code-quality.yml

name: Code Quality

on:
  push:

jobs:
  lint:
    runs-on: ubuntu-latest
    
    steps:
    - uses: actions/checkout@v4
    
    - name: Use Node.js
      uses: actions/setup-node@v4
      with:
        node-version: '18.x'
        cache: 'npm'
    
    - name: Install dependencies
      run: npm ci
    
    - name: Run ESLint
      run: |
        if npm list eslint &>/dev/null; then
          # Run ESLint and allow more warnings for legacy codebase
          npx eslint src --ext .ts,.tsx,.js,.jsx --max-warnings 300
        else
          echo "ESLint not configured, skipping"
        fi
    
    - name: Type check
      run: npx tsc --noEmit

  security:
    runs-on: ubuntu-latest
    
    steps:
    - uses: actions/checkout@v4
    
    - name: Use Node.js
      uses: actions/setup-node@v4
      with:
        node-version: '18.x'
        cache: 'npm'
    
    - name: Install dependencies
      run: npm ci
    
    - name: Run npm audit
      run: npm audit --production --audit-level=critical
    
    - name: Run Snyk to check for vulnerabilities
      if: env.SNYK_TOKEN != ''
      uses: snyk/actions/node@master
      env:
        SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
      with:
        args: --severity-threshold=critical