ci.yml

name: CI/CD Pipeline

on:
  push:
    branches: [ master, develop ]
  pull_request:
    branches: [ master, develop ]

permissions:
  contents: read

env:
  DOTNET_VERSION: '10.0.x'
  DOTNET_SKIP_FIRST_TIME_EXPERIENCE: true
  DOTNET_CLI_TELEMETRY_OPTOUT: true
  DOTNET_NOLOGO: true
  CI_TEST_FILTER: 'Category!=Performance&Category!=Debug&Category!=Manual'
  MIN_LINE_COVERAGE_PERCENT: '60'

jobs:
  build:
    name: Build & Test
    runs-on: ${{ matrix.os }}
    timeout-minutes: 45
    strategy:
      fail-fast: false
      matrix:
        os: [ ubuntu-latest, windows-latest, macos-latest ]
        
    steps:
    - name: Checkout
      uses: actions/checkout@v4
      with:
        fetch-depth: 0
        
    - name: Setup .NET 10
      uses: actions/setup-dotnet@v4
      with:
        dotnet-version: '10.0.x'
        
    - name: Display .NET info
      run: dotnet --info
        
    - name: Restore dependencies
      run: dotnet restore SharpCoreDB.CI.slnf --configfile NuGet.Config
      
    - name: Fail on deprecated NuGet packages
      shell: pwsh
      run: |
        $output = dotnet list SharpCoreDB.CI.slnf package --deprecated --configfile NuGet.Config
        $outputText = $output | Out-String
        Write-Host $outputText

        if ($LASTEXITCODE -ne 0) {
          Write-Error "Failed to evaluate deprecated packages."
          exit $LASTEXITCODE
        }

        if ($outputText -match "has the following deprecated packages") {
          Write-Error "Deprecated NuGet packages detected. CI is configured to fail."
          exit 1
        }

        Write-Host "No deprecated NuGet packages detected."
      
    - name: Fail on vulnerable NuGet packages
      shell: pwsh
      run: |
        $output = dotnet list SharpCoreDB.CI.slnf package --vulnerable --configfile NuGet.Config
        $outputText = $output | Out-String
        Write-Host $outputText

        if ($LASTEXITCODE -ne 0) {
          Write-Error "Failed to evaluate vulnerable packages."
          exit $LASTEXITCODE
        }

        if ($outputText -match "has the following vulnerable packages") {
          Write-Error "Vulnerable NuGet packages detected. CI is configured to fail."
          exit 1
        }

        Write-Host "No vulnerable NuGet packages detected."
      
    - name: Build
      run: dotnet build SharpCoreDB.CI.slnf --configuration Release --no-restore /p:ContinuousIntegrationBuild=true

    - name: Test SharpCoreDB.Tests
      run: dotnet test tests/SharpCoreDB.Tests/SharpCoreDB.Tests.csproj --configuration Release --no-build --verbosity minimal --logger trx --results-directory ./TestResults/SharpCoreDB.Tests --collect:"XPlat Code Coverage" --filter "${{ env.CI_TEST_FILTER }}" --blame-hang --blame-hang-timeout 5m
      timeout-minutes: 30
      env:
        CI: "true"
        GITHUB_ACTIONS: "true"

    - name: Test SharpCoreDB.VectorSearch.Tests
      run: dotnet test tests/SharpCoreDB.VectorSearch.Tests/SharpCoreDB.VectorSearch.Tests.csproj --configuration Release --no-build --verbosity minimal --logger trx --results-directory ./TestResults/SharpCoreDB.VectorSearch.Tests --collect:"XPlat Code Coverage" --filter "${{ env.CI_TEST_FILTER }}" --blame-hang --blame-hang-timeout 5m
      timeout-minutes: 15
      env:
        CI: "true"
        GITHUB_ACTIONS: "true"

    - name: Validate coverage threshold
      if: matrix.os == 'ubuntu-latest'
      shell: python3 {0}
      run: |
        import glob
        import os
        import sys
        import xml.etree.ElementTree as ET

        threshold = float(os.environ.get("MIN_LINE_COVERAGE_PERCENT", "60"))
        files = glob.glob("**/TestResults/**/coverage.cobertura.xml", recursive=True)

        if not files:
          print("No coverage.cobertura.xml files found.", file=sys.stderr)
          sys.exit(1)

        covered = 0
        valid = 0
        for file in files:
          try:
            root = ET.parse(file).getroot()
            lines_valid = int(root.attrib.get("lines-valid", "0"))
            lines_covered = int(root.attrib.get("lines-covered", "0"))
            valid += lines_valid
            covered += lines_covered
            print(f"Coverage input: {file} -> {lines_covered}/{lines_valid}")
          except Exception as ex:
            print(f"Skipping unreadable coverage file {file}: {ex}")

        if valid == 0:
          print("Coverage reports found but lines-valid is 0.", file=sys.stderr)
          sys.exit(1)

        percent = (covered / valid) * 100.0
        print(f"Merged line coverage: {percent:.2f}% (threshold: {threshold:.2f}%)")

        if percent < threshold:
          print("Coverage threshold not met.", file=sys.stderr)
          sys.exit(1)

    - name: Upload test results
      if: always()
      uses: actions/upload-artifact@v4
      with:
        name: test-results-${{ matrix.os }}
        path: '**/TestResults/**/*.trx'
        if-no-files-found: ignore
        
    - name: Upload coverage
      if: matrix.os == 'ubuntu-latest'
      uses: codecov/codecov-action@v6
      with:
        files: '**/TestResults/**/coverage.cobertura.xml'
        flags: unittests
        name: codecov-umbrella
        fail_ci_if_error: false
        token: ${{ secrets.CODECOV_TOKEN }}

  pack:
    name: Pack NuGet Packages
    runs-on: ubuntu-latest
    needs: build
    if: github.event_name == 'push' && github.ref == 'refs/heads/master'
    
    steps:
    - name: Checkout
      uses: actions/checkout@v4
      with:
        fetch-depth: 0
        
    - name: Setup .NET 10
      uses: actions/setup-dotnet@v4
      with:
        dotnet-version: '10.0.x'
        
    - name: Pack NuGet packages
      run: dotnet pack SharpCoreDB.CI.slnf --configuration Release --output ./artifacts /p:ContinuousIntegrationBuild=true --configfile NuGet.Config