browser-quality-advisory.yml

name: Browser Quality Advisory

on:
  pull_request:
  push:
    branches: ["main"]
  schedule:
    - cron: "0 9 * * 1"
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: browser-quality-advisory-${{ github.ref }}
  cancel-in-progress: true

env:
  DOTNET_VERSION: "8.0.x"
  NODE_VERSION: "22"
  LIGHTHOUSE_BASE_URL: "http://127.0.0.1:5073"

jobs:
  advisory:
    name: A11y + Lighthouse (Advisory)
    runs-on: ubuntu-latest
    timeout-minutes: 60

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup .NET
        uses: actions/setup-dotnet@v4
        with:
          dotnet-version: ${{ env.DOTNET_VERSION }}

      - name: Setup Node
        uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: npm
          cache-dependency-path: tests/browser/package-lock.json

      - name: Install advisory dependencies
        run: npm --prefix tests/browser ci

      - name: Install Playwright runtime (chromium + webkit)
        run: npx --prefix tests/browser playwright install --with-deps chromium webkit

      - name: Run advisory accessibility lane
        continue-on-error: true
        run: |
          npx --prefix tests/browser playwright test \
            --config tests/browser/playwright.config.js \
            --project chromium \
            --project mobile-safari \
            --grep "@advisory"

      - name: Start app for Lighthouse
        env:
          ASPNETCORE_ENVIRONMENT: Development
          DatabaseProvider: Sqlite
          ConnectionStrings__DefaultConnection: Data Source=${{ github.workspace }}/tests/browser/.tmp/leadportal-lighthouse.db
          SeedAdmin__Email: admin@dirxhealth.com
          SeedAdmin__Password: Admin@123
          LocalStorage__RootPath: ${{ github.workspace }}/tests/browser/.tmp/uploads
          SEED_DEMO_DATA: true
        shell: bash
        run: |
          set -euo pipefail
          mkdir -p tests/browser/.tmp/uploads tests/browser/lighthouse tests/browser/test-results
          dotnet run \
            --project LeadManagementPortal/LeadManagementPortal.csproj \
            --urls "${LIGHTHOUSE_BASE_URL}" \
            > tests/browser/test-results/lighthouse-app.log 2>&1 &
          echo $! > tests/browser/.tmp/lighthouse.pid

      - name: Wait for app readiness
        shell: bash
        run: |
          set -euo pipefail
          for i in {1..60}; do
            if curl -fsS "${LIGHTHOUSE_BASE_URL}/Account/Login" > /dev/null; then
              exit 0
            fi
            sleep 2
          done
          echo "Application did not become ready in time."
          exit 1

      - name: Run Lighthouse audits
        continue-on-error: true
        shell: bash
        run: |
          set -euo pipefail
          routes=(
            "/"
            "/Account/Login"
            "/Account/AccessDenied"
          )

          for route in "${routes[@]}"; do
            slug="$(echo "$route" | sed 's#^/##; s#[^a-zA-Z0-9]#-#g')"
            if [ -z "$slug" ]; then
              slug="home"
            fi

            npx --prefix tests/browser lighthouse \
              "${LIGHTHOUSE_BASE_URL}${route}" \
              --chrome-flags="--headless --no-sandbox" \
              --only-categories=performance,accessibility,best-practices,seo \
              --output=html \
              --output=json \
              --output-path="tests/browser/lighthouse/${slug}"
          done

      - name: Stop Lighthouse app
        if: always()
        shell: bash
        run: |
          set +e
          if [ -f tests/browser/.tmp/lighthouse.pid ]; then
            kill "$(cat tests/browser/.tmp/lighthouse.pid)" 2>/dev/null || true
          fi

      - name: Upload advisory artifacts
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: browser-quality-advisory
          path: |
            tests/browser/playwright-report/
            tests/browser/test-results/
            tests/browser/lighthouse/
          if-no-files-found: ignore
          retention-days: 14

  deployed-surface-smoke:
    name: Deployed Surface Smoke (${{ matrix.browser }})
    runs-on: ubuntu-latest
    timeout-minutes: 30
    continue-on-error: true
    strategy:
      fail-fast: false
      matrix:
        browser: [chromium, firefox, webkit]

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Resolve deploy URL
        id: target
        env:
          SALESREPPORTAL_BASE_URL: ${{ vars.SALESREPPORTAL_BASE_URL }}
        shell: bash
        run: |
          set -euo pipefail
          if [ -z "${SALESREPPORTAL_BASE_URL:-}" ]; then
            echo "should_probe=false" >> "$GITHUB_OUTPUT"
            echo "url=" >> "$GITHUB_OUTPUT"
            exit 0
          fi
          echo "should_probe=true" >> "$GITHUB_OUTPUT"
          echo "url=${SALESREPPORTAL_BASE_URL}" >> "$GITHUB_OUTPUT"

      - name: Skip summary when deploy URL missing
        if: steps.target.outputs.should_probe != 'true'
        shell: bash
        run: |
          {
            echo "### Deployed surface smoke skipped"
            echo "- Missing repo variable: SALESREPPORTAL_BASE_URL"
            echo "- Configure it with your canonical deployed portal URL to enable this advisory lane."
          } >> "$GITHUB_STEP_SUMMARY"

      - name: Setup Node
        if: steps.target.outputs.should_probe == 'true'
        uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: npm
          cache-dependency-path: tests/browser/package-lock.json

      - name: Install dependencies
        if: steps.target.outputs.should_probe == 'true'
        run: npm --prefix tests/browser ci

      - name: Install Playwright browser runtime
        if: steps.target.outputs.should_probe == 'true'
        run: npx --prefix tests/browser playwright install --with-deps ${{ matrix.browser }}

      - name: Probe deployed login surface
        if: steps.target.outputs.should_probe == 'true'
        env:
          BROWSER: ${{ matrix.browser }}
          SURFACE_NAME: deployed-login
          SURFACE_URL: ${{ steps.target.outputs.url }}/Account/Login
          REQUIRED_SELECTORS: body||form
          MIN_BODY_TEXT_LENGTH: "80"
          SCREENSHOT_DIR: tests/browser/playwright-report/surfaces
        run: node scripts/ci/browser-surface-smoke.mjs

      - name: Upload deployed surface artifacts
        if: always() && steps.target.outputs.should_probe == 'true'
        uses: actions/upload-artifact@v4
        with:
          name: deployed-surface-smoke-${{ matrix.browser }}
          path: |
            tests/browser/playwright-report/surfaces/
          if-no-files-found: ignore
          retention-days: 14