name: Quality gate

on:
  pull_request:
  push:
    branches: [main]

permissions:
  contents: read

jobs:
  backend:
    runs-on: ubuntu-latest
    services:
      postgres:
        image: pgvector/pgvector:pg17
        env:
          POSTGRES_USER: postgres
          POSTGRES_PASSWORD: postgres
          POSTGRES_DB: postgres
        ports:
          - 5432:5432
        options: >-
          --health-cmd "pg_isready -U postgres"
          --health-interval 5s
          --health-timeout 5s
          --health-retries 10
    env:
      DATABASE_URL: postgresql+asyncpg://postgres:postgres@127.0.0.1:5432/postgres
      NLTK_DISABLE_IMPORT_SECURITY: "1"
      AUTH_SECRET_KEY: ci-admin-secret
      REALTIME_TOKEN_SECRET: ci-realtime-secret
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: "3.11"
          cache: pip
          cache-dependency-path: backend/requirements.txt
      - name: Install backend dependencies
        run: python -m pip install -r backend/requirements.txt
      - name: Run migrations from an empty database
        working-directory: backend
        run: alembic upgrade head
      - name: Run backend and contract tests
        working-directory: backend
        run: python -m scripts.run_tests

  frontend:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: "22"
          cache: npm
          cache-dependency-path: frontend/package-lock.json
      - name: Install frontend dependencies
        working-directory: frontend
        run: npm ci
      - name: Run JavaScript SDK contract tests
        working-directory: frontend
        run: npm run test:contracts
      - name: Lint frontend
        working-directory: frontend
        run: npm run lint
      - name: Build production frontend
        working-directory: frontend
        run: npm run build