ci.yml

name: CI

permissions:
  contents: read
  security-events: write
  actions: read

env:
  KEELMATRIX_NO_TELEMETRY: "1"

on:
  push:
    branches: [ main, master ]
  pull_request:
    branches: [ "*" ]

jobs:
  supported-tfms:
    if: github.actor != 'dependabot[bot]'
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        os: [windows-latest, ubuntu-latest, macos-latest]
        tfm: [net8.0, netstandard2.0]
    steps:
      - uses: actions/checkout@v7
      - name: Set up .NET
        uses: actions/setup-dotnet@v6
        with:
          dotnet-version: '8.0.408'
      - name: Restore dependencies
        run: dotnet restore KeelMatrix.QueryWatch.sln --configfile NuGet.config
      - name: Build for ${{ matrix.tfm }}
        shell: pwsh
        run: |
          if ('${{ matrix.tfm }}' -eq 'net8.0') {
            dotnet build ./src/KeelMatrix.QueryWatch/KeelMatrix.QueryWatch.csproj --configuration Release --no-restore -f net8.0
            if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
            dotnet build ./src/KeelMatrix.QueryWatch.Contracts/KeelMatrix.QueryWatch.Contracts.csproj --configuration Release --no-restore -f net8.0
            if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
            dotnet build ./src/KeelMatrix.QueryWatch.EfCore/KeelMatrix.QueryWatch.EfCore.csproj --configuration Release --no-restore -f net8.0
            exit $LASTEXITCODE
          }

          # netstandard is not directly runnable under dotnet test, so validate the
          # supported library assets by building each netstandard target explicitly.
          dotnet build ./src/KeelMatrix.QueryWatch/KeelMatrix.QueryWatch.csproj --configuration Release --no-restore -f netstandard2.0
          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
          dotnet build ./src/KeelMatrix.QueryWatch.Contracts/KeelMatrix.QueryWatch.Contracts.csproj --configuration Release --no-restore -f netstandard2.0
          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
          exit $LASTEXITCODE

  test:
    if: github.actor != 'dependabot[bot]'
    runs-on: ${{ matrix.os }}
    needs: supported-tfms
    strategy:
      fail-fast: false
      matrix:
        os: [windows-latest, ubuntu-latest, macos-latest]
    steps:
      - uses: actions/checkout@v7
      - name: Set up .NET
        uses: actions/setup-dotnet@v6
        with:
          dotnet-version: '8.0.408'
      - name: Restore dependencies
        run: dotnet restore KeelMatrix.QueryWatch.sln --configfile NuGet.config
      - name: Build
        run: dotnet build --configuration Release --no-restore
      - name: Test
        env:
          QWATCH__DISABLE_COMPOSE: "1"
        run: >
          dotnet test KeelMatrix.QueryWatch.sln --configuration Release --no-build --framework net8.0
          --collect:"XPlat Code Coverage"
          --results-directory ./artifacts/TestResults
          --filter "FullyQualifiedName!~KeelMatrix.QueryWatch.Providers.SmokeTests"
  smoke-tests:
    if: github.actor != 'dependabot[bot]'
    needs: test
    runs-on: ubuntu-latest
    timeout-minutes: 20
    steps:
      - uses: actions/checkout@v7
      - name: Set up .NET
        uses: actions/setup-dotnet@v6
        with:
          dotnet-version: '8.0.408'
      - name: Restore dependencies
        run: dotnet restore KeelMatrix.QueryWatch.sln --configfile NuGet.config
      - name: Run smoke tests
        env:
          QWATCH__DISABLE_COMPOSE: "0"
        run: >
          dotnet test tests/KeelMatrix.QueryWatch.Providers.SmokeTests/KeelMatrix.QueryWatch.Providers.SmokeTests.csproj
          --configuration Release
          --framework net8.0
          --filter "FullyQualifiedName~KeelMatrix.QueryWatch.Providers.SmokeTests"

  package-and-analyze:
    if: github.actor != 'dependabot[bot]'
    needs: [test, smoke-tests]
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - name: Set up .NET
        uses: actions/setup-dotnet@v6
        with:
          dotnet-version: '8.0.408'
      - name: Restore dependencies
        run: dotnet restore KeelMatrix.QueryWatch.sln --configfile NuGet.config
      - name: Build
        run: dotnet build --configuration Release --no-restore
      - name: QueryWatch gate (optional - JSON)
        shell: pwsh
        run: |
          if (Test-Path "artifacts/qwatch.report.json") {
            dotnet run --project tools/KeelMatrix.QueryWatch.Cli -- --input artifacts/qwatch.report.json --max-queries 50
          } else {
            Write-Host "No QueryWatch JSON found; skipping QueryWatch gate."
          }
      - name: Pack (core)
        run: dotnet pack ./src/KeelMatrix.QueryWatch/KeelMatrix.QueryWatch.csproj --configuration Release --no-build --include-symbols --p:SymbolPackageFormat=snupkg -p:Version=0.1.0 --output ./artifacts/packages
      - name: Pack (EF Core adapter)
        run: dotnet pack ./src/KeelMatrix.QueryWatch.EfCore/KeelMatrix.QueryWatch.EfCore.csproj --configuration Release --no-build --include-symbols --p:SymbolPackageFormat=snupkg -p:Version=0.1.0 --output ./artifacts/packages
      - name: Pack (qwatch)
        run: dotnet pack ./tools/KeelMatrix.QueryWatch.Cli/KeelMatrix.QueryWatch.Cli.csproj --configuration Release --no-build --include-symbols --p:SymbolPackageFormat=snupkg -p:Version=0.1.0 --output ./artifacts/packages
      - name: Install and smoke-test qwatch package
        shell: bash
        run: |
          dotnet tool install qwatch --tool-path ./artifacts/qwatch-tool --version 0.1.0 --add-source ./artifacts/packages --configfile ./NuGet.config
          ./artifacts/qwatch-tool/qwatch --help
          ./artifacts/qwatch-tool/qwatch --input ./tests/KeelMatrix.QueryWatch.Cli.IntegrationTests/Fixtures/current_ok.json --max-queries 200
          dotnet tool uninstall qwatch --tool-path ./artifacts/qwatch-tool
      - name: Upload packages
        uses: actions/upload-artifact@v7
        with:
          name: nuget-packages
          path: ./artifacts/packages
          if-no-files-found: error
          overwrite: true
      - name: Verify formatting
        run: dotnet format --verify-no-changes
      - name: Check for vulnerable dependencies
        run: dotnet list KeelMatrix.QueryWatch.sln package --vulnerable --include-transitive
  perf-bench:
    if: (github.event_name == 'pull_request' || github.ref == 'refs/heads/main') && github.actor != 'dependabot[bot]'
    needs: test
    runs-on: windows-latest
    timeout-minutes: 12
    strategy:
      fail-fast: false
      matrix:
        shard:
          # original pieces, but 1 per shard
          - { name: jwt-core,      filter: "*Jwt*ciOi*" }
          - { name: phone-long,    filter: "*Phone*0958*" }
          - { name: email-simple,  filter: "*Email*(Sample:*user@example.com*)" }
          - { name: email-long,    filter: "*Email*(Sample:*@domain.co.uk*)" }
  
    steps:
      - uses: actions/checkout@v7
      - uses: actions/setup-dotnet@v6
        with: { dotnet-version: '8.0.408' }
      - name: Run perf benchmarks (${{ matrix.shard.name }})
        shell: pwsh
        run: >
          pwsh -NoProfile -File bench/Run-Benchmarks.ps1
          -Job Short
          -Filter "${{ matrix.shard.filter }}"
          -MaxStdevPct 12
          -Ci
          -CoolDownSec 0
  
      - name: Upload benchmark artifacts (${{ matrix.shard.name }})
        uses: actions/upload-artifact@v7
        with:
          name: perf-benchmarks-${{ matrix.shard.name }}
          path: artifacts/benchmarks
          if-no-files-found: error
  
      - name: Publish benchmark summary to PR (${{ matrix.shard.name }})
        shell: pwsh
        run: |
          $f = Get-ChildItem "artifacts/benchmarks/*/SUMMARY.md" -ErrorAction SilentlyContinue |
               Sort-Object LastWriteTime -Descending | Select-Object -First 1
          if ($f) { Get-Content $f.FullName | Out-File -FilePath $env:GITHUB_STEP_SUMMARY -Append -Encoding utf8 }

# --- Optional companion gates (disabled by default) ---
# - name: Unrecorded HTTP Call gate
#   if: always()
#   run: |
#     echo "TODO: Fail if tests performed network calls without cassettes"
#
# - name: Snapshot PII Scan / Drift
#   if: always()
#   run: |
#     echo "TODO: Scan changed fixture files for PII patterns"