backend.yml

name: Backend CI/CD
  
on:
  push:
    branches: ["**"]
    paths:
      - 'backend/**'
      - '.github/workflows/backend.yml'
  pull_request:
    branches: [main]
    paths:
      - 'backend/**'
      - '.github/workflows/backend.yml'

jobs:
  validate:
    name: Validate Migration Integrity
    runs-on: ubuntu-latest

    services:
      redis:
        image: redis
        ports:
          - 6379:6379
        options: >-
          --health-cmd "redis-cli ping"
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5
      postgres:
        image: postgres:15
        env:
          POSTGRES_USER: prisma
          POSTGRES_PASSWORD: prisma_password
          POSTGRES_DB: cidb
        ports:
          - 5432:5432
        options: >-
          --health-cmd pg_isready
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5
      postgres-shadow:
        image: postgres:15
        env:
          POSTGRES_USER: prisma
          POSTGRES_PASSWORD: prisma_password
          POSTGRES_DB: shadowdb
        ports:
          - 5433:5432
        options: >-
          --health-cmd pg_isready
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5

    defaults:
      run:
        working-directory: backend

    steps:
      - uses: actions/checkout@v4

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '20'
          cache: 'npm'
          cache-dependency-path: 'package-lock.json'

      - name: Install dependencies
        run: npm install

      # Generate the Prisma client before any migration steps so that all
      # downstream commands (migrate deploy, migrate diff, ts-node scripts)
      # have the correct client bindings available.
      - name: Generate Prisma client
        env:
          DATABASE_URL: "postgresql://prisma:prisma_password@localhost:5432/cidb"
        run: npx prisma generate

      # Fast environment check — fails immediately with a clear message if
      # DATABASE_URL is missing or malformed, rather than surfacing a cryptic
      # Prisma error several steps later.
      - name: Validate migration environment
        env:
          DATABASE_URL: "postgresql://prisma:prisma_password@localhost:5432/cidb"
        run: node scripts/validate-migration-env.js
      - name: Verify Migrations Against Temporary Database
        env:
          DATABASE_URL: "postgresql://prisma:prisma_password@localhost:5432/cidb"
          SHADOW_DATABASE_URL: "postgresql://prisma:prisma_password@localhost:5433/shadowdb"
        run: npm run migrate:verify

      - name: Run Migration Integrity Checker
        env:
          DATABASE_URL: "postgresql://prisma:prisma_password@localhost:5432/cidb"
          SHADOW_DATABASE_URL: "postgresql://prisma:prisma_password@localhost:5433/shadowdb"
        run: node scripts/check-migrations.js

      # Emit migration status as an artefact so reviewers can see which
      # migrations are applied without re-running CI.
      - name: Report migration status
        if: always()
        env:
          DATABASE_URL: "postgresql://prisma:prisma_password@localhost:5432/cidb"
        run: |
          echo "## Migration Status" > migration-status.md
          npx prisma migrate status >> migration-status.md 2>&1 || true

      - name: Upload migration status report
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: migration-status
          path: backend/migration-status.md
          retention-days: 7

      - name: Audit dependencies
        continue-on-error: true
        run: npm audit --audit-level=high

      - name: Run Lint
        run: npm run lint

      - name: Run Tests
        env:
          DATABASE_URL: "file:./test.db"
        run: npm test

      - name: Cleanup test artifacts
        if: always()
        run: rm -rf coverage logs test.db* migration-status.md