name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

env:
  PYTHON_VERSION: "3.11"
  PIP_DISABLE_PIP_VERSION_CHECK: "1"
  PIP_NO_CACHE_DIR: "1"

jobs:
  lint:
    name: Lint & Format
    runs-on: ubuntu-latest
    container:
      image: python:3.11-slim

    steps:
      - name: Setup and checkout
        run: |
          apt-get update -qq && apt-get install -yqq --no-install-recommends git >/dev/null
          git clone --depth 1 --branch "${GITHUB_REF_NAME}" \
            "https://oauth2:${{ github.token }}@${GITHUB_SERVER_URL#https://}/${GITHUB_REPOSITORY}.git" .

      - name: Install tools
        run: pip install -q ruff mypy

      - name: Syntax check
        run: python -m py_compile run.py wsgi.py app/*.py app/**/*.py

      - name: Ruff lint
        run: ruff check app/ tests/ fpaste

      - name: Ruff format
        run: ruff format --check app/ tests/ fpaste

      - name: Type check
        run: mypy app/ --ignore-missing-imports --no-error-summary

  security:
    name: Security Scan
    runs-on: ubuntu-latest
    container:
      image: python:3.11-slim

    steps:
      - name: Setup and checkout
        run: |
          apt-get update -qq && apt-get install -yqq --no-install-recommends git >/dev/null
          git clone --depth 1 --branch "${GITHUB_REF_NAME}" \
            "https://oauth2:${{ github.token }}@${GITHUB_SERVER_URL#https://}/${GITHUB_REPOSITORY}.git" .

      - name: Install dependencies
        run: |
          pip install -q -r requirements.txt
          pip install -q bandit pip-audit

      - name: Bandit scan
        run: bandit -r app/ -ll -q

      - name: Dependency audit
        run: pip-audit --strict --progress-spinner=off

  test:
    name: Tests
    runs-on: ubuntu-latest
    needs: [lint]
    container:
      image: python:3.11-slim

    steps:
      - name: Setup and checkout
        run: |
          apt-get update -qq && apt-get install -yqq --no-install-recommends git >/dev/null
          git clone --depth 1 --branch "${GITHUB_REF_NAME}" \
            "https://oauth2:${{ github.token }}@${GITHUB_SERVER_URL#https://}/${GITHUB_REPOSITORY}.git" .

      - name: Install dependencies
        run: |
          pip install -q -r requirements.txt
          pip install -q pytest

      - name: Run tests
        run: pytest tests/ -v --tb=short