ci_tests.yml

name: CI - Tests

on:
  pull_request:
  push:
    branches:
      - 'master'

jobs:
  pre-commit_audit:
    runs-on: ubuntu-latest

    steps:
    - name: Checkout ${{ github.repository }}
      uses: actions/checkout@v6

    - name: Set up Python 3.10
      uses: actions/setup-python@v6
      with:
        python-version: '3.10'

    - name: Install dependencies
      run: |
        python -m pip install -U pip
        pip install -U setuptools wheel
        pip install -U -r .dev/requirements_ci.txt

    - name: Run pre-commit
      continue-on-error: true
      id: pre_commit
      run: pre-commit run --all-files

    - name: Run pip-audit
      uses: pypa/gh-action-pip-audit@v1.1.0
      with:
        inputs: requirements.txt .dev/requirements_ci.txt .dev/requirements_dev.txt .dev/requirements_docker_dev.txt .dev/requirements_release.txt
        # CVE-2025-69872: DiskCache 5.6.3
        #   DiskCache (python-diskcache) through 5.6.3 uses Python pickle for serialization by default.
        #   An attacker with write access to the cache directory can achieve arbitrary code execution
        #   when a victim application reads from the cache.
        ignore-vulns: |
          CVE-2025-69872

    - name: Fail if pre-commit failed
      run: |
        if [ "${{ steps.pre_commit.outcome }}" = 'failure' ]; then
          echo "Pre-commit failed (see above)"
          exit 1
        fi

  pytest:
    name: "pytest (Python ${{ matrix.python-version}} - Live Redis: ${{ matrix.live-redis }})"
    runs-on: ubuntu-latest

    strategy:
      fail-fast: false
      matrix:
        python-version: ["3.10", "3.11", "3.12", "3.13"]
        live-redis: [true, false]

    services:
      redis:
        image: redis:latest
        ports:
          - 6379:6379

    steps:
    - name: Checkout ${{ github.repository }}
      uses: actions/checkout@v6

    - name: Set up Python ${{ matrix.python-version}}
      uses: actions/setup-python@v6
      with:
        python-version: ${{ matrix.python-version}}

    - name: Install python dependencies
      run: |
        python -m pip install -U pip
        pip install -U setuptools wheel
        pip install -U -r requirements.txt -r .dev/requirements_dev.txt

    - name: Test with pytest
      run: |
        if [ "${{ matrix.live-redis }}" == "true" ]; then
            LIVE_REDIS=--live-redis
            REDIS_HOST=localhost
        else
            LIVE_REDIS=

            # An incorrect host, which will ensure we fallback to using 'fakeredis'
            REDIS_HOST=redis
        fi

        OTEAPI_REDIS_HOST=${REDIS_HOST} pytest -vv --cov-report=xml --cov=app ${LIVE_REDIS}
      env:
        OTEAPI_REDIS_TYPE: redis
        OTEAPI_REDIS_PORT: 6379

    - name: Upload coverage to Codecov
      if: github.repository == 'EMMC-ASBL/oteapi-services'
      uses: codecov/codecov-action@v7
      with:
        token: ${{ secrets.CODECOV_TOKEN }}
        env_vars: PYTHON
      env:
        PYTHON: ${{ matrix.python-version }}

  docker-compose:
    runs-on: ubuntu-latest

    strategy:
      fail-fast: false
      matrix:
        docker-target: ["development", "production"]

    env:
      OTEAPI_PORT: 8123
      OTEAPI_PREFIX: /api/ci/v1
      DOCKER_OTEAPI_TARGET: ${{ matrix.docker-target }}
      OTEAPI_CORE_PATH: /tmp/oteapi-core

    steps:
    - name: Checkout ${{ github.repository }}
      uses: actions/checkout@v6

    - name: Clone current requirement version of `oteapi-core` locally
      run: |
        REQ_VERSION=$(cat requirements.txt | grep "oteapi-core")
        git clone --branch v${REQ_VERSION#oteapi-core==} https://github.com/EMMC-ASBL/oteapi-core ${OTEAPI_CORE_PATH}

    - name: Build OTEAPI Services Dockerfiles
      run: |
        docker compose version
        docker compose -f compose.dev.yml build
        docker compose -f .github/utils/compose.ci_plugins.yml build

    - name: Start the Docker services
      run: |
        docker compose -f compose.dev.yml up &
        .github/utils/wait_for_it.sh localhost:${{ env.OTEAPI_PORT }} -t 120
        sleep 15
        curl -X "GET" -i "http://localhost:${{ env.OTEAPI_PORT }}${{ env.OTEAPI_PREFIX }}/session"

    - name: Start the Docker services with a local `oteapi-core`
      run: |
        docker compose -f compose.dev.yml down
        docker compose -f .github/utils/compose.ci_plugins.yml up &
        .github/utils/wait_for_it.sh localhost:${{ env.OTEAPI_PORT }} -t 120
        # Sleep for longer, since it takes a while to install `oteapi-core[dev]`
        # And the port will be available as soon as the CMD is reached in the Dockerfile.
        sleep 90
        curl -X "GET" -i "http://localhost:${{ env.OTEAPI_PORT }}${{ env.OTEAPI_PREFIX }}/session"
      env:
        CONTAINER_PLUGIN_PATH: /local-oteapi-core
        OTEAPI_PLUGIN_PACKAGES: "--force-reinstall -v -e /local-oteapi-core[docs]"