ci.yml

name: CI

on:
  push:
    branches: ["**"]
  pull_request:
    branches: [main]

# Cancel previous in-progress runs for the same branch to save CI minutes.
concurrency:
  group: ci-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  test:
    name: ${{ matrix.os }} · Python ${{ matrix.python-version }}
    runs-on: ${{ matrix.os }}
    strategy:
      # Don't abort the whole matrix when one cell fails — surfaces all
      # OS/version regressions in a single CI run.
      fail-fast: false
      matrix:
        os: [ubuntu-latest, windows-latest]
        python-version: ["3.12", "3.13", "3.14"]

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Set up Python ${{ matrix.python-version }}
        uses: actions/setup-python@v5
        with:
          python-version: ${{ matrix.python-version }}
          # Cache pip downloads keyed on requirements files so re-runs
          # for the same dep set skip the wheel build.
          cache: pip
          cache-dependency-path: |
            pyproject.toml
            requirements.txt
            requirements-dev.txt

      - name: Install Qt system libraries (Linux)
        # PySide6 wheels ship most native deps but link to a handful
        # of system libs that ubuntu-latest doesn't preinstall —
        # libEGL.so.1 and the xcb / xkb stack are the load-time deps
        # pytest-qt trips on at "import QtGui" before any test runs.
        if: runner.os == 'Linux'
        run: |
          sudo apt-get update
          sudo apt-get install -y --no-install-recommends \
            libegl1 \
            libgl1 \
            libxkbcommon0 \
            libxkbcommon-x11-0 \
            libdbus-1-3 \
            libxcb-cursor0 \
            libxcb-icccm4 \
            libxcb-image0 \
            libxcb-keysyms1 \
            libxcb-randr0 \
            libxcb-render-util0 \
            libxcb-shape0 \
            libxcb-xinerama0 \
            libxcb-xkb1 \
            libfontconfig1

      - name: Install dev extras
        run: |
          python -m pip install --upgrade pip
          pip install -e ".[dev]"

      - name: ruff lint
        run: python -m ruff check .

      - name: bandit security scan
        # The -c flag is mandatory — without it bandit ignores the
        # project's per-rule skip configuration in pyproject.toml.
        run: python -m bandit -c pyproject.toml -r thesisagents/ sources/

      - name: pytest
        # Hermetic fixtures only — no live HTTP. -X utf8 keeps Windows
        # console codec out of the picture for paper titles containing
        # accented or CJK characters. QT_QPA_PLATFORM=offscreen lets
        # PySide6 widgets instantiate without an X server on the
        # Ubuntu runner.
        env:
          QT_QPA_PLATFORM: offscreen
        run: python -X utf8 -m pytest tests/ -q