name: Frontend

on:
  push:
    paths:
      - "apps/frontend/**"
      - ".github/workflows/frontend.yml"
  pull_request:
    paths:
      - "apps/frontend/**"
      - ".github/workflows/frontend.yml"

permissions:
  contents: read

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
      - uses: actions/setup-node@v6
        with:
          node-version: 24
          cache: npm
          cache-dependency-path: apps/frontend/package-lock.json

      - run: npm ci
        working-directory: apps/frontend
      - run: npm run build
        working-directory: apps/frontend

  security-audit:
    name: Audit des dépendances
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
      - uses: actions/setup-node@v6
        with:
          node-version: 24
      # Seuil high : une vulnérabilité moderate de devDependency ne doit pas bloquer une livraison.
      - run: npm audit --audit-level=high --package-lock-only
        working-directory: apps/frontend

  test:
    needs: build
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
      - uses: actions/setup-node@v6
        with:
          node-version: 24
          cache: npm
          cache-dependency-path: apps/frontend/package-lock.json
      - run: npm ci
        working-directory: apps/frontend
      - run: npm test --watch=false --code-coverage --coverageReporters=lcov
        working-directory: apps/frontend
      - name: Upload coverage
        uses: actions/upload-artifact@v4
        with:
          name: frontend-coverage
          path: apps/frontend/coverage/frontend/lcov.info

  sonarqube:
    needs: [build, test]
    name: SonarQube
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
        with:
          fetch-depth: 0
      - name: Download coverage
        uses: actions/download-artifact@v4
        with:
          name: frontend-coverage
          path: apps/frontend/coverage/frontend
      - name: SonarQube Scan
        uses: SonarSource/sonarqube-scan-action@v8
        env:
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}