ci.yml

# EnSim Continuous Integration Pipeline
# This workflow runs on every push and pull request to ensure code quality
#
# Jobs:
# - test: Run full test suite on multiple Python versions
# - lint: Check code style and formatting
# - type-check: Run static type analysis
# - security: Scan for security vulnerabilities

name: CI

on:
  push:
    branches: [main, develop]
  pull_request:
    branches: [main, develop]
  workflow_dispatch:

env:
  PYTHON_DEFAULT: "3.11"

jobs:
  # ============================================================================
  # Test Job - Run test suite across multiple Python versions
  # ============================================================================
  test:
    name: Test (Python ${{ matrix.python-version }}, ${{ matrix.os }})
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest]
        python-version: ["3.10", "3.11", "3.12"]
    
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
      
      - name: Set up Python ${{ matrix.python-version }}
        uses: actions/setup-python@v5
        with:
          python-version: ${{ matrix.python-version }}
          cache: 'pip'
      
      - name: Install system dependencies (Ubuntu)
        if: runner.os == 'Linux'
        run: |
          sudo apt-get update
          sudo apt-get install -y libxkbcommon-x11-0 libxcb-icccm4 libxcb-image0 \
            libxcb-keysyms1 libxcb-randr0 libxcb-render-util0 libxcb-xinerama0 \
            libxcb-xfixes0 x11-utils libegl1 libgl1 libxcb-cursor0
      
      - name: Install dependencies
        run: |
          python -m pip install --upgrade pip
          pip install -r requirements.txt
          pip install pytest pytest-cov pytest-timeout
      
      - name: Run unit tests
        run: |
          pytest tests/unit/ -v --cov=src --cov-report=xml --timeout=60 --ignore=tests/unit/test_gui.py
        env:
          QT_QPA_PLATFORM: offscreen
      
      - name: Run validation tests
        run: |
          pytest tests/validation/ -v --timeout=120
        env:
          QT_QPA_PLATFORM: offscreen
      
      - name: Upload coverage to Codecov
        if: matrix.os == 'ubuntu-latest' && matrix.python-version == '3.11'
        uses: codecov/codecov-action@v4
        with:
          file: ./coverage.xml
          fail_ci_if_error: false
          verbose: true

  # ============================================================================
  # Lint Job - Code style and formatting (informational only)
  # ============================================================================
  lint:
    name: Lint & Format
    runs-on: ubuntu-latest
    continue-on-error: true  # Don't fail the workflow on lint issues
    
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
      
      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: ${{ env.PYTHON_DEFAULT }}
          cache: 'pip'
      
      - name: Install linting tools
        run: |
          pip install ruff black isort
      
      - name: Run Ruff linter
        run: |
          ruff check src/ tests/ --output-format=github || true
      
      - name: Check Black formatting
        run: |
          black --check --diff src/ tests/ || true
      
      - name: Check import sorting
        run: |
          isort --check-only --diff src/ tests/ || true

  # ============================================================================
  # Type Check Job - Static type analysis (informational only)
  # ============================================================================
  type-check:
    name: Type Check
    runs-on: ubuntu-latest
    continue-on-error: true
    
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
      
      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: ${{ env.PYTHON_DEFAULT }}
          cache: 'pip'
      
      - name: Install dependencies
        run: |
          pip install -r requirements.txt
          pip install mypy types-PyYAML
      
      - name: Run mypy
        run: |
          mypy src/ --ignore-missing-imports --no-error-summary || true

  # ============================================================================
  # Security Job - Scan for vulnerabilities (informational only)
  # ============================================================================
  security:
    name: Security Scan
    runs-on: ubuntu-latest
    continue-on-error: true
    
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
      
      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: ${{ env.PYTHON_DEFAULT }}
          cache: 'pip'
      
      - name: Install security tools
        run: |
          pip install safety bandit
      
      - name: Check dependencies for vulnerabilities
        run: |
          pip install -r requirements.txt
          safety check --full-report || true
      
      - name: Run Bandit security linter
        run: |
          bandit -r src/ -ll --skip B101 || true

  # ============================================================================
  # Build Job - Test package building
  # ============================================================================
  build:
    name: Build Package
    runs-on: ubuntu-latest
    needs: [test]
    
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
      
      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: ${{ env.PYTHON_DEFAULT }}
      
      - name: Install build tools
        run: |
          pip install build twine
      
      - name: Build package
        run: |
          python -m build
      
      - name: Check package
        run: |
          twine check dist/*
      
      - name: Upload build artifacts
        uses: actions/upload-artifact@v4
        with:
          name: dist
          path: dist/
          retention-days: 5