ci.yml

name: 🚀 CI/CD Pipeline

on:
  push:
    branches: [main, develop]
  pull_request:
    branches: [main, develop]
  release:
    types: [published]

env:
  NODE_VERSION: 18.x

jobs:
  # Quality Gates - Run in parallel
  typecheck:
    name: 🔍 TypeScript Check
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: 'npm'
      
      - name: Install dependencies
        run: npm ci
      
      - name: TypeScript compilation check
        run: npm run typecheck

  lint:
    name: 🧹 Lint & Format Check
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: 'npm'
      
      - name: Install dependencies
        run: npm ci
      
      - name: Lint check
        run: npm run lint
      
      - name: Format check
        run: npx biome format --write src/ --dry-run

  test:
    name: 🧪 Tests & Coverage
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: 'npm'
      
      - name: Install dependencies
        run: npm ci
      
      - name: Run tests with coverage
        run: npm run test:coverage
      
      - name: Upload coverage to Codecov
        uses: codecov/codecov-action@v3
        with:
          file: ./coverage/coverage-final.json
          fail_ci_if_error: true
          flags: unittests
      
      - name: Comment coverage on PR
        if: github.event_name == 'pull_request'
        uses: romeovs/lcov-reporter-action@v0.3.1
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          lcov-file: ./coverage/lcov.info

  security:
    name: 🔒 Security Scan
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: 'npm'
      
      - name: Install dependencies
        run: npm ci
      
      - name: Run npm audit
        run: npm audit --audit-level high
      
      - name: Run Snyk security scan
        uses: snyk/actions/node@master
        env:
          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
        with:
          args: --severity-threshold=high
      
      - name: Upload Snyk results to GitHub Code Scanning
        uses: github/codeql-action/upload-sarif@v2
        if: always()
        with:
          sarif_file: snyk.sarif

  # Build and Package
  build:
    name: 🏗️ Build Extension
    needs: [typecheck, lint, test, security]
    runs-on: ubuntu-latest
    outputs:
      version: ${{ steps.version.outputs.version }}
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: 'npm'
      
      - name: Install dependencies
        run: npm ci
      
      - name: Build extension
        run: npm run build:prod
      
      - name: Copy manifest to dist
        run: cp public/manifest.json dist/
      
      - name: Copy icons to dist
        run: cp -r icons dist/
      
      - name: Get version from package.json
        id: version
        run: echo "version=$(node -p "require('./package.json').version")" >> $GITHUB_OUTPUT
      
      - name: Create extension package
        run: |
          cd dist
          zip -r ../faf-extension-v${{ steps.version.outputs.version }}.zip .
      
      - name: Upload build artifact
        uses: actions/upload-artifact@v4
        with:
          name: extension-build-${{ steps.version.outputs.version }}
          path: |
            faf-extension-v${{ steps.version.outputs.version }}.zip
            dist/
          retention-days: 30

  # Performance Testing
  performance:
    name: 🏃‍♂️ Performance Tests
    needs: [build]
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/download-artifact@v4
        with:
          name: extension-build-${{ needs.build.outputs.version }}
      
      - name: Setup Chrome
        uses: browser-actions/setup-chrome@latest
      
      - name: Run extension performance tests
        run: |
          # Custom performance testing script
          node scripts/performance-test.js
      
      - name: Upload performance results
        uses: actions/upload-artifact@v4
        with:
          name: performance-results
          path: performance-results.json

  # Chrome Web Store Deployment (Production only)
  deploy-chrome-store:
    name: 🚀 Deploy to Chrome Web Store
    if: github.event_name == 'release'
    needs: [build, performance]
    runs-on: ubuntu-latest
    environment: production
    steps:
      - uses: actions/checkout@v4
      - uses: actions/download-artifact@v4
        with:
          name: extension-build-${{ needs.build.outputs.version }}
      
      - name: Upload to Chrome Web Store
        uses: mnao305/chrome-extension-upload@v4.0.1
        with:
          file-path: faf-extension-v${{ needs.build.outputs.version }}.zip
          extension-id: ${{ secrets.CHROME_EXTENSION_ID }}
          client-id: ${{ secrets.CHROME_CLIENT_ID }}
          client-secret: ${{ secrets.CHROME_CLIENT_SECRET }}
          refresh-token: ${{ secrets.CHROME_REFRESH_TOKEN }}
          publish: true
      
      - name: Create GitHub Release Assets
        uses: softprops/action-gh-release@v1
        with:
          files: faf-extension-v${{ needs.build.outputs.version }}.zip
          generate_release_notes: true

  # Notification on success/failure
  notify:
    name: 📢 Notify
    if: always()
    needs: [typecheck, lint, test, security, build, performance]
    runs-on: ubuntu-latest
    steps:
      - name: Notify Slack on success
        if: success()
        uses: 8398a7/action-slack@v3
        with:
          status: success
          text: '✅ FAF Extension CI/CD completed successfully!'
        env:
          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
      
      - name: Notify Slack on failure
        if: failure()
        uses: 8398a7/action-slack@v3
        with:
          status: failure
          text: '❌ FAF Extension CI/CD failed!'
        env:
          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}