name: CI - Build & Verify
run-name: CI ${{ gitea.ref_name }} by @${{ gitea.actor }}

concurrency:
  group: vtubeawards-ci-${{ gitea.ref }}
  cancel-in-progress: true

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

jobs:
  backend:
    name: Backend (.NET)
    runs-on: linux
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup .NET SDK
        uses: actions/setup-dotnet@v4
        with:
          dotnet-version: '8.0.x'

      - name: Restore
        run: dotnet restore Backend/Backend.csproj

      - name: Build
        run: dotnet build Backend/Backend.csproj --no-restore --configuration Release

  frontend:
    name: Frontend (Vue/TS)
    runs-on: linux
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '24'

      - name: Install dependencies
        run: npm ci
        working-directory: frontend

      - name: Build
        run: npm run build
        working-directory: frontend

  hygiene:
    name: Repository Hygiene
    runs-on: linux
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Reject tracked build output
        run: |
          set -euo pipefail
          tracked="$(git ls-files frontend/dist Backend/bin Backend/obj || true)"
          if [ -n "$tracked" ]; then
            echo "Build output is tracked and must be removed:"
            echo "$tracked"
            exit 1
          fi

      - name: Secret pattern scan
        run: |
          set -euo pipefail
          hits="$(
            grep -RInE '(SECRET|TOKEN|PASSWORD|API_KEY)[[:space:]]*[:=][[:space:]]*.{8,}' \
              --include='*.cs' \
              --include='*.ts' \
              --include='*.vue' \
              Backend frontend/src 2>/dev/null || true
          )"
          if [ -n "$hits" ]; then
            echo "Possible hardcoded secret found:"
            echo "$hits"
            exit 1
          fi