portal/.gitea/workflows/ci.yaml

# CI for TypeScript / Next.js services on Gitea Actions.
# `shared` always runs; `test`/`e2e`/`image` activate when package.json lands.
name: ci

on:
  pull_request:
    branches: [main]
  push:
    branches: [main]

jobs:
  shared:
    runs-on: docker
    steps:
      - uses: actions/checkout@v4
        with: { fetch-depth: 0 }

      - name: commitlint (PR only)
        if: github.event_name == 'pull_request'
        shell: bash
        env:
          BASE_SHA: ${{ github.event.pull_request.base.sha }}
          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
        run: |
          set -euo pipefail
          pattern='^(feat|fix|docs|chore|refactor|test|perf|build|ci|revert)(\([a-z0-9_/.-]+\))?!?: .{1,72}$'
          bad=0
          while IFS= read -r subject; do
            if ! [[ "$subject" =~ $pattern ]]; then
              echo "::error::Commit subject does not match Conventional Commits: $subject"
              bad=$((bad+1))
            fi
          done < <(git log --format=%s "${BASE_SHA}..${HEAD_SHA}")
          if [ "$bad" -gt 0 ]; then
            echo "::error::$bad commit(s) failed commitlint."
            exit 1
          fi
          echo "commitlint: OK"

      - name: gitleaks
        shell: bash
        run: |
          set -euo pipefail
          GL_VERSION=8.18.4
          curl -fsSL "https://github.com/gitleaks/gitleaks/releases/download/v${GL_VERSION}/gitleaks_${GL_VERSION}_linux_x64.tar.gz" \
            | tar -xz -C /tmp gitleaks
          /tmp/gitleaks detect --source . --no-banner --redact --verbose --exit-code 1

      - name: trivy fs scan
        shell: bash
        run: |
          set -euo pipefail
          TRIVY_VERSION=0.70.0
          curl -fsSL "https://github.com/aquasecurity/trivy/releases/download/v${TRIVY_VERSION}/trivy_${TRIVY_VERSION}_Linux-64bit.tar.gz" \
            | tar -xz -C /tmp trivy
          /tmp/trivy fs --severity HIGH,CRITICAL --exit-code 1 --no-progress --skip-dirs node_modules,target,dist .

  test:
    runs-on: docker

    steps:
      - uses: actions/checkout@v4

      - uses: pnpm/action-setup@v4
        with: { version: 9 }

      - uses: actions/setup-node@v4
        with:
          node-version: '20'
          cache: pnpm

      - run: pnpm install --frozen-lockfile
      - run: pnpm lint
      - run: pnpm typecheck
      # `pnpm test` already includes --coverage via the package.json script.
      - run: pnpm test
      - name: coverage gate
        run: |
          node -e "const c=require('./coverage/coverage-summary.json').total.lines.pct; if (c<70) { console.error('coverage', c, '< 70%'); process.exit(1) }"
      - name: build
        env:
          # Required at build-time by Auth.js. Replaced by Infisical-sourced
          # secret in stage/prod via Orca env injection (M5.1+).
          AUTH_SECRET: ci-build-dummy-${{ github.sha }}
        run: pnpm build

  e2e:
    needs: test
    runs-on: docker
    # Two gates: playwright.config.ts must exist + the repo variable
    # RUN_E2E must be 'true'. Until stage.breakpilot.com is up (M1.2 +
    # M0.3), the e2e job is opt-in. Locally, devs run `make e2e` against
    # their own dev stack.
    if: hashFiles('playwright.config.ts','playwright.config.js') != '' && github.event_name == 'push' && github.ref == 'refs/heads/main' && vars.RUN_E2E == 'true'
    steps:
      - uses: actions/checkout@v4
      - uses: pnpm/action-setup@v4
        with: { version: 9 }
      - uses: actions/setup-node@v4
        with: { node-version: '20', cache: pnpm }
      - run: pnpm install --frozen-lockfile
      - run: pnpm exec playwright install --with-deps chromium
      - run: pnpm e2e
        env:
          PLAYWRIGHT_BASE_URL: ${{ vars.STAGE_PORTAL_BASE_URL }}
          PLAYWRIGHT_APEX_URL: ${{ vars.STAGE_PORTAL_APEX_URL }}
          PLAYWRIGHT_TEST_USER: ${{ secrets.STAGE_TEST_USER }}
          PLAYWRIGHT_TEST_PASS: ${{ secrets.STAGE_TEST_PASS }}

  image:
    # Builds the portal image and ships it through the same path every
    # other service in orca-infra uses: push :latest + :sha-<sha> to
    # registry.meghsakha.com, then POST a github-style payload to the
    # orca webhook so the master pulls and redeploys breakpilot-portal.
    #
    # Webhook target (registered once on the master via
    #   orca webhooks add --repo platform/portal \
    #                     --service breakpilot-portal --branch main
    # ) accepts unsigned payloads — orca matches on repo + branch.
    needs: [shared, test]
    if: github.event_name == 'push' && github.ref == 'refs/heads/main' && hashFiles('Dockerfile') != ''
    runs-on: docker
    steps:
      - uses: actions/checkout@v4
      - uses: docker/login-action@v3
        with:
          registry: registry.meghsakha.com
          username: ${{ secrets.REGISTRY_USER }}
          password: ${{ secrets.REGISTRY_PASS }}
      - uses: docker/build-push-action@v6
        with:
          push: true
          tags: |
            registry.meghsakha.com/breakpilot/portal:latest
            registry.meghsakha.com/breakpilot/portal:sha-${{ github.sha }}
      - name: trigger orca redeploy
        # Signs the POST with HMAC-SHA256 over the JSON body using the
        # secret orca generated when the webhook was registered. Orca's
        # endpoint is publicly reachable on the master, so the signature
        # gates who can fire a deploy.
        env:
          ORCA_WEBHOOK_SECRET: ${{ secrets.ORCA_WEBHOOK_SECRET }}
        run: |
          BODY='{"repository":{"full_name":"platform/portal"},"ref":"refs/heads/main"}'
          SIG="sha256=$(printf '%s' "$BODY" | openssl dgst -sha256 -hmac "$ORCA_WEBHOOK_SECRET" -hex | awk '{print $NF}')"
          curl -ksSf -X POST \
            -H "Content-Type: application/json" \
            -H "X-GitHub-Event: push" \
            -H "X-Hub-Signature-256: $SIG" \
            -d "$BODY" \
            https://46.225.100.82:6880/api/v1/webhooks/github