# Woodpecker CI Quality Enforcement Pipeline - Monorepo
when:
  - event: [push, pull_request, manual]

# Dependencies are installed ONCE in the `install` step and every downstream
# step depends on it, reusing the populated node_modules from the shared
# workspace volume. Do NOT re-run `npm ci` per step — that pays the full cold
# install (network fetch + native rebuilds) N times and is the dominant cost
# in a pipeline.
#
# For best results, replace `&node_image` with a pre-baked CI base image that
# ships your toolchain (python3/make/g++ for native modules) and a warm npm
# cache, then keep `--prefer-offline` so installs resolve from the cache. See
# the Mosaic Stack repo's Dockerfile.ci + .woodpecker/ci-image.yml for the
# baked-image pattern.
variables:
  - &node_image 'node:20-alpine'
  - &gitleaks_image 'ghcr.io/gitleaks/gitleaks:v8.24.0'

steps:
  # Secret scanning (runs in parallel with install, no deps)
  secret-scan:
    image: *gitleaks_image
    commands:
      - gitleaks git --redact --verbose --log-opts="HEAD~1..HEAD"
    depends_on: []

  # Single cached install. Every other step depends on this and reuses the
  # node_modules it produces in the shared workspace.
  install:
    image: *node_image
    commands:
      - corepack enable
      - npm ci --ignore-scripts --prefer-offline
    depends_on: []

  security-audit:
    image: *node_image
    commands:
      - npm audit --audit-level=high
    depends_on:
      - install

  lint:
    image: *node_image
    environment:
      SKIP_ENV_VALIDATION: 'true'
    commands:
      - npm run lint
    depends_on:
      - install

  typecheck:
    image: *node_image
    environment:
      SKIP_ENV_VALIDATION: 'true'
    commands:
      - npm run type-check
    depends_on:
      - install

  test:
    image: *node_image
    environment:
      SKIP_ENV_VALIDATION: 'true'
    commands:
      - npm run test -- --coverage --coverageThreshold='{"global":{"branches":80,"functions":80,"lines":80,"statements":80}}'
    depends_on:
      - install

  build:
    image: *node_image
    environment:
      SKIP_ENV_VALIDATION: 'true'
      NODE_ENV: 'production'
    commands:
      - npm run build
    depends_on:
      - lint
      - typecheck
      - test
      - security-audit
      - secret-scan
