ci.yml

name: CI

on:
  push:
    branches: [ main, develop ]
  pull_request:
    branches: [ main, develop ]
  workflow_dispatch:

env:
  PYTHON_VERSION: '3.11'
  CACHE_VERSION: v1

jobs:
  lint:
    name: Lint and static analysis
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: ${{ env.PYTHON_VERSION }}
          cache: 'pip'
          cache-dependency-path: |
            requirements.txt
            constraints.txt

      - name: Upgrade pip
        run: python -m pip install --upgrade pip

      - name: Install linters and tools
        run: python -m pip install ruff mypy bandit pip-audit safety cyclonedx-py

      - name: Ruff (lint)
        run: ruff check . --output-format=github

      - name: Ruff (format check)
        run: ruff format --check .

      - name: Mypy (type check)
        run: mypy --config-file pyproject.toml utils API_SDK engine_sdk bcasl

      - name: Bandit (security)
        run: bandit -r utils API_SDK engine_sdk bcasl -f json -o bandit-report.json

      - name: pip-audit (dependencies)
        if: hashFiles('requirements.txt') != ''
        run: pip-audit -r requirements.txt --format=json --output=pip-audit-report.json

      - name: Safety check
        if: hashFiles('requirements.txt') != ''
        run: safety check -r requirements.txt --json --output safety-report.json
        continue-on-error: true

      - name: Generate SBOM
        if: hashFiles('requirements.txt') != ''
        run: cyclonedx-py -r requirements.txt -o sbom.json

      - name: Upload security reports
        uses: actions/upload-artifact@v4
        with:
          name: security-reports
          path: |
            bandit-report.json
            pip-audit-report.json
            safety-report.json
            sbom.json
          if-no-files-found: ignore

  format:
    name: Code formatting
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: ${{ env.PYTHON_VERSION }}
          cache: 'pip'

      - name: Install black
        run: python -m pip install black

      - name: Black format check
        run: black --check --diff .

  types:
    name: Type checking
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: ${{ env.PYTHON_VERSION }}
          cache: 'pip'

      - name: Install dependencies
        run: |
          python -m pip install --upgrade pip
          if [ -f requirements.txt ]; then pip install -r requirements.txt; fi
          pip install mypy

      - name: MyPy type check
        run: mypy --config-file pyproject.toml utils API_SDK engine_sdk bcasl

  tests:
    name: Tests
    runs-on: ubuntu-latest
    strategy:
      matrix:
        python-version: ['3.10', '3.11', '3.12']
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Set up Python ${{ matrix.python-version }}
        uses: actions/setup-python@v5
        with:
          python-version: ${{ matrix.python-version }}
          cache: 'pip'

      - name: Install dependencies
        run: |
          python -m pip install --upgrade pip
          if [ -f requirements.txt ]; then pip install -r requirements.txt; fi

      - name: Run tests with pytest
        run: |
          if [ -d tests ]; then
            python -m pytest tests/ -v --tb=short --cov=utils --cov=API_SDK --cov=engine_sdk --cov=bcasl --cov-report=xml --cov-report=term-missing
          else
            echo "No tests directory found, skipping tests"
          fi

      - name: Upload coverage to Codecov
        if: matrix.python-version == '3.11'
        uses: codecov/codecov-action@v4
        with:
          file: ./coverage.xml
          flags: unittests
          name: codecov-umbrella
          fail_ci_if_error: false

  build:
    name: Build and test (${{ matrix.os }}, py${{ matrix.python-version }})
    runs-on: ${{ matrix.os }}
    needs: lint
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, macos-latest, windows-latest]
        python-version: ['3.10', '3.11']

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: ${{ matrix.python-version }}
          cache: 'pip'

      - name: Upgrade pip
        run: python -m pip install --upgrade pip

      - name: Install requirements (if present)
        if: hashFiles('requirements.txt') != ''
        run: python -m pip install -r requirements.txt

      - name: Install tooling (pytest, coverage, build)
        run: python -m pip install pytest coverage build

      - name: Verify sources compile
        run: python -m compileall -q .

      - name: Run tests with coverage (if tests/ exists)
        run: >-
          python -c "import os,sys,subprocess; sys.exit(subprocess.call([sys.executable,'-m','coverage','run','-m','pytest','-q'])) if os.path.isdir('tests') else 0"

      - name: Generate coverage XML (if coverage file exists)
        run: >-
          python -c "import os,sys,subprocess; sys.exit(subprocess.call([sys.executable,'-m','coverage','xml','-i'])) if os.path.isfile('.coverage') else 0"

      - name: Upload coverage artifact
        uses: actions/upload-artifact@v4
        with:
          name: coverage-${{ matrix.os }}-py${{ matrix.python-version }}
          path: coverage.xml
          if-no-files-found: ignore

      - name: Build distributions (sdist+wheel) if packaging configured
        if: >-
          hashFiles('pyproject.toml') != '' ||
          hashFiles('setup.cfg') != '' ||
          hashFiles('setup.py') != ''
        run: python -m build --sdist --wheel

      - name: Upload dist artifacts (if any)
        uses: actions/upload-artifact@v4
        with:
          name: dist-${{ matrix.os }}-py${{ matrix.python-version }}
          path: dist/*
          if-no-files-found: warn