name: VibeGuard Security & Quality

on:
  push:
    branches: [main, master, develop]
  pull_request:
    branches: [main, master]

permissions:
  contents: read
  security-events: write

jobs:
  vibeguard:
    name: Security & Quality Check
    runs-on: ubuntu-latest

    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '20'
          cache: 'npm'

      - name: Install dependencies
        run: npm ci

      - name: Install VibeGuard
        run: npm install -g vibeguard

      - name: Install security tools
        run: |
          # Install gitleaks
          GITLEAKS_VERSION="8.18.0"
          curl -sSfL "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz" | tar -xz
          sudo mv gitleaks /usr/local/bin/

          # Install osv-scanner
          OSV_VERSION="1.7.0"
          curl -sSfL "https://github.com/google/osv-scanner/releases/download/v${OSV_VERSION}/osv-scanner_linux_amd64" -o osv-scanner
          chmod +x osv-scanner
          sudo mv osv-scanner /usr/local/bin/

          # Install semgrep
          pip install semgrep

      - name: Run VibeGuard Check
        id: vibeguard
        run: |
          vg ci --format sarif > vibeguard-results.sarif || true
          vg ci --format json > vibeguard-results.json || true

      - name: Upload SARIF to GitHub Security
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: vibeguard-results.sarif
        if: always()
        continue-on-error: true

      - name: Upload results artifact
        uses: actions/upload-artifact@v4
        with:
          name: vibeguard-results
          path: |
            vibeguard-results.sarif
            vibeguard-results.json
        if: always()

      - name: VibeGuard CI (blocking)
        run: vg ci --fail-on error

  # Optional: Run on PR changes only (faster)
  vibeguard-pr:
    name: PR Quick Check
    runs-on: ubuntu-latest
    if: github.event_name == 'pull_request'

    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '20'
          cache: 'npm'

      - name: Install dependencies
        run: npm ci

      - name: Install VibeGuard
        run: npm install -g vibeguard

      - name: Run quick check on changed files
        run: vg check --changed