ci.yml

name: CI

on:
  push:
    branches: ["main", "develop"]
  pull_request:
    branches: ["main"]

env:
  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"

jobs:
  lint-and-test:
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v4

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: "3.12"
          cache: "pip"

      - name: Install system dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y ffmpeg ghostscript libheif-dev libcairo2 libpangocairo-1.0-0 libgdk-pixbuf2.0-0

      - name: Install Python dependencies
        run: pip install -r requirements-dev.txt

      - name: Lint (ruff)
        run: ruff check .

      - name: Format check (ruff)
        run: ruff format --check .

      # Tailwind dynamic-class gate — forbids `class="prefix-{{ x }}-suffix"`
      # patterns that JIT extraction misses, leaving the production bundle
      # silently incomplete. See scripts/check_template_classes.py docstring.
      - name: Template class gate
        run: python scripts/check_template_classes.py

      # i18n drift gate — re-extract the .pot from current sources and fail
      # if it differs from the committed file. Catches a developer who added
      # `_('...')` calls but forgot `python scripts/i18n.py extract` before
      # pushing. Translation work then stays in sync with code.
      - name: i18n message-catalog drift
        run: python scripts/i18n.py drift-check

      # pip-audit scans dependencies for known CVEs.
      # Blocking — a failure means a published advisory affects a pinned dep.
      # If a finding is genuinely unfixable upstream, add the ID to the --ignore-vuln list
      # below with a comment naming the package + reason; never silence the whole step.
      - name: Dependency vulnerability scan (pip-audit)
        run: pip-audit -r requirements.txt

      - name: Run tests
        run: pytest tests/ -v --tb=short

  secret-scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: gitleaks (server-side secret scanner)
        uses: gitleaks/gitleaks-action@ff98106e4c7b2bc287b24eaf42907196329070c7 # v2.3.9
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}