code-quality-gates.yml

name: Code Quality Gates

on:
  push:
    branches: ['**']
  pull_request:
    branches: [main]

env:
  COVERAGE_THRESHOLD: 85
  COMPLEXITY_THRESHOLD: 10

jobs:
  eslint-frontend:
    name: ESLint - Frontend Code Quality
    runs-on: ubuntu-latest

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Set up Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '20'
          cache: 'npm'

      - name: Install dependencies
        run: npm install

      - name: Run ESLint
        id: eslint
        run: |
          npm run lint --workspace=apps/frontend -- --format json --output-file eslint-report.json || true

          # Parse and display results
          node -e "
            const fs = require('fs');
            const report = JSON.parse(fs.readFileSync('eslint-report.json', 'utf8'));
            let errors = 0, warnings = 0;
            
            report.forEach(file => {
              errors += file.errorCount;
              warnings += file.warningCount;
            });
            
            console.log(\`ESLint Results: \${errors} errors, \${warnings} warnings\`);
            
            if (errors > 0) {
              console.log('::error::ESLint found errors');
              process.exit(1);
            }
          "

      - name: Upload ESLint report
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: eslint-report
          path: eslint-report.json
          retention-days: 30

  eslint-backend:
    name: ESLint - Backend Code Quality
    runs-on: ubuntu-latest

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Set up Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '20'
          cache: 'npm'

      - name: Install dependencies
        run: npm install

      - name: Run ESLint
        id: eslint
        run: |
          npm run lint --workspace=apps/backend -- --format json --output-file eslint-report.json || true

          # Parse and display results
          node -e "
            const fs = require('fs');
            const report = JSON.parse(fs.readFileSync('eslint-report.json', 'utf8'));
            let errors = 0, warnings = 0;
            
            report.forEach(file => {
              errors += file.errorCount;
              warnings += file.warningCount;
            });
            
            console.log(\`ESLint Results: \${errors} errors, \${warnings} warnings\`);
            
            if (errors > 0) {
              console.log('::error::ESLint found errors');
              process.exit(1);
            }
          "

      - name: Upload ESLint report
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: eslint-backend-report
          path: eslint-report.json
          retention-days: 30

  clippy-contracts:
    name: Clippy - Rust Contract Quality
    runs-on: ubuntu-latest

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Set up Rust toolchain
        uses: dtolnay/rust-toolchain@stable
        with:
          targets: wasm32-unknown-unknown
          components: clippy

      - name: Cache Rust dependencies
        uses: Swatinem/rust-cache@v2
        with:
          workspaces: |
            contracts

      - name: Run Clippy
        run: cargo clippy --workspace --all-targets -- -D warnings

  code-coverage:
    name: Code Coverage Analysis
    runs-on: ubuntu-latest

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Set up Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '20'
          cache: 'npm'

      - name: Install dependencies
        run: npm install

      - name: Generate frontend coverage
        run: npm run test:coverage:frontend

      - name: Generate backend coverage
        run: npm run test:coverage:backend

      - name: Generate SDK coverage
        run: npm run test:coverage --workspace=packages/sdk

      - name: Check coverage thresholds
        run: |
          node <<'NODE'
          const fs = require('fs');
          const threshold = Number(process.env.COVERAGE_THRESHOLD);
          const workspaces = [
            ['Frontend', 'apps/frontend/coverage/coverage-summary.json'],
            ['Backend', 'apps/backend/coverage/coverage-summary.json'],
            ['SDK', 'packages/sdk/coverage/coverage-summary.json'],
          ];
          let failed = false;

          for (const [name, reportPath] of workspaces) {
            if (!fs.existsSync(reportPath)) {
              console.error(`::error::${name} coverage report is missing: ${reportPath}`);
              failed = true;
              continue;
            }

            const report = JSON.parse(fs.readFileSync(reportPath, 'utf8'));
            const lines = report.total?.lines?.pct;
            if (typeof lines !== 'number') {
              console.error(`::error::${name} coverage report has no total line percentage`);
              failed = true;
              continue;
            }

            console.log(`${name} line coverage: ${lines}% (minimum ${threshold}%)`);
            if (lines < threshold) {
              console.error(`::error::${name} line coverage is below ${threshold}%`);
              failed = true;
            }
          }

          if (failed) process.exit(1);
          NODE
        env:
          COVERAGE_THRESHOLD: ${{ env.COVERAGE_THRESHOLD }}

      - name: Upload coverage reports
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: coverage-reports
          path: |
            apps/backend/coverage/
            apps/frontend/coverage/
            packages/sdk/coverage/
          retention-days: 30

  contracts-coverage:
    name: Contracts Coverage
    runs-on: ubuntu-latest

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Set up Rust toolchain
        uses: dtolnay/rust-toolchain@stable
        with:
          components: llvm-tools-preview

      - name: Cache Rust dependencies
        uses: Swatinem/rust-cache@v2

      - name: Install cargo-llvm-cov
        uses: taiki-e/install-action@v2
        with:
          tool: cargo-llvm-cov

      - name: Generate contract coverage and enforce threshold
        run: |
          set -o pipefail
          cargo llvm-cov \
            --workspace \
            --all-features \
            --summary-only \
            --fail-under-lines "$COVERAGE_THRESHOLD" \
            -- --test-threads=1 \
            2>&1 | tee contracts-coverage-summary.txt
          echo "Contract line coverage minimum: ${COVERAGE_THRESHOLD}%"

      - name: Upload contract coverage report
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: contracts-coverage-report
          path: contracts-coverage-summary.txt
          retention-days: 30

      - name: Add contract coverage to workflow summary
        if: always()
        run: |
          echo "## Contract Coverage" >> "$GITHUB_STEP_SUMMARY"
          echo "Minimum line coverage: **${COVERAGE_THRESHOLD}%**" >> "$GITHUB_STEP_SUMMARY"
          if [ -f contracts-coverage-summary.txt ]; then
            echo '```' >> "$GITHUB_STEP_SUMMARY"
            tail -20 contracts-coverage-summary.txt >> "$GITHUB_STEP_SUMMARY"
            echo '```' >> "$GITHUB_STEP_SUMMARY"
          fi

  complexity-analysis:
    name: Complexity Analysis
    runs-on: ubuntu-latest

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Set up Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '20'
          cache: 'npm'

      - name: Install dependencies
        run: npm install

      - name: Install complexity analyzer
        run: npm install -g complexity-report

      - name: Analyze backend complexity
        run: |
          complexity-report --format json --output backend-complexity.json apps/backend/src || true

          node -e "
            const fs = require('fs');
            const threshold = ${{ env.COMPLEXITY_THRESHOLD }};
            
            try {
              const report = JSON.parse(fs.readFileSync('backend-complexity.json', 'utf8'));
              let highComplexity = [];
              
              report.forEach(file => {
                if (file.complexity > threshold) {
                  highComplexity.push(\`\${file.name}: \${file.complexity}\`);
                }
              });
              
              if (highComplexity.length > 0) {
                console.log('::warning::High complexity files detected:');
                highComplexity.forEach(f => console.log(\`  - \${f}\`));
              }
            } catch (e) {
              console.log('Complexity analysis skipped');
            }
          "
        continue-on-error: true

      - name: Upload complexity report
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: complexity-report
          path: backend-complexity.json
          retention-days: 30

  quality-gates-summary:
    name: Quality Gates Summary
    runs-on: ubuntu-latest
    needs: [eslint-frontend, eslint-backend, clippy-contracts, code-coverage, contracts-coverage, complexity-analysis]
    if: always()

    steps:
      - name: Generate quality report
        run: |
          echo "## 📊 Code Quality Gates Report" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "| Check | Status |" >> $GITHUB_STEP_SUMMARY
          echo "|-------|--------|" >> $GITHUB_STEP_SUMMARY
          echo "| ESLint (Frontend) | ${{ needs.eslint-frontend.result }} |" >> $GITHUB_STEP_SUMMARY
          echo "| ESLint (Backend) | ${{ needs.eslint-backend.result }} |" >> $GITHUB_STEP_SUMMARY
          echo "| Clippy (Contracts) | ${{ needs.clippy-contracts.result }} |" >> $GITHUB_STEP_SUMMARY
          echo "| JavaScript Workspace Coverage | ${{ needs.code-coverage.result }} |" >> $GITHUB_STEP_SUMMARY
          echo "| Contract Coverage | ${{ needs.contracts-coverage.result }} |" >> $GITHUB_STEP_SUMMARY
          echo "| Complexity Analysis | ${{ needs.complexity-analysis.result }} |" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "### Quality Standards" >> $GITHUB_STEP_SUMMARY
          echo "- **Coverage Threshold:** ${{ env.COVERAGE_THRESHOLD }}%" >> $GITHUB_STEP_SUMMARY
          echo "- **Complexity Threshold:** ${{ env.COMPLEXITY_THRESHOLD }}" >> $GITHUB_STEP_SUMMARY
          echo "- **Linting:** Strict mode (errors block merge)" >> $GITHUB_STEP_SUMMARY

      - name: Fail if quality gates failed
        if: |
          always() && (
            needs.eslint-frontend.result == 'failure' ||
            needs.eslint-backend.result == 'failure' ||
            needs.clippy-contracts.result == 'failure' ||
            needs.code-coverage.result == 'failure' ||
            needs.contracts-coverage.result == 'failure'
          )
        run: |
          echo "❌ Code quality gates failed"
          exit 1

      - name: Comment PR with quality report
        if: github.event_name == 'pull_request'
        uses: actions/github-script@v7
        with:
          script: |
            const summary = `
            ## 📊 Code Quality Gates

            | Check | Status |
            |-------|--------|
            | ESLint (Frontend) | ${{ needs.eslint-frontend.result }} |
            | ESLint (Backend) | ${{ needs.eslint-backend.result }} |
            | Clippy (Contracts) | ${{ needs.clippy-contracts.result }} |
            | JavaScript Workspace Coverage | ${{ needs.code-coverage.result }} |
            | Contract Coverage | ${{ needs.contracts-coverage.result }} |
            | Complexity Analysis | ${{ needs.complexity-analysis.result }} |

            ### Quality Standards
            - **Coverage Threshold:** ${{ env.COVERAGE_THRESHOLD }}%
            - **Complexity Threshold:** ${{ env.COMPLEXITY_THRESHOLD }}
            - **Linting:** Strict mode (errors block merge)

            [View detailed reports](https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }})
            `;

            await github.rest.issues.createComment({
              issue_number: context.issue.number,
              owner: context.repo.owner,
              repo: context.repo.repo,
              body: summary
            });