name: CI/CD Pipeline

on:
  push:
    branches: [main, develop]
    tags: ["v*"]
  pull_request:
    branches: [main, develop]

env:
  CARGO_TERM_COLOR: always
  RUST_BACKTRACE: 1

jobs:
  frontend-lint:
    name: Frontend Check & Build
    runs-on: ubuntu-22.04
    steps:
      - uses: actions/checkout@v7
      - uses: oven-sh/setup-bun@v2
        with:
          bun-version: latest
          no-cache: true
      - run: bun install --frozen-lockfile
      - run: bun run typecheck
      - run: bun run format:check
      - run: bunx eslint src --ext ts,tsx --report-unused-disable-directives --max-warnings 0
      - run: bun run build
      - uses: actions/upload-artifact@v4
        with:
          name: dist
          path: dist/
          retention-days: 7

  rust-check:
    name: Rust Check & Test
    runs-on: ubuntu-22.04
    steps:
      - uses: actions/checkout@v7
      - uses: dtolnay/rust-toolchain@stable
        with:
          toolchain: stable
          components: clippy, rustfmt
      - uses: Swatinem/rust-cache@v2
        with:
          workspaces: src-tauri
      - name: Install system dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y \
            libwebkit2gtk-4.1-dev \
            build-essential \
            libssl-dev \
            libgtk-3-dev \
            libayatana-appindicator3-dev \
            librsvg2-dev \
            libxdo-dev \
            libsoup-3.0-dev \
            libjavascriptcoregtk-4.1-dev \
            libgdk-pixbuf-2.0-dev \
            libpango1.0-dev \
            libatk1.0-dev \
            libcairo2-dev
      - name: Check Rust formatting
        working-directory: src-tauri
        run: cargo fmt --all -- --check
      - run: mkdir -p dist
      - name: Run Clippy
        working-directory: src-tauri
        run: cargo clippy -- -D warnings
      - name: Run tests
        working-directory: src-tauri
        run: cargo test --all
      - name: Cargo check
        working-directory: src-tauri
        run: cargo check --all-targets

  build-tauri:
    name: Build Tauri App
    runs-on: ubuntu-22.04
    needs: [frontend-lint, rust-check]
    steps:
      - uses: actions/checkout@v7
      - uses: oven-sh/setup-bun@v2
        with:
          bun-version: latest
          no-cache: true
      - uses: dtolnay/rust-toolchain@stable

      - name: Install system deps
        run: |
          sudo apt-get update
          sudo apt-get install -y \
            libwebkit2gtk-4.1-dev \
            build-essential \
            libssl-dev \
            libgtk-3-dev \
            libayatana-appindicator3-dev \
            librsvg2-dev \
            libxdo-dev \
            libsoup-3.0-dev \
            libjavascriptcoregtk-4.1-dev \
            libgdk-pixbuf-2.0-dev \
            libpango1.0-dev \
            libatk1.0-dev \
            libcairo2-dev

      - name: Install dependencies
        run: bun install --frozen-lockfile

      - name: Build frontend
        run: bun run build

      - name: Build Tauri
        run: bun run tauri build
        env:
          NO_STRIP: 1
          APPIMAGE_EXTRACT_AND_RUN: 1

      - name: Install fpm
        run: |
          sudo apt-get install -y ruby ruby-dev rpm
          sudo gem install --no-document fpm
          export PATH="$(gem env | grep 'EXECUTABLE DIRECTORY' | awk '{print $4}'):$PATH"
          fpm --version

      - name: Build RPM package
        run: |
          export PATH="$(gem env | grep 'EXECUTABLE DIRECTORY' | awk '{print $4}'):$PATH"
          ./scripts/build-rpm.sh

      - name: Upload artifacts
        uses: actions/upload-artifact@v4
        with:
          name: linuxy
          path: |
            src-tauri/target/release/bundle/deb/*.deb
            src-tauri/target/release/bundle/rpm/*.rpm
            src-tauri/target/release/bundle/appimage/*.AppImage
          retention-days: 7

  security-audit:
    name: Security Audit
    runs-on: ubuntu-22.04
    steps:
      - uses: actions/checkout@v7
      - uses: dtolnay/rust-toolchain@stable
      - run: cargo install cargo-audit
      - run: mkdir -p dist
      - working-directory: src-tauri
        run: cargo audit
      - uses: oven-sh/setup-bun@v2
        with:
          bun-version: latest
          no-cache: true
      - run: bun install --frozen-lockfile
      - run: bun audit

  verify-csp:
    name: Verify CSP Configuration
    runs-on: ubuntu-22.04
    steps:
      - uses: actions/checkout@v7
      - run: |
          CSP=$(grep -o '"csp": *"[^"]*"' src-tauri/tauri.conf.json | sed 's/"csp": "//' | sed 's/"//')
          echo "Checking CSP: $CSP"
          if ! echo "$CSP" | grep -q "appimage.github.io"; then
            echo "ERROR: appimage.github.io not in CSP"; exit 1
          fi
          if ! echo "$CSP" | grep -q "api.github.com"; then
            echo "ERROR: api.github.com not in CSP"; exit 1
          fi
          if ! echo "$CSP" | grep -q "avatars.githubusercontent.com"; then
            echo "ERROR: avatars.githubusercontent.com not in CSP"; exit 1
          fi
          echo "CSP verification passed!"

  integration-test:
    name: Integration Tests (Linux)
    runs-on: ubuntu-22.04
    steps:
      - uses: actions/checkout@v7
      - uses: dtolnay/rust-toolchain@stable
      - uses: oven-sh/setup-bun@v2
        with:
          bun-version: latest
          no-cache: true
      - name: Install system deps
        run: |
          sudo apt-get update
          sudo apt-get install -y \
            libwebkit2gtk-4.1-dev \
            build-essential \
            libssl-dev \
            libgtk-3-dev \
            libayatana-appindicator3-dev \
            librsvg2-dev \
            libxdo-dev \
            libsoup-3.0-dev \
            libjavascriptcoregtk-4.1-dev \
            libgdk-pixbuf-2.0-dev \
            libpango1.0-dev \
            libatk1.0-dev \
            libcairo2-dev \
            firejail
      - run: bun install --frozen-lockfile
      - run: bun run build
      - run: bun run tauri build
      - name: Install fpm
        run: |
          sudo apt-get install -y ruby ruby-dev rpm
          sudo gem install --no-document fpm
      - name: Build RPM
        run: |
          export PATH="$(gem env | grep 'EXECUTABLE DIRECTORY' | awk '{print $4}'):$PATH"
          ./scripts/build-rpm.sh
      - name: Verify outputs
        run: |
          ls -la src-tauri/target/release/linuxy
          file src-tauri/target/release/linuxy
          ls -la src-tauri/target/release/bundle/
          for pattern in \
            "src-tauri/target/release/bundle/deb/*.deb" \
            "src-tauri/target/release/bundle/rpm/*.rpm"; do
            if compgen -G "$pattern" > /dev/null; then
              echo "$pattern: OK"
            else
              echo "::error::Missing bundle file: $pattern" && exit 1
            fi
          done