name: verify

on:
  push:
  pull_request:

jobs:
  booking-verify:
    runs-on: ubuntu-latest
    services:
      postgres:
        image: postgres:16-alpine
        env:
          POSTGRES_DB: booking_ci
          POSTGRES_USER: booking_ci
          POSTGRES_PASSWORD: booking_ci
        ports:
          - 5432:5432
        options: >-
          --health-cmd "pg_isready -U booking_ci -d booking_ci"
          --health-interval 5s
          --health-timeout 5s
          --health-retries 20
    steps:
      - uses: actions/checkout@v4

      - name: Set up JDK 17
        uses: actions/setup-java@v4
        with:
          distribution: temurin
          java-version: '17'
          cache: maven

      - name: Set up Node 24
        uses: actions/setup-node@v4
        with:
          node-version: '24.14.0'
          cache: pnpm
          cache-dependency-path: client/pnpm-lock.yaml

      - name: Enable pinned pnpm
        run: |
          corepack enable
          corepack install

      - name: Backend verify
        working-directory: server
        run: ./mvnw -B verify

      - name: Frontend install and quality gates
        working-directory: client
        run: |
          pnpm install --frozen-lockfile
          pnpm typecheck
          pnpm lint
          pnpm test
          pnpm build
          pnpm audit --prod

      - name: Source secret scan
        run: bash scripts/verify-no-secrets.sh

      - name: Install PostgreSQL client
        run: |
          sudo apt-get update
          sudo apt-get install --yes postgresql-client

      - name: Verify Booking PostgreSQL migration boundary
        env:
          BOOKING_PG_VERIFY_URL: postgresql://booking_ci:booking_ci@localhost:5432/booking_ci
        run: bash scripts/verify-booking-postgresql-migration.sh