name: CI

on:
  push:
    branches: [master]
  pull_request:
    branches: [master]

jobs:
  build-and-test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Setup .NET
        uses: actions/setup-dotnet@v4
        with:
          dotnet-version: '10.0.x'

      - name: Restore
        run: dotnet restore Lumeo.slnx

      - name: Build
        run: dotnet build Lumeo.slnx -c Release --no-restore -warnaserror

      - name: Test
        # Exclude Lumeo.Tests.E2E — those are Playwright tests that need browser
        # binaries + a running dev server (see tests/Lumeo.Tests.E2E/README.md).
        # The project still builds in the previous step, so compile breakage is
        # caught; only execution is skipped. Wire to a separate workflow when
        # ready to run them headless against a deployed preview.
        run: dotnet test Lumeo.slnx -c Release --no-build --verbosity normal --filter "FullyQualifiedName!~Lumeo.Tests.E2E"

      - name: Check vulnerable packages (shipped + tests, excluding E2E)
        # E2E test project pulls SixLabors.ImageSharp 3.x for perceptual visual
        # diffs (CVE-2024-2cmq-823j-5qj8 / CVE-2024-rxmq-m78w-7wmc). Both apply
        # to *malicious image decode*; our usage only loads locally-generated
        # Playwright screenshots, so attack surface is zero. ImageSharp 4.x
        # would fix this but requires a commercial Six Labors license. Scope
        # the vulnerability gate to projects we actually ship to users.
        run: |
          set -o pipefail
          dotnet list src/Lumeo/Lumeo.csproj package --vulnerable --include-transitive 2>&1 | tee vulnerable.txt
          dotnet list src/Lumeo.Charts/Lumeo.Charts.csproj package --vulnerable --include-transitive 2>&1 | tee -a vulnerable.txt
          dotnet list src/Lumeo.DataGrid/Lumeo.DataGrid.csproj package --vulnerable --include-transitive 2>&1 | tee -a vulnerable.txt
          dotnet list src/Lumeo.Editor/Lumeo.Editor.csproj package --vulnerable --include-transitive 2>&1 | tee -a vulnerable.txt
          dotnet list src/Lumeo.Scheduler/Lumeo.Scheduler.csproj package --vulnerable --include-transitive 2>&1 | tee -a vulnerable.txt
          dotnet list src/Lumeo.Gantt/Lumeo.Gantt.csproj package --vulnerable --include-transitive 2>&1 | tee -a vulnerable.txt
          dotnet list src/Lumeo.Motion/Lumeo.Motion.csproj package --vulnerable --include-transitive 2>&1 | tee -a vulnerable.txt
          ! grep -q "has the following vulnerable packages" vulnerable.txt
