stages:
  - verify
  - build

backend_verify:
  stage: verify
  image: python:3.12-slim
  script:
    - pip install --no-cache-dir -r backend/requirements.txt pytest ruff bandit pip-audit
    - PYTHONPATH=backend python -m compileall -q backend/app
    - ruff check backend/app backend/tests
    - PYTHONPATH=backend pytest -q backend/tests --junitxml=backend-test-report.xml
    - bandit -q -r backend/app -lll
    - pip-audit -r backend/requirements.txt
  artifacts:
    reports:
      junit: backend-test-report.xml
    paths:
      - backend-test-report.xml
    expire_in: 180 days

frontend_build:
  stage: build
  image: node:20-alpine
  script:
    - cd frontend
    - npm ci
    - npm run build
  artifacts:
    name: "qiji-frontend-$CI_COMMIT_SHORT_SHA"
    paths:
      - frontend/dist/
    expire_in: 30 days

backend_sbom:
  stage: verify
  image: python:3.12-slim
  script:
    - pip install --no-cache-dir cyclonedx-bom
    - python -m cyclonedx_py requirements backend/requirements.txt --output-reproducible --of JSON -o sbom-backend.cdx.json
  artifacts:
    name: "qiji-sbom-$CI_COMMIT_SHORT_SHA"
    paths:
      - sbom-backend.cdx.json
    expire_in: 180 days

filesystem_security:
  stage: verify
  image:
    name: aquasec/trivy:0.67.2
    entrypoint: [""]
  script:
    - trivy fs --exit-code 1 --ignore-unfixed --severity HIGH,CRITICAL --scanners vuln,misconfig,secret .