ci.yml

name: CI - Build & Test

on:
  push:
    branches: [ main, develop ]
  pull_request:
    branches: [ main, develop ]
  workflow_dispatch:

jobs:
  detect-and-build:
    runs-on: ubuntu-latest
    
    strategy:
      matrix:
        node-version: [18.x, 20.x]
      fail-fast: false
    
    steps:
      - name: Checkout código
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: ${{ matrix.node-version }}
          cache: 'npm'
        if: hashFiles('**/package.json') != ''

      - name: Setup Python
        uses: actions/setup-python@v5
        with:
          python-version: '3.11'
          cache: 'pip'
        if: hashFiles('**/requirements.txt', '**/pyproject.toml', '**/setup.py') != ''

      - name: Setup .NET
        uses: actions/setup-dotnet@v4
        with:
          dotnet-version: '8.0.x'
        if: hashFiles('**/*.csproj', '**/*.sln') != ''

      - name: Setup Java
        uses: actions/setup-java@v4
        with:
          java-version: '17'
          distribution: 'temurin'
          cache: 'maven'
        if: hashFiles('**/pom.xml', '**/build.gradle') != ''

      - name: Setup Go
        uses: actions/setup-go@v5
        with:
          go-version: '1.21'
          cache: true
        if: hashFiles('**/go.mod') != ''

      # NODE.JS / JAVASCRIPT / TYPESCRIPT
      - name: Instalar dependências Node.js
        if: hashFiles('**/package.json') != ''
        run: |
          if [ -f "package-lock.json" ]; then
            npm ci
          elif [ -f "yarn.lock" ]; then
            npm install -g yarn
            yarn install --frozen-lockfile
          elif [ -f "pnpm-lock.yaml" ]; then
            npm install -g pnpm
            pnpm install --frozen-lockfile
          else
            npm install
          fi

      - name: Lint Node.js
        if: hashFiles('**/package.json') != ''
        continue-on-error: true
        run: |
          if grep -q "\"lint\"" package.json; then
            npm run lint
          fi

      - name: Build Node.js/Frontend
        if: hashFiles('**/package.json') != ''
        run: |
          if grep -q "\"build\"" package.json; then
            npm run build
          fi

      - name: Testes Node.js
        if: hashFiles('**/package.json') != ''
        continue-on-error: true
        run: |
          if grep -q "\"test\"" package.json; then
            npm test
          fi

      # PYTHON
      - name: Instalar dependências Python
        if: hashFiles('**/requirements.txt', '**/pyproject.toml', '**/setup.py') != ''
        run: |
          python -m pip install --upgrade pip
          if [ -f "requirements.txt" ]; then
            pip install -r requirements.txt
          fi
          if [ -f "requirements-dev.txt" ]; then
            pip install -r requirements-dev.txt
          fi
          if [ -f "pyproject.toml" ]; then
            pip install -e .
          fi

      - name: Lint Python
        if: hashFiles('**/requirements.txt', '**/pyproject.toml', '**/setup.py') != ''
        continue-on-error: true
        run: |
          if python -c "import flake8" 2>/dev/null; then
            flake8 . --count --select=E9,F63,F7,F82 --show-source --statistics
          fi

      - name: Testes Python
        if: hashFiles('**/requirements.txt', '**/pyproject.toml', '**/setup.py') != ''
        continue-on-error: true
        run: |
          if python -c "import pytest" 2>/dev/null; then
            pytest
          elif python -c "import unittest" 2>/dev/null; then
            python -m unittest discover
          fi

      # .NET
      - name: Restaurar dependências .NET
        if: hashFiles('**/*.csproj', '**/*.sln') != ''
        run: dotnet restore

      - name: Build .NET
        if: hashFiles('**/*.csproj', '**/*.sln') != ''
        run: dotnet build --configuration Release --no-restore

      - name: Testes .NET
        if: hashFiles('**/*.csproj', '**/*.sln') != ''
        continue-on-error: true
        run: dotnet test --configuration Release --no-build --verbosity normal

      # JAVA
      - name: Build Maven
        if: hashFiles('**/pom.xml') != ''
        run: mvn clean install -DskipTests

      - name: Testes Maven
        if: hashFiles('**/pom.xml') != ''
        continue-on-error: true
        run: mvn test

      - name: Build Gradle
        if: hashFiles('**/build.gradle') != ''
        run: |
          if [ -f "gradlew" ]; then
            chmod +x gradlew
            ./gradlew build -x test
          else
            gradle build -x test
          fi

      - name: Testes Gradle
        if: hashFiles('**/build.gradle') != ''
        continue-on-error: true
        run: |
          if [ -f "gradlew" ]; then
            ./gradlew test
          else
            gradle test
          fi

      # GO
      - name: Build Go
        if: hashFiles('**/go.mod') != ''
        run: go build -v ./...

      - name: Testes Go
        if: hashFiles('**/go.mod') != ''
        continue-on-error: true
        run: go test -v ./...

      # DOCKER (se existir Dockerfile)
      - name: Build Docker Image
        if: hashFiles('**/Dockerfile') != ''
        run: |
          docker build -t app:${{ github.sha }} .

      - name: Upload artefatos
        uses: actions/upload-artifact@v4
        if: always()
        continue-on-error: true
        with:
          name: build-artifacts-${{ matrix.node-version }}
          path: |
            dist/
            build/
            target/
            out/
            bin/
          retention-days: 5

  security-scan:
    runs-on: ubuntu-latest
    needs: detect-and-build
    
    steps:
      - name: Checkout código
        uses: actions/checkout@v4

      - name: Executar Trivy security scanner
        uses: aquasecurity/trivy-action@master
        continue-on-error: true
        with:
          scan-type: 'fs'
          scan-ref: '.'
          format: 'sarif'
          output: 'trivy-results.sarif'

      - name: Upload Trivy results
        uses: github/codeql-action/upload-sarif@v3
        continue-on-error: true
        with:
          sarif_file: 'trivy-results.sarif'

  code-quality:
    runs-on: ubuntu-latest
    needs: detect-and-build
    
    steps:
      - name: Checkout código
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: SonarCloud Scan
        uses: SonarSource/sonarcloud-github-action@master
        continue-on-error: true
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
        if: env.SONAR_TOKEN != ''

  notify:
    runs-on: ubuntu-latest
    needs: [detect-and-build, security-scan, code-quality]
    if: always()
    
    steps:
      - name: Status da pipeline
        run: |
          echo "Pipeline concluída!"
          echo "Status: ${{ needs.detect-and-build.result }}"