name: 🚦 Security & Quality Gate

on:
  pull_request:
    types: [opened, edited, synchronize, reopened]
    branches: [develop, master]
  workflow_dispatch:
  push:
    branches: [develop]

permissions:
  contents: read

jobs:
  validate_pr_title:
    name: "📝 Validate PR Title"
    if: github.event_name == 'pull_request'
    runs-on: ubuntu-24.04
    permissions:
      pull-requests: write
      contents: read
    steps:
      - uses: amannn/action-semantic-pull-request@48f256284bd46cdaab1048c3721360e808335d50 # v6.1.1
        id: lint_pr_title
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - uses: marocchino/sticky-pull-request-comment@0ea0beb66eb9baf113663a64ec522f60e49231c0 # v3.0.4
        if: always() && (steps.lint_pr_title.outputs.error_message != null)
        with:
          header: pr-title-lint-error
          message: |
            Hey there and thank you for opening this pull request! 👋🏼
            We require pull request titles to follow the [Conventional Commits specification](https://www.conventionalcommits.org/en/v1.0.0/).

            **Error details:**
            ```
            ${{ steps.lint_pr_title.outputs.error_message }}
            ```

      - if: ${{ steps.lint_pr_title.outputs.error_message == null }}
        uses: marocchino/sticky-pull-request-comment@0ea0beb66eb9baf113663a64ec522f60e49231c0 # v3.0.4
        with:
          header: pr-title-lint-error
          delete: true

  dependency-review:
    name: 🔍 Vulnerable Dependencies
    runs-on: ubuntu-24.04
    permissions:
      contents: read
    steps:
      - name: Checkout Repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          ref: ${{ github.event.pull_request.head.sha || github.sha }}
          fetch-depth: 0

      - name: Dependency Review
        uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0
        with:
          fail-on-severity: high
          base-ref: ${{ github.event.pull_request.base.sha || 'develop' }}
          head-ref: ${{ github.event.pull_request.head.sha || github.ref }}

  expo-doctor:
    name: 🚑 Expo Doctor Check
    if: false
    runs-on: ubuntu-24.04
    steps:
      - name: 🛒 Checkout repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          ref: ${{ github.event.pull_request.head.sha || github.sha }}
          submodules: recursive
          fetch-depth: 0

      - name: 🍞 Setup Bun
        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
        with:
          bun-version: latest

      - name: 📦 Install dependencies (bun)
        run: bun install --frozen-lockfile

      - name: 🚑 Run Expo Doctor
        run: bun expo-doctor

  code_quality:
    name: "🔍 Lint & Test (${{ matrix.command }})"
    runs-on: ubuntu-24.04
    strategy:
      fail-fast: false
      matrix:
        command:
          - "lint"
          - "check"
          - "format"
          - "typecheck"

    steps:
      - name: "📥 Checkout PR code"
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          ref: ${{ github.event.pull_request.head.sha || github.sha }}
          submodules: recursive
          fetch-depth: 0

      - name: "🟢 Setup Node.js"
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version: '24.x'

      - name: "🍞 Setup Bun"
        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
        with:
          bun-version: latest

      - name: "📦 Install dependencies"
        run: bun install --frozen-lockfile

      - name: "🚨 Run ${{ matrix.command }}"
        run: bun run ${{ matrix.command }}
