name: CI

on:
  push:
    branches: [main, master]
  pull_request:
    branches: [main, master]

jobs:
  test:
    name: Test & Lint
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: dashcaddy-api

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '20'
          cache: 'npm'
          cache-dependency-path: dashcaddy-api/package-lock.json

      - name: Install dependencies
        run: npm ci

      - name: Lint
        run: npm run lint

      - name: Test (CI mode + coverage)
        run: npm run test:ci

      - name: Upload coverage artifact
        if: always()
        uses: actions/upload-artifact@v3
        with:
          name: coverage-${{ github.sha }}
          path: dashcaddy-api/coverage/
          retention-days: 14

  security:
    name: Security audit
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: dashcaddy-api

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '20'
          cache: 'npm'
          cache-dependency-path: dashcaddy-api/package-lock.json

      - name: Install dependencies
        run: npm ci

      - name: npm audit (production deps, high+ severity)
        run: npm audit --production --audit-level=high
        continue-on-error: true

      - name: Run security-focused test suite
        run: npm run test:security