# Woodpecker CI Quality Enforcement Pipeline
# Runs on: push, pull_request, manual

when:
  - event: [push, pull_request, manual]

variables:
  - &node_image 'node:20-alpine'
  - &gitleaks_image 'ghcr.io/gitleaks/gitleaks:v8.24.0'
  - &install_deps |
    corepack enable
    npm ci --ignore-scripts

steps:
  # Secret scanning (runs in parallel with install, no deps)
  secret-scan:
    image: *gitleaks_image
    commands:
      - gitleaks git --redact --verbose --log-opts="HEAD~1..HEAD"
    depends_on: []

  # Stage 1: Install
  install:
    image: *node_image
    commands:
      - *install_deps

  # Stage 2: Security Audit
  security-audit:
    image: *node_image
    commands:
      - *install_deps
      - npm audit --audit-level=high
    depends_on:
      - install

  # Stage 3: Lint
  lint:
    image: *node_image
    commands:
      - *install_deps
      - npm run lint
    depends_on:
      - install

  # Stage 4: Type Check
  typecheck:
    image: *node_image
    commands:
      - *install_deps
      - npm run type-check
    depends_on:
      - install

  # Stage 5: Test with Coverage
  test:
    image: *node_image
    commands:
      - *install_deps
      - npm run test -- --coverage --coverageThreshold='{"global":{"branches":80,"functions":80,"lines":80,"statements":80}}'
    depends_on:
      - install

  # Stage 6: Build
  build:
    image: *node_image
    commands:
      - *install_deps
      - npm run build
    depends_on:
      - lint
      - typecheck
      - test
      - security-audit
      - secret-scan
