name: CI

on:
  push:
    branches: [dev, main]
  pull_request:
    branches: [dev, main]

concurrency:
  group: ci-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: read

jobs:
  gitleaks:
    name: Detecção de segredos
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
        with:
          fetch-depth: 0

      # Usa o binário OSS do gitleaks diretamente (Apache-2.0), em vez da
      # action gitleaks/gitleaks-action@v2, que passou a exigir licença paga
      # para repositórios de organização a partir da v2.
      - name: Instalar gitleaks
        run: |
          VERSION=$(curl -fsSL https://api.github.com/repos/gitleaks/gitleaks/releases/latest | grep -Po '"tag_name": "v\K[^"]*')
          curl -fsSL "https://github.com/gitleaks/gitleaks/releases/download/v${VERSION}/gitleaks_${VERSION}_linux_x64.tar.gz" -o gitleaks.tar.gz
          tar -xzf gitleaks.tar.gz gitleaks
          sudo install -m 755 gitleaks /usr/local/bin/gitleaks
          gitleaks version

      - name: Rodar gitleaks
        run: gitleaks detect --source . --config .gitleaks.toml --redact --verbose

  build-and-test:
    name: Lint, typecheck, testes e build
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7

      - uses: pnpm/action-setup@v6

      - uses: actions/setup-node@v7
        with:
          node-version: 22
          cache: pnpm

      - name: Instalar dependências
        run: pnpm install --frozen-lockfile

      - name: Formatação
        run: pnpm format:check

      - name: Lint
        run: pnpm lint

      - name: Typecheck
        run: pnpm typecheck

      - name: Build
        run: pnpm build

      - name: Testes com cobertura
        run: pnpm test:coverage

      - name: Publicar relatório de cobertura
        uses: actions/upload-artifact@v7
        if: always()
        with:
          name: coverage-report
          path: coverage/
          retention-days: 7