name: CI - Build & Verify
run-name: CI ${{ gitea.ref_name }} by @${{ gitea.actor }}

concurrency:
  group: vtubeawards-ci-${{ gitea.ref }}
  cancel-in-progress: true

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

jobs:
  verify:
    name: Build, Typecheck & Hygiene
    runs-on: ubuntu-latest
    timeout-minutes: 20
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Reject tracked build output
        run: |
          set -euo pipefail
          tracked="$(git ls-files frontend/dist Backend/bin Backend/obj || true)"
          if [ -n "$tracked" ]; then
            echo "Build output is tracked and must be removed:"
            echo "$tracked"
            exit 1
          fi

      - name: Secret pattern scan
        run: |
          set -euo pipefail
          hits="$(
            grep -RInE '(SECRET|TOKEN|PASSWORD|API_KEY)[[:space:]]*[:=][[:space:]]*.{8,}' \
              --include='*.cs' \
              --include='*.ts' \
              --include='*.vue' \
              Backend frontend/src 2>/dev/null || true
          )"
          if [ -n "$hits" ]; then
            echo "Possible hardcoded secret found:"
            echo "$hits"
            exit 1
          fi

      - name: Backend build
        run: |
          set -euo pipefail
          docker run --rm \
            -v "${{ gitea.workspace }}:/workspace" \
            -w /workspace \
            mcr.microsoft.com/dotnet/sdk:8.0-alpine \
            sh -lc 'dotnet restore Backend/Backend.csproj && dotnet build Backend/Backend.csproj --no-restore --configuration Release'

      - name: Frontend build
        run: |
          set -euo pipefail
          docker run --rm \
            -v "${{ gitea.workspace }}:/workspace" \
            -w /workspace/frontend \
            node:24-alpine \
            sh -lc 'npm ci && npm run build'