name: Test and SonarQube

on:
  push:
    branches: [main]
  workflow_dispatch:

permissions:
  contents: read

jobs:
  quality:
    runs-on: ubuntu-latest
    steps:
      - name: Check out repository
        uses: actions/checkout@v4
        with:
          # Full history so SonarQube can attribute issues to commits (blame).
          fetch-depth: 0

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: '3.11'

      - name: Set up Node
        uses: actions/setup-node@v4
        with:
          node-version: '20'

      - name: Install Node dependencies
        run: npm ci || npm install

      # Checks that run without a live server. The Playwright suite in tests/
      # drives the running application (Docker, port 7890) and cannot execute
      # on a bare CI runner, so it is deliberately NOT wired in here — a step
      # that always fails would make the Quality Gate meaningless. Wire it up
      # once the app can be started in CI.
      - name: Verify Python sources compile
        run: python -m compileall -q core routes scripts server.py ttsvc_cli.py

      - name: Run Python security regressions
        run: python -m unittest discover -s tests -p 'test_*.py'

      - name: Verify JavaScript parses
        run: |
          for f in $(git ls-files 'static/js/*.js' 'scripts/*.mjs'); do
            node --check "$f" || exit 1
          done

      - name: Run frontend collision and manifest checks
        run: npm run check:frontend

      - name: Build the frontend bundle
        run: node scripts/minify.mjs

      # Advisory until pre-existing failures are fixed (see architecture/qa.md).
      - name: Central QA (fast)
        continue-on-error: true
        run: npm run qa -- --fast

      - name: SonarQube scan
        uses: SonarSource/sonarqube-scan-action@v8.1.0
        env:
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
          SONAR_HOST_URL: ${{ vars.SONAR_HOST_URL }}
        with:
          # Project key, sources and exclusions live in sonar-project.properties
          # so they stay identical for local and CI scans.
          args: >-
            -Dsonar.qualitygate.wait=true
            -Dsonar.qualitygate.timeout=300