tests.yml

name: Tests

on:
  push:
    branches: [main, master, develop]
  pull_request:
    branches: [main, master, develop]
  workflow_dispatch:
    inputs:
      coverage-threshold:
        description: "Minimum coverage percentage for the Ubuntu baseline suite"
        required: false
        default: "40"

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

env:
  COVERAGE_THRESHOLD: "40"
  SMOKE_TEST_PATHS: >-
    tests/test_bt_api_quality.py
    tests/test_event_bus.py
    tests/core/test_async_context.py
    tests/gateway/test_config.py
  FULL_SUITE_MARKERS: "not network and not integration and not performance and not e2e"

jobs:
  quality:
    name: Quality Gates
    runs-on: ubuntu-latest
    timeout-minutes: 15

    steps:
      - uses: actions/checkout@v6

      - uses: actions/setup-python@v6
        with:
          python-version: "3.11"
          cache: pip
          cache-dependency-path: pyproject.toml

      - name: Install package + quality tools
        run: |
          python -m pip install --upgrade pip
          pip install -e ".[dev]"
          pip install bandit pip-audit

      - name: Ruff lint check
        run: ruff check bt_api_py tests --output-format=github

      - name: Ruff format check
        run: ruff format --check bt_api_py tests

      - name: MyPy type check
        run: mypy bt_api_py --ignore-missing-imports

      - name: Bandit security scan
        run: bandit -r bt_api_py -ll --skip B101,B311

      - name: Dependency audit
        run: pip-audit || true
        continue-on-error: true

  compatibility:
    name: Compatibility (Python ${{ matrix.python-version }}, ${{ matrix.os }})
    runs-on: ${{ matrix.os }}
    timeout-minutes: 30
    needs: quality

    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, macos-latest, windows-latest]
        python-version: ["3.9", "3.10", "3.11", "3.12", "3.13", "3.14"]

    defaults:
      run:
        shell: bash

    steps:
      - uses: actions/checkout@v6

      - uses: actions/setup-python@v6
        with:
          python-version: ${{ matrix.python-version }}
          cache: pip
          cache-dependency-path: pyproject.toml

      - name: Install build tools (Linux)
        if: runner.os == 'Linux'
        run: sudo apt-get update && sudo apt-get install -y build-essential

      # GitHub-hosted runners do not expose a generic Windows 11 x64 label.
      # `windows-latest` is the supported hosted Windows image for this matrix.
      - name: Install package + dev deps
        run: |
          python -m pip install --upgrade pip
          pip install -e ".[dev]"

      - name: Run cross-platform compatibility smoke suite
        env:
          SKIP_LIVE_TESTS: "true"
        run: pytest $SMOKE_TEST_PATHS -q

  full-suite:
    name: Full Suite (Python 3.11, Ubuntu)
    runs-on: ubuntu-latest
    timeout-minutes: 45
    needs: quality
    env:
      CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}

    defaults:
      run:
        shell: bash

    steps:
      - uses: actions/checkout@v6

      - uses: actions/setup-python@v6
        with:
          python-version: "3.11"
          cache: pip
          cache-dependency-path: pyproject.toml

      - name: Install build tools
        run: sudo apt-get update && sudo apt-get install -y build-essential

      - name: Install package + dev deps
        run: |
          python -m pip install --upgrade pip
          pip install -e ".[dev,security]"

      - name: Run baseline suite with coverage gate
        env:
          SKIP_LIVE_TESTS: "true"
        run: |
          pytest tests -v \
            -m "$FULL_SUITE_MARKERS" \
            --cov=bt_api_py \
            --cov-report=xml:coverage-full.xml \
            --cov-report=html \
            --cov-report=term-missing \
            --cov-fail-under=${{ github.event.inputs['coverage-threshold'] || env.COVERAGE_THRESHOLD }}

      - name: Upload coverage to Codecov
        if: always() && env.CODECOV_TOKEN != ''
        uses: codecov/codecov-action@v6
        with:
          token: ${{ secrets.CODECOV_TOKEN }}
          files: ./coverage-full.xml
          flags: ubuntu-py3.11
          fail_ci_if_error: false
          verbose: true

      - name: Archive coverage report
        if: always()
        uses: actions/upload-artifact@v7
        with:
          name: coverage-report-ubuntu-py3.11
          path: htmlcov/
          retention-days: 30

  quality-gate:
    name: Quality Gate
    runs-on: ubuntu-latest
    needs: [quality, compatibility, full-suite]
    if: always()

    steps:
      - name: Check job results
        run: |
          if [ "${{ needs.quality.result }}" != "success" ]; then
            echo "::error::Quality checks failed"
            exit 1
          fi
          if [ "${{ needs.compatibility.result }}" != "success" ]; then
            echo "::error::Compatibility matrix failed"
            exit 1
          fi
          if [ "${{ needs.full-suite.result }}" != "success" ]; then
            echo "::error::Full baseline suite failed"
            exit 1
          fi

      - name: Generate summary
        run: |
          echo "## CI Summary" >> "$GITHUB_STEP_SUMMARY"
          echo "" >> "$GITHUB_STEP_SUMMARY"
          echo "| Job | Status |" >> "$GITHUB_STEP_SUMMARY"
          echo "|-----|--------|" >> "$GITHUB_STEP_SUMMARY"
          echo "| Quality | ${{ needs.quality.result == 'success' && 'Passed' || 'Failed' }} |" >> "$GITHUB_STEP_SUMMARY"
          echo "| Compatibility matrix | ${{ needs.compatibility.result == 'success' && 'Passed' || 'Failed' }} |" >> "$GITHUB_STEP_SUMMARY"
          echo "| Ubuntu baseline suite | ${{ needs.full-suite.result == 'success' && 'Passed' || 'Failed' }} |" >> "$GITHUB_STEP_SUMMARY"
          echo "" >> "$GITHUB_STEP_SUMMARY"
          echo "Compatibility matrix: macOS, Linux, Windows x Python 3.9-3.14." >> "$GITHUB_STEP_SUMMARY"