA_WEBHOOK_SECRET }}
        run: |
          set -eu
          BODY='{"repository":{"full_name":"platform/portal"},"ref":"refs/heads/main"}'
          SIG="sha256=$(printf '%s' "$BODY" | openssl dgst -sha256 -hmac "$ORCA_WEBHOOK_SECRET" -hex | awk '{print $NF}')"
          curl -ksSf -X POST \
            -H "Content-Type: application/json" \
            -H "X-GitHub-Event: push" \
            -H "X-Hub-Signature-256: $SIG" \
            -d "$BODY" \
            http://46.225.100.82:6880/api/v1/webhooks/github