name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

env:
  PYTHON_VERSION: "3.11"
  PIP_DISABLE_PIP_VERSION_CHECK: "1"
  PIP_NO_CACHE_DIR: "1"

jobs:
  lint:
    name: Lint & Format
    runs-on: ubuntu-latest
    container:
      image: python:3.11-slim

    steps:
      - name: Setup and checkout
        run: |
          apt-get update -qq && apt-get install -yqq --no-install-recommends git >/dev/null
          git clone --depth 1 --branch "${GITHUB_REF_NAME}" \
            "https://oauth2:${{ github.token }}@${GITHUB_SERVER_URL#https://}/${GITHUB_REPOSITORY}.git" .

      - name: Install dev tools
        run: pip install -q ruff mypy

      - name: Python syntax check
        run: python -m py_compile run.py wsgi.py app/*.py app/**/*.py

      - name: Ruff lint
        run: ruff check app/ tests/ fpaste

      - name: Ruff format
        run: ruff format --check app/ tests/ fpaste

      - name: Type check (informational)
        run: |
          # mypy strict mode - track progress, don't fail CI yet
          errors=$(mypy app/ --ignore-missing-imports 2>&1 | grep -c "error:" || true)
          echo "mypy found $errors type errors"
          if [ "$errors" -gt 20 ]; then
            echo "::warning::mypy errors increased to $errors (baseline: 20)"
          fi
        continue-on-error: true

  security:
    name: Security Scan
    runs-on: ubuntu-latest
    container:
      image: python:3.11-slim

    steps:
      - name: Setup and checkout
        run: |
          apt-get update -qq && apt-get install -yqq --no-install-recommends git >/dev/null
          git clone --depth 1 --branch "${GITHUB_REF_NAME}" \
            "https://oauth2:${{ github.token }}@${GITHUB_SERVER_URL#https://}/${GITHUB_REPOSITORY}.git" .

      - name: Install dependencies
        run: |
          pip install -q --upgrade pip
          pip install -q -r requirements.txt
          pip install -q bandit pip-audit

      - name: Bandit security scan
        run: |
          # -ll = medium and high severity only
          # -q = quiet, only show issues
          bandit -r app/ -ll -q

      - name: Dependency audit (informational)
        run: |
          # Check for known vulnerabilities in dependencies
          # Warnings only - container base packages often have issues
          pip-audit --progress-spinner=off || echo "::warning::pip-audit found vulnerabilities"
        continue-on-error: true

  test:
    name: Tests
    runs-on: ubuntu-latest
    needs: [lint]
    container:
      image: python:3.11-slim

    steps:
      - name: Setup and checkout
        run: |
          apt-get update -qq && apt-get install -yqq --no-install-recommends git >/dev/null
          git clone --depth 1 --branch "${GITHUB_REF_NAME}" \
            "https://oauth2:${{ github.token }}@${GITHUB_SERVER_URL#https://}/${GITHUB_REPOSITORY}.git" .

      - name: Install dependencies
        run: |
          pip install -q -r requirements.txt
          pip install -q pytest pytest-cov

      - name: Run tests
        run: pytest tests/ -v --tb=short

      - name: Run tests with coverage
        run: |
          pytest tests/ --cov=app --cov-report=term-missing --cov-fail-under=70 || \
            echo "::warning::Coverage below 70%"
        continue-on-error: true