ci.yml

name: CI

on:
  push:
    branches: [ master ]
  pull_request:
    branches: [ master ]

permissions:
  contents: read

jobs:
  lint:
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd

    - name: Set up Python
      uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405
      with:
        python-version: '3.12'

    - name: Install linting tools
      run: pip install ruff

    - name: Lint with ruff
      run: ruff check src/zettelforge/

    - name: Format check with ruff
      run: ruff format --check src/zettelforge/

  # GOV-009 §"Vulnerability Response": runs on every PR, fails on
  # HIGH/CRITICAL. Token-free complement to Snyk (which gates on
  # SNYK_TOKEN being set as a repo secret). Audit H-5.
  pip-audit:
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
    - name: Set up Python
      uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405
      with:
        python-version: '3.12'
    - name: Install pip-audit
      run: pip install pip-audit==2.9.0
    - name: Audit dependencies (any reported vuln blocks)
      run: |
        pip install -e ".[dev]" || pip install -e "."
        # pip-audit fails non-zero on any reported vuln. Add
        # --ignore-vuln=CVE-... with a citation when the finding is
        # explicitly accepted per GOV-009 §"Vulnerability Response".
        #
        # CVE-2026-3219: vulnerability in `pip` itself (the package
        # manager), not a project dependency. The runner's pip is
        # supplied by GitHub's setup-python image and is not something
        # ZettelForge's pyproject can pin or upgrade. Risk-accepted
        # because the pip vulnerability surface is exposed during
        # install, not at runtime; CI builds in ephemeral runners with
        # no persistent state. Re-evaluate when GitHub's images ship a
        # patched pip.
        pip-audit --strict \
          --ignore-vuln=CVE-2026-3219

  test:
    runs-on: ubuntu-latest
    needs: lint
    strategy:
      fail-fast: false
      matrix:
        python-version: ['3.12', '3.13']

    steps:
    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd

    - name: Set up Python ${{ matrix.python-version }}
      uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405
      with:
        python-version: ${{ matrix.python-version }}

    - name: Install dependencies
      run: |
        python -m pip install --upgrade pip
        # If [dev] install fails, fall back to bare install + manually
        # add the pytest deps. Parenthesizing the fallback prevents shell
        # precedence from running the "pytest pytest-cov pytest-asyncio"
        # step when [dev] already succeeded (audit L-4).
        pip install -e ".[dev]" || (pip install -e "." && pip install pytest pytest-cov pytest-asyncio)

    - name: Pre-download fastembed model
      run: |
        python -c "from fastembed import TextEmbedding; TextEmbedding('nomic-ai/nomic-embed-text-v1.5-Q')"

    - name: Test with pytest
      env:
        ZETTELFORGE_BACKEND: sqlite
        ZETTELFORGE_EMBEDDING_PROVIDER: fastembed
      run: |
        # GOV-007 §"Coverage Requirements" mandates ≥80% line / ≥70% branch.
        # We start the ratchet at 67 (matches governance/controls.yaml's
        # current declaration) so today's pipeline does not break, and #51
        # tracks raising it toward 80% across v2.5.x. Audit finding H-2.
        pytest tests/ -v --cov=zettelforge --cov-report=xml --cov-report=term-missing --cov-fail-under=67

    - name: Upload coverage
      if: matrix.python-version == '3.12'
      continue-on-error: true
      env:
        CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
      run: |
        python -m pip install codecov-cli
        codecovcli upload-process -f ./coverage.xml

  governance:
    runs-on: ubuntu-latest
    needs: lint
    steps:
    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd

    - name: Set up Python
      uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405
      with:
        python-version: '3.12'

    - name: Install dependencies
      run: |
        python -m pip install --upgrade pip
        # See "Install dependencies" comment above (audit L-4).
        pip install -e ".[dev]" || (pip install -e "." && pip install pytest pytest-cov)

    - name: GOV-012 — Logging compliance tests
      env:
        ZETTELFORGE_BACKEND: sqlite
      run: |
        pytest tests/test_logging_compliance.py -v

    - name: Governance spec-drift check
      run: |
        pytest tests/test_governance_spec_drift.py -v

  build:
    runs-on: ubuntu-latest
    needs: [test, governance]

    steps:
    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd

    - name: Set up Python
      uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405
      with:
        python-version: '3.12'

    - name: Install build dependencies
      run: |
        python -m pip install --upgrade pip
        pip install build twine

    - name: Build package
      run: python -m build

    - name: Check package
      run: twine check dist/*