tests.yml

name: Tests

on:
  push:
    branches: [master, dev, code-optimization]
  pull_request:
    branches: [master, dev, code-optimization]
  workflow_dispatch:
    inputs:
      coverage-threshold:
        description: "Minimum coverage percentage for the Ubuntu baseline suite"
        required: false
        default: "40"

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

env:
  COVERAGE_THRESHOLD: "40"
  SMOKE_TEST_PATHS: >-
    tests/test_bt_api_quality.py
    tests/test_forwarding_schema.py
    tests/test_forwarding_bus_router_client.py
    tests/test_monitoring_contracts.py
  FULL_SUITE_MARKERS: "not network and not integration and not performance and not e2e and not ctp"

jobs:
  quality:
    name: Quality Gates
    runs-on: ubuntu-latest
    timeout-minutes: 15

    steps:
      # full history required: shallow clones break gitleaks PR-range scans (base^..head)
      - uses: actions/checkout@v6
        with:
          fetch-depth: 0

      - uses: actions/setup-python@v6
        with:
          python-version: "3.11"
          cache: pip
          cache-dependency-path: pyproject.toml

      - name: Install package + quality tools
        run: |
          python -m pip install --upgrade pip
          pip install -e ".[dev]"
          pip install bandit pip-audit

      - name: Ruff lint check
        run: ruff check bt_api_py tests --output-format=github

      - name: Ruff format check
        run: ruff format --check bt_api_py tests

      - name: MyPy type check
        run: mypy bt_api_py tests --ignore-missing-imports

      - name: Bandit security scan
        run: bandit -r bt_api_py -c pyproject.toml

      - name: Dependency audit
        run: pip-audit

      - name: Secret scan (incremental gitleaks)
        if: github.event_name == 'pull_request'
        uses: gitleaks/gitleaks-action@v2
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          GITLEAKS_CONFIG: .gitleaks.toml

  compatibility:
    name: Compatibility
    needs: quality
    uses: ./.github/workflows/reusable-compat-matrix.yml

  full-suite:
    name: Full Suite (Python 3.11, Ubuntu)
    runs-on: ubuntu-latest
    timeout-minutes: 45
    needs: quality
    env:
      CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}

    defaults:
      run:
        shell: bash

    steps:
      - uses: actions/checkout@v6

      - uses: actions/setup-python@v6
        with:
          python-version: "3.11"
          cache: pip
          cache-dependency-path: pyproject.toml

      - name: Install build tools
        run: sudo apt-get update && sudo apt-get install -y build-essential

      - name: Install package + dev deps
        run: |
          python -m pip install --upgrade pip
          pip install -e ".[dev,security]"

      - name: Run baseline suite with coverage gate
        env:
          SKIP_LIVE_TESTS: "true"
        run: |
          pytest tests -v \
            -m "$FULL_SUITE_MARKERS" \
            --cov=bt_api_py \
            --cov-report=xml:coverage-full.xml \
            --cov-report=html \
            --cov-report=term-missing \
            --cov-fail-under=${{ github.event.inputs['coverage-threshold'] || env.COVERAGE_THRESHOLD }}

      - name: Upload coverage to Codecov
        if: always() && env.CODECOV_TOKEN != ''
        uses: codecov/codecov-action@v6
        with:
          token: ${{ secrets.CODECOV_TOKEN }}
          files: ./coverage-full.xml
          flags: ubuntu-py3.11
          fail_ci_if_error: false
          verbose: true

      - name: Archive coverage report
        if: always()
        uses: actions/upload-artifact@v7
        with:
          name: coverage-report-ubuntu-py3.11
          path: htmlcov/
          retention-days: 30

  quality-gate:
    name: Tests / Quality Gate
    runs-on: ubuntu-latest
    needs: [quality, compatibility, full-suite]
    if: always()

    steps:
      - name: Check job results
        run: |
          if [ "${{ needs.quality.result }}" != "success" ]; then
            echo "::error::Quality checks failed"
            exit 1
          fi
          if [ "${{ needs.compatibility.result }}" != "success" ]; then
            echo "::error::Compatibility matrix failed"
            exit 1
          fi
          if [ "${{ needs.full-suite.result }}" != "success" ]; then
            echo "::error::Full baseline suite failed"
            exit 1
          fi

      - name: Generate summary
        run: |
          echo "## CI Summary" >> "$GITHUB_STEP_SUMMARY"
          echo "" >> "$GITHUB_STEP_SUMMARY"
          echo "| Job | Status |" >> "$GITHUB_STEP_SUMMARY"
          echo "|-----|--------|" >> "$GITHUB_STEP_SUMMARY"
          echo "| Quality | ${{ needs.quality.result == 'success' && 'Passed' || 'Failed' }} |" >> "$GITHUB_STEP_SUMMARY"
          echo "| Compatibility matrix | ${{ needs.compatibility.result == 'success' && 'Passed' || 'Failed' }} |" >> "$GITHUB_STEP_SUMMARY"
          echo "| Ubuntu baseline suite | ${{ needs.full-suite.result == 'success' && 'Passed' || 'Failed' }} |" >> "$GITHUB_STEP_SUMMARY"
          echo "" >> "$GITHUB_STEP_SUMMARY"
          echo "Compatibility matrix: macOS, Linux, Windows x Python 3.11-3.13 (blocking) + 3.14 (canary)." >> "$GITHUB_STEP_SUMMARY"