name: ci
on: [push, pull_request]
jobs:
  backend: # 전건(데모 무손상 + 멀티유저 격리 + 인젝션 + N+1 포함)
    runs-on: ubuntu-latest
    env: { EMBED_PROVIDER: heuristic, AGENT_PROVIDER: scripted }
    steps:
      - uses: actions/checkout@v4
      - uses: astral-sh/setup-uv@v3
      - run: uv sync
        working-directory: backend
      - run: uv run ruff check app tests
        working-directory: backend
      - run: uv run pytest -q # federation/nplus1/golden/auth/multiuser 포함
        working-directory: backend
      - run: uv run pip-audit || true # 보안(경고)
        working-directory: backend

  auth-multiuser: # phase-15 인증 켠 상태 격리 검증
    runs-on: ubuntu-latest
    env: { AUTH_ENABLED: "true", EMBED_PROVIDER: heuristic, AGENT_PROVIDER: scripted }
    steps:
      - uses: actions/checkout@v4
      - uses: astral-sh/setup-uv@v3
      - run: uv sync
        working-directory: backend
      - run: AUTH_ENABLED=true uv run pytest tests/test_auth.py tests/test_multiuser_isolation.py tests/test_export.py tests/test_ready.py -q
        working-directory: backend

  migrations: # Alembic 왕복(전 phase 스키마)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: astral-sh/setup-uv@v3
      - run: uv sync && uv run alembic upgrade head && uv run alembic downgrade base && uv run alembic upgrade head
        working-directory: backend

  frontend-unit:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: pnpm/action-setup@v4
      - uses: actions/setup-node@v4
        with: { node-version: 20, cache: pnpm, cache-dependency-path: frontend/pnpm-lock.yaml }
      - run: pnpm install --frozen-lockfile
        working-directory: frontend
      - run: pnpm exec tsc --noEmit
        working-directory: frontend
      - run: pnpm lint
        working-directory: frontend
      - run: pnpm test
        working-directory: frontend

  e2e:
    runs-on: ubuntu-latest
    needs: [backend, frontend-unit]
    env:
      LLM_PROVIDER: heuristic # CI는 Ollama 없이 결정론적
      ARI_ALLOW_TEST_RESET: "1"
    steps:
      - uses: actions/checkout@v4
      - uses: astral-sh/setup-uv@v3
      - run: uv sync && uv run alembic upgrade head && uv run python -m app.seed
        working-directory: backend
      - run: ARI_ALLOW_TEST_RESET=1 LLM_PROVIDER=heuristic uv run uvicorn app.main:app --port 31800 &
        working-directory: backend
      - uses: pnpm/action-setup@v4
      - uses: actions/setup-node@v4
        with: { node-version: 20, cache: pnpm, cache-dependency-path: frontend/pnpm-lock.yaml }
      - run: pnpm install --frozen-lockfile
        working-directory: frontend
      - run: pnpm exec playwright install --with-deps chromium
        working-directory: frontend
      - run: pnpm exec playwright test --workers=1
        working-directory: frontend
      - uses: actions/upload-artifact@v4
        if: failure()
        with: { name: playwright-report, path: frontend/playwright-report }