ci.yml

name: CI

on:
  pull_request:
    branches: [main, develop]
  workflow_call:

permissions:
  contents: write
  pull-requests: write
  checks: write
  security-events: write
  actions: read
  pages: write
  id-token: write

jobs:
  lint:
    name: Lint
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Set up Go
        uses: actions/setup-go@v5
        with:
          go-version: "1.26"
          cache: true
          cache-dependency-path: go.sum

      - name: Go Lint
        uses: golangci/golangci-lint-action@v7
        with:
          version: v2.10.1
          args: --timeout=5m --config=.golangci.yml ./cmd/... ./internal/... ./pkg/...
          only-new-issues: ${{ github.event_name == 'pull_request' }}
          skip-cache: false

  test-core:
    name: Test Core
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Set up Go
        uses: actions/setup-go@v5
        with:
          go-version: "1.26"
          cache: true
          cache-dependency-path: go.sum

      - name: Cache Go build cache
        uses: actions/cache@v4
        with:
          path: ~/.cache/go-build
          key: ${{ runner.os }}-go-build-${{ hashFiles('**/go.sum') }}
          restore-keys: |
            ${{ runner.os }}-go-build-

      - name: Run Core Tests
        run: |
          CORE_PKGS="./internal/... ./pkg/store/... ./pkg/log/... ./pkg/ui/component/... ./pkg/ui/theme/..."
          if [[ "${{ github.ref }}" == "refs/heads/main" || "${{ github.ref }}" == "refs/heads/develop" ]]; then
            echo "Running tests with race detector (main/develop branch)"
            go test -race -coverprofile=coverage-core.txt -covermode=atomic $CORE_PKGS
          else
            echo "Running tests without race detector (PR - faster feedback)"
            go test -coverprofile=coverage-core.txt -covermode=atomic $CORE_PKGS
          fi

      - name: Upload Core Coverage
        uses: actions/upload-artifact@v4
        with:
          name: coverage-core
          path: coverage-core.txt

  test-cli:
    name: Test CLI
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Set up Go
        uses: actions/setup-go@v5
        with:
          go-version: "1.26"
          cache: true
          cache-dependency-path: go.sum

      - name: Cache Go build cache
        uses: actions/cache@v4
        with:
          path: ~/.cache/go-build
          key: ${{ runner.os }}-go-build-${{ hashFiles('**/go.sum') }}
          restore-keys: |
            ${{ runner.os }}-go-build-

      - name: Run CLI Tests
        run: |
          CLI_PKGS="./pkg/cli/..."
          if [[ "${{ github.ref }}" == "refs/heads/main" || "${{ github.ref }}" == "refs/heads/develop" ]]; then
            echo "Running tests with race detector (main/develop branch)"
            go test -race -p 1 -coverprofile=coverage-cli.txt -covermode=atomic $CLI_PKGS
          else
            echo "Running tests without race detector (PR - faster feedback)"
            go test -p 1 -coverprofile=coverage-cli.txt -covermode=atomic $CLI_PKGS
          fi

      - name: Upload CLI Coverage
        uses: actions/upload-artifact@v4
        with:
          name: coverage-cli
          path: coverage-cli.txt

  coverage:
    name: Upload Coverage
    needs: [test-core, test-cli]
    runs-on: ubuntu-latest
    steps:
      - name: Download coverage reports
        uses: actions/download-artifact@v4
        with:
          path: coverage
      - name: Upload Coverage to Codecov
        uses: codecov/codecov-action@v5
        with:
          files: coverage/coverage-core/coverage-core.txt,coverage/coverage-cli/coverage-cli.txt
          fail_ci_if_error: false
        env:
          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}

  build:
    name: Build Check
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Set up Go
        uses: actions/setup-go@v5
        with:
          go-version: "1.26"
          cache: true
          cache-dependency-path: go.sum

      - name: Build
        run: go build -v ./cmd/arc

  benchmark:
    name: Benchmark
    needs: [test-core, test-cli]
    uses: ./.github/workflows/benchmark.yml
    secrets: inherit
    permissions:
      contents: write
      pull-requests: write

  pr_size:
    name: PR Size Label
    if: github.event_name == 'pull_request'
    runs-on: ubuntu-latest
    steps:
      - name: Check PR Size
        uses: codelytv/pr-size-labeler@v1
        with:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          xs_label: "size/XS"
          xs_max_size: 10
          s_label: "size/S"
          s_max_size: 50
          m_label: "size/M"
          m_max_size: 200
          l_label: "size/L"
          l_max_size: 500
          xl_label: "size/XL"
          fail_if_xl: false
          message_if_xl: >
            ⚠️ This PR is very large (500+ lines). Consider breaking it into smaller PRs for easier review.
          files_to_ignore: "go.sum"

  spellcheck:
    name: Spell Check
    if: github.event_name == 'pull_request'
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Spell Check in docs/
        uses: crate-ci/typos@master
        with:
          config: .typos.toml
          files: "docs/ README.md"

  link_check:
    name: Link Check
    if: github.event_name == 'pull_request'
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Check Links in docs/
        uses: lycheeverse/lychee-action@v2
        with:
          args: >-
            --verbose --no-progress
            --exclude-path '.github'
            --exclude-path 'specs'
            --exclude 'conventionalcommits\.org'
            --exclude 'github\.com/arc-framework/arc-cli/releases'
            'docs/**/*.md' 'README.md'
          fail: true
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  binary_size:
    name: Binary Size Tracker
    if: github.event_name == 'pull_request'
    runs-on: ubuntu-latest
    steps:
      - name: Checkout PR
        uses: actions/checkout@v4

      - name: Set up Go
        uses: actions/setup-go@v5
        with:
          go-version: "1.26"
          cache: true

      - name: Build PR Binary
        run: |
          go build -ldflags="-s -w" -o arc-pr ./cmd/arc
          PR_SIZE=$(stat -f%z arc-pr 2>/dev/null || stat -c%s arc-pr)
          echo "pr_size=$PR_SIZE" >> $GITHUB_OUTPUT
        id: pr

      - name: Checkout Base
        uses: actions/checkout@v4
        with:
          ref: ${{ github.base_ref }}

      - name: Build Base Binary
        run: |
          go build -ldflags="-s -w" -o arc-base ./cmd/arc
          BASE_SIZE=$(stat -f%z arc-base 2>/dev/null || stat -c%s arc-base)
          echo "base_size=$BASE_SIZE" >> $GITHUB_OUTPUT
        id: base

      - name: Compare Sizes
        uses: actions/github-script@v7
        with:
          script: |
            const prSize = ${{ steps.pr.outputs.pr_size }};
            const baseSize = ${{ steps.base.outputs.base_size }};
            const diff = prSize - baseSize;
            const diffPercent = ((diff / baseSize) * 100).toFixed(2);

            const formatSize = (bytes) => {
              const kb = bytes / 1024;
              const mb = kb / 1024;
              return mb >= 1 ? `${mb.toFixed(2)} MB` : `${kb.toFixed(2)} KB`;
            };

            let emoji = '📊';
            let status = 'No significant change';
            if (Math.abs(diffPercent) > 5) {
              emoji = diff > 0 ? '📈' : '📉';
              status = diff > 0 ? 'Size increased' : 'Size decreased';
            }

            const comment = `${emoji} **Binary Size ${status}**

            | Metric | Size |
            |--------|------|
            | Base | ${formatSize(baseSize)} |
            | PR | ${formatSize(prSize)} |
            | Diff | ${diff > 0 ? '+' : ''}${formatSize(Math.abs(diff))} (${diff > 0 ? '+' : ''}${diffPercent}%) |

            ${Math.abs(diffPercent) > 10 ? '⚠️ **Warning**: Binary size changed by more than 10%' : ''}`;

            github.rest.issues.createComment({
              issue_number: context.issue.number,
              owner: context.repo.owner,
              repo: context.repo.repo,
              body: comment
            });

      - name: Enforce size limit
        shell: bash
        run: |
          PR_SIZE="${{ steps.pr.outputs.pr_size }}"
          MAX_SIZE=20971520  # 20 MB hard limit
          echo "Binary size: $(( PR_SIZE / 1024 / 1024 )) MB (${PR_SIZE} bytes)"
          if [ "${PR_SIZE}" -gt "${MAX_SIZE}" ]; then
            echo "::error::Binary exceeds 20 MB hard limit. Current: ${PR_SIZE} bytes."
            exit 1
          fi
          echo "Size OK ✓"

  security:
    name: Security Scan
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Set up Go
        uses: actions/setup-go@v5
        with:
          go-version: "1.26"
          cache: true
          cache-dependency-path: go.sum

      - name: Run govulncheck
        run: |
          go install golang.org/x/vuln/cmd/govulncheck@latest
          govulncheck ./...

      - name: Run Gosec
        uses: securego/gosec@master
        with:
          args: "-exclude=G304,G301,G306,G703 -confidence=high -severity=high -fmt text ./..."

      - name: Dependency Review
        if: github.event_name == 'pull_request'
        uses: actions/dependency-review-action@v4
        continue-on-error: true
        with:
          fail-on-severity: high