backend/.gitea/workflows/verify.yml

name: Backend verify

on:
  push:
    branches: [develop, main]
  pull_request:
    types: [opened, synchronize, reopened, edited]
  schedule:
    - cron: '47 5 * * *'

# Gitea >= 1.26. A new revision supersedes only the same PR/branch/event.
concurrency:
  group: backend-verify-${{ gitea.event_name }}-${{ gitea.event.pull_request.number || gitea.ref }}
  cancel-in-progress: true

jobs:
  commits:
    if: gitea.event_name == 'pull_request'
    timeout-minutes: 15
    runs-on: ubuntu-latest
    steps:
      - uses: https://github.com/actions/checkout@v4
        with:
          ref: ${{ github.event.pull_request.head.sha }}
          fetch-depth: 0
      - uses: https://github.com/actions/setup-node@v4
        with:
          node-version-file: .nvmrc
      - run: npm ci --ignore-scripts
      - name: Check PR title and commits
        env:
          PR_TITLE: ${{ github.event.pull_request.title }}
          BASE_SHA: ${{ github.event.pull_request.base.sha }}
          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
        run: |
          printf '%s\n' "$PR_TITLE" | npm run commitlint -- --strict
          npm run commitlint -- --strict --from "$BASE_SHA" --to "$HEAD_SHA"

  security:
    needs: commits
    if: >-
      !cancelled() &&
      gitea.event.action != 'edited' &&
      (needs.commits.result == 'success' || needs.commits.result == 'skipped')
    timeout-minutes: 15
    runs-on: ubuntu-latest
    steps:
      - uses: https://github.com/actions/checkout@v4
        with:
          fetch-depth: 0
      - name: Record checked revision
        run: git rev-parse HEAD
      - name: Scan history with Gitleaks 8.30.1
        run: |
          curl --fail --location --silent --show-error https://github.com/gitleaks/gitleaks/releases/download/v8.30.1/gitleaks_8.30.1_linux_x64.tar.gz -o /tmp/gitleaks.tar.gz
          echo '551f6fc83ea457d62a0d98237cbad105af8d557003051f41f3e7ca7b3f2470eb  /tmp/gitleaks.tar.gz' | sha256sum --check
          mkdir -p /tmp/gitleaks-bin
          tar -xzf /tmp/gitleaks.tar.gz -C /tmp/gitleaks-bin gitleaks
          /tmp/gitleaks-bin/gitleaks git --log-opts=--all --redact=100 --no-banner
      - uses: https://github.com/actions/setup-node@v4
        with:
          node-version-file: .nvmrc
      - name: Audit runtime and development dependencies
        run: |
          npm audit --omit=dev --audit-level=low
          npm audit --include=dev --audit-level=high --ignore-advisory=GHSA-hp3w-g68c-fv3c

  verify:
    needs: [commits, security]
    if: >-
      !cancelled() && gitea.event.action != 'edited' &&
      needs.security.result == 'success' &&
      gitea.event_name != 'schedule'
    timeout-minutes: 45
    runs-on: ubuntu-latest
    steps:
      - uses: https://github.com/actions/checkout@v4
        with:
          fetch-depth: 0
      - name: Record checked revision
        run: git rev-parse HEAD
      - uses: https://github.com/actions/setup-node@v4
        with:
          node-version-file: .nvmrc
      - run: npm ci
      - name: Generate Prisma client before typechecks
        run: npx --no-install prisma generate
      - name: Run all backend gates
        run: npm run verify
      - name: Run isolated SQLite and runtime OpenAPI suites
        run: npm run test:e2e
      - name: Analyze develop with SonarQube
        if: gitea.event_name == 'push' && gitea.ref == 'refs/heads/develop'
        # v2.3.0: same Docker-based scanner used for SonarQube 9.9.
        uses: https://github.com/SonarSource/sonarqube-scan-action@aecaf43ae57e412bd97d70ef9ce6076e672fe0a9
        env:
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
        with:
          args: -Dsonar.qualitygate.wait=true