ci.yml

name: CI

on:
  push:
    branches: [main, develop]
  pull_request:
    branches: [main, develop]

env:
  GO_VERSION: '1.26'
  GOLANGCI_LINT_VERSION: 'v2.11.2'

jobs:
  # ===========================================================================
  # Lint Job
  # ===========================================================================
  lint:
    name: Lint
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Setup Go
        uses: actions/setup-go@v5
        with:
          go-version: ${{ env.GO_VERSION }}
          cache: true

      - name: Run golangci-lint
        uses: golangci/golangci-lint-action@v8
        with:
          version: ${{ env.GOLANGCI_LINT_VERSION }}
          args: --timeout=5m

      - name: Check formatting
        run: |
          if [ -n "$(gofmt -l .)" ]; then
            echo "Code is not formatted. Run 'gofmt -w .'"
            gofmt -d .
            exit 1
          fi

      - name: Check go mod tidy
        run: |
          go mod tidy
          git diff --exit-code go.mod go.sum

  # ===========================================================================
  # Test Job
  # ===========================================================================
  test:
    name: Test (Go ${{ matrix.go-version }})
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        go-version: ['1.26']
    
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Setup Go
        uses: actions/setup-go@v5
        with:
          go-version: ${{ matrix.go-version }}
          cache: true

      - name: Download dependencies
        run: go mod download

      - name: Run tests with race detector
        run: go test -v -race -coverprofile=coverage.out -covermode=atomic $(go list ./... | grep -v "/examples")

      - name: Check coverage threshold
        run: |
          COVERAGE=$(go tool cover -func=coverage.out | grep total | awk '{print $3}' | sed 's/%//')
          echo "Total coverage: ${COVERAGE}%"
          if (( $(echo "$COVERAGE < 90" | bc -l) )); then
            echo "FAIL: Coverage ${COVERAGE}% is below 90% threshold"
            exit 1
          fi
          echo "PASS: Coverage ${COVERAGE}% meets 90% threshold"

      - name: Upload coverage to Codecov
        uses: codecov/codecov-action@v6
        with:
          file: ./coverage.out
          fail_ci_if_error: false
          token: ${{ secrets.CODECOV_TOKEN }}

      - name: Upload coverage artifact
        uses: actions/upload-artifact@v4
        with:
          name: coverage-${{ matrix.go-version }}
          path: coverage.out

  # ===========================================================================
  # Security Job
  # ===========================================================================
  security:
    name: Security Scan
    runs-on: ubuntu-latest
    permissions:
      security-events: write
      contents: read
    
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Setup Go
        uses: actions/setup-go@v5
        with:
          go-version: ${{ env.GO_VERSION }}
          cache: true

      - name: Run Gosec Security Scanner
        uses: securego/gosec@master
        with:
          args: '-no-fail -fmt sarif -out gosec-results.sarif -exclude-dir examples -exclude-dir safedeserialize/examples ./...'

      - name: Fix SARIF relationships format
        if: always()
        run: |
          jq '.runs[].tool.driver.rules |= if type == "array" then map(if has("relationships") and (.relationships | type) == "array" then .relationships |= map(select(type == "object")) else . end) else [] end' \
            gosec-results.sarif > gosec-results-fixed.sarif
          mv gosec-results-fixed.sarif gosec-results.sarif

      - name: Upload Gosec SARIF
        uses: github/codeql-action/upload-sarif@v4
        if: always()
        with:
          sarif_file: gosec-results.sarif

      - name: Run govulncheck
        run: |
          go install golang.org/x/vuln/cmd/govulncheck@latest
          govulncheck ./...

      - name: Run Nancy (Dependency Scanner)
        run: |
          go install github.com/sonatype-nexus-community/nancy@latest
          go list -json -deps ./... | nancy sleuth || true

  # ===========================================================================
  # Agentic Fix Job — AST-based analysis with CWE-mapped fix suggestions
  # ===========================================================================
  agentic-fix:
    name: Agentic Fix Analysis
    runs-on: ubuntu-latest
    permissions:
      contents: read

    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Setup Go
        uses: actions/setup-go@v5
        with:
          go-version: ${{ env.GO_VERSION }}
          cache: true

      - name: Test new packages (analyzer, middleware, safedecode)
        run: go test ./analyzer/... ./middleware/... ./safedecode/... -v -count=1

      - name: Run Agentic Analyzer
        # Emits ::warning annotations inline on PR diffs for each finding.
        # -exit-zero keeps the job green; remove it to make the job a hard gate.
        run: go run ./cmd/analyzer/... -dir . -exit-zero

      - name: Run Agentic Analyzer (JSON report)
        run: go run ./cmd/analyzer/... -dir . -fmt json -exit-zero > agentic-findings.json

      - name: Upload findings artifact
        uses: actions/upload-artifact@v4
        with:
          name: agentic-findings
          path: agentic-findings.json