name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
  workflow_dispatch:

# 最小权限：构建/测试仅需读取仓库内容，显式声明以收敛默认的可写令牌。
permissions:
  contents: read

concurrency:
  group: ci-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  backend:
    name: Go Build & Test
    runs-on: ubuntu-latest
    timeout-minutes: 20
    steps:
      - uses: actions/checkout@v7

      - name: Set up Go
        uses: actions/setup-go@v7
        with:
          go-version: "1.25"
          cache-dependency-path: server/go.sum

      - name: Verify modules
        working-directory: server
        run: go mod verify

      - name: Check formatting
        working-directory: server
        run: |
          unformatted="$(gofmt -l .)"
          if [ -n "$unformatted" ]; then
            printf '%s\n' "$unformatted"
            exit 1
          fi

      - name: Vet
        working-directory: server
        run: go vet ./...

      - name: Build
        working-directory: server
        run: go build ./...

      - name: Test
        working-directory: server
        run: go test ./... -v

  backend-windows:
    name: Go Test (Windows)
    runs-on: windows-latest
    timeout-minutes: 20
    steps:
      - uses: actions/checkout@v7

      - name: Set up Go
        uses: actions/setup-go@v7
        with:
          go-version: "1.25"
          cache-dependency-path: server/go.sum

      - name: Verify modules
        working-directory: server
        run: go mod verify

      - name: Build
        working-directory: server
        run: go build ./...

      - name: Test
        working-directory: server
        run: go test ./...

  frontend:
    name: React Build & Test
    runs-on: ubuntu-latest
    timeout-minutes: 20
    steps:
      - uses: actions/checkout@v7

      - name: Set up Node.js
        uses: actions/setup-node@v7
        with:
          node-version: "24"
          cache: "npm"
          cache-dependency-path: web/package-lock.json

      - name: Install dependencies
        working-directory: web
        run: npm ci

      - name: Audit production dependencies
        working-directory: web
        run: npm audit --omit=dev --audit-level=high

      - name: Lint and formatting
        working-directory: web
        run: npm run lint && npm run format:check

      - name: Test
        working-directory: web
        run: npm run test

      - name: Type Check & Build
        working-directory: web
        run: npm run build

  docs:
    name: Documentation Build
    runs-on: ubuntu-latest
    timeout-minutes: 20
    steps:
      - uses: actions/checkout@v7

      - name: Set up Node.js
        uses: actions/setup-node@v7
        with:
          node-version: "24"
          cache: "npm"
          cache-dependency-path: docs-site/package-lock.json

      - name: Install dependencies
        working-directory: docs-site
        run: npm ci

      - name: Type Check & Build
        working-directory: docs-site
        run: npm run typecheck && npm run build

  container:
    name: Container Build
    needs: [backend, backend-windows, frontend, docs]
    runs-on: ubuntu-latest
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@v7

      - name: Validate Compose configuration
        run: docker compose config --quiet

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v4

      - name: Build image
        uses: docker/build-push-action@v7
        with:
          context: .
          push: false
          tags: backupx:ci
          cache-from: type=gha,scope=backupx-ci
          cache-to: type=gha,mode=max,scope=backupx-ci