name: "make"
on:
  push:
    branches:
      - "main"
  pull_request:
    branches:
      - "main"

jobs:
  release-snapshot:
    name: "release-snapshot"
    runs-on: "ubuntu-24.04"
    permissions:
      contents: "read"
      packages: "write"
      id-token: "write"
    steps:
      - uses: "actions/checkout@v4"
        with:
          fetch-depth: 0
      - uses: "actions/setup-go@v5"
        with:
          go-version: "1.25"
      - uses: "actions/setup-node@v4"
        with:
          node-version-file: ".nvmrc"
      - run: "npm ci"
      - uses: "docker/setup-qemu-action@v3"
      - uses: "docker/setup-buildx-action@v3"
      - uses: "sigstore/cosign-installer@v3"
      - uses: "anchore/sbom-action/download-syft@v0"
      - uses: "goreleaser/goreleaser-action@v6"
        with:
          distribution: "goreleaser"
          version: "~> v2"
          args: "release --clean --snapshot"
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      - uses: "aquasecurity/trivy-action@0.28.0"
        with:
          image-ref: "ghcr.io/getprobo/probo:latest-amd64"
          format: "table"
          exit-code: 1
          ignore-unfixed: true
          vuln-type: "os,library"
          severity: "CRITICAL,HIGH"

  test:
    name: "test"
    runs-on: "ubuntu-22.04"
    permissions:
      contents: "read"
    steps:
      - uses: "actions/checkout@v4"
      - uses: "actions/setup-go@v5"
        with:
          go-version: "1.25"
      - uses: "actions/setup-node@v4"
        with:
          node-version-file: ".nvmrc"
      - run: "npm ci"
      - run: "make build"
      - run: "make test"
      - run: "make coverage-report"
      - name: "Upload coverage reports"
        uses: "actions/upload-artifact@v4"
        with:
          name: "coverage-reports"
          path: |
            coverage.out
            coverage.html
          retention-days: 30
      - run: "make lint"

  vulnerability-scan:
    name: "vulnerability-scan"
    runs-on: "ubuntu-24.04"
    permissions:
      contents: "read"
    steps:
      - uses: "actions/checkout@v4"
        with:
          fetch-depth: 0
      - uses: "actions/setup-go@v5"
        with:
          go-version: "1.25"
      - uses: "actions/setup-node@v4"
        with:
          node-version: 22
      - run: "npm ci"
      - name: "Install Syft"
        uses: "anchore/sbom-action/download-syft@v0"
      - name: "Install Grype"
        run: |
          curl -sSfL https://raw.githubusercontent.com/anchore/grype/v0.85.0/install.sh | sh -s -- -b /usr/local/bin
      - name: "Generate SBOM"
        run: |
          syft dir:. --output cyclonedx-json --source-name probo --source-version ${{ github.sha }} > sbom.json
      - name: "Scan SBOM for vulnerabilities"
        run: |
          echo "Scanning SBOM for vulnerabilities..."
          grype sbom:sbom.json --fail-on critical --output table
          echo "Vulnerability scan completed successfully - no critical vulnerabilities found"