ci.yml

# Quality gates: Go tests/vet/vulncheck, UI lint/typecheck/build, and a
# dependency/filesystem vulnerability scan. Runs on PRs and on pushes to main.
# The Deploy workflow gates on its own fast `test` job; this workflow adds the
# heavier scans that shouldn't block every deploy but must pass on PRs.
name: CI

on:
  pull_request:
  push:
    branches: [main]

permissions:
  contents: read

concurrency:
  group: ci-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  backend:
    name: Go — vet, test, govulncheck
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: vibescan-go
    steps:
      - uses: actions/checkout@v7
      - uses: actions/setup-go@v7
        with:
          go-version-file: vibescan-go/go.mod
          cache-dependency-path: vibescan-go/go.sum
      - name: go vet
        run: go vet ./...
      - name: gofmt
        run: test -z "$(gofmt -l .)"
      - name: go test (race)
        # -short skips the browser/capture tests, which need a real headless
        # Chromium (present on the scanner host, not on CI runners). Those tests
        # already guard themselves with testing.Short().
        run: go test -short -race -covermode=atomic -coverprofile=coverage.out ./...
      - name: Coverage summary
        run: go tool cover -func=coverage.out
      - name: govulncheck
        run: |
          go install golang.org/x/vuln/cmd/govulncheck@v1.6.0
          "$(go env GOPATH)/bin/govulncheck" ./...

  frontend:
    name: UI — lint, typecheck, build
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: vibescan-ui
    steps:
      - uses: actions/checkout@v7
      - uses: actions/setup-node@v7
        with:
          node-version: 22
          cache: npm
          cache-dependency-path: vibescan-ui/package-lock.json
      - run: npm ci
      - name: Lint
        run: npm run lint
      - name: Unit tests
        run: npm test
      - name: Typecheck + build
        run: npm run build

  scan:
    name: Trivy — dependency & secret scan
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      # vuln + secret only. Dockerfile-misconfig scanning is intentionally omitted:
      # the scanner agent image (Dockerfile.agent) runs as root because nmap needs
      # raw-socket privileges, which trips the "non-root user" check as a false
      # positive. Dependency (gomod/npm) and secret scanning are the security gates.
      - name: Trivy filesystem scan (vulns + secrets)
        uses: aquasecurity/trivy-action@57a97c7e7821a5776cebc9bb87c984fa69cba8f1 # v0.35.0
        with:
          version: v0.69.3
          scan-type: fs
          scanners: vuln,secret
          severity: HIGH,CRITICAL
          ignore-unfixed: true
          exit-code: "1"