ci.yml

name: CI

on:
  push:
    branches: [main]
  pull_request:
  schedule:
    # Weekly (Mon 06:00 UTC) so pip-audit catches newly disclosed CVEs even
    # without a code change.
    - cron: "0 6 * * 1"

jobs:
  lint:
    name: Ruff (lint + format)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7

      - uses: actions/setup-python@v7
        with:
          python-version: "3.12"

      - name: Install ruff
        run: |
          python -m pip install --upgrade pip
          pip install -e ".[dev]"

      - name: Ruff lint
        run: ruff check .

      - name: Ruff format (check only)
        run: ruff format --check .

  typecheck:
    name: Pyright
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7

      - uses: actions/setup-python@v7
        with:
          python-version: "3.12"

      - name: Install package + pyright
        run: |
          python -m pip install --upgrade pip
          pip install -e ".[dev]"

      - name: Pyright
        run: pyright

  test:
    name: Tests (py${{ matrix.python-version }})
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        python-version: ["3.11", "3.12", "3.13"]
    steps:
      - uses: actions/checkout@v7

      - uses: actions/setup-python@v7
        with:
          python-version: ${{ matrix.python-version }}

      - name: Install dependencies
        run: |
          python -m pip install --upgrade pip
          pip install -e ".[dev]"

      - name: Run tests with coverage
        run: coverage run -m pytest tests -q

      # `coverage report` enforces `fail_under` (85% from pyproject.toml).
      - name: Coverage report (enforces fail_under)
        run: coverage report

      - name: Coverage XML
        if: always()
        run: coverage xml

      - name: Upload coverage report
        if: always()
        uses: actions/upload-artifact@v7
        with:
          name: coverage-py${{ matrix.python-version }}
          path: coverage.xml
          if-no-files-found: ignore

  package:
    name: Build wheel, install & smoke test
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7

      - uses: actions/setup-python@v7
        with:
          python-version: "3.12"

      - name: Build sdist + wheel
        run: |
          python -m pip install --upgrade pip build
          python -m build

      - name: Install the built wheel into a clean venv
        run: |
          python -m venv /tmp/wheeltest
          /tmp/wheeltest/bin/python -m pip install --upgrade pip
          /tmp/wheeltest/bin/python -m pip install dist/*.whl

      - name: Smoke test the installed wheel
        # Run from a neutral directory: if we ran inside the checkout, the
        # source `app/` tree would shadow the installed wheel on sys.path
        # and we'd be testing the source, not the built artifact.
        run: |
          set -euxo pipefail
          NEUTRAL_DIR=$(mktemp -d)
          cd "$NEUTRAL_DIR"
          PY=/tmp/wheeltest/bin/python
          "$PY" - <<'PY'
          import importlib.metadata as md
          import app
          loc = app.__file__
          assert "site-packages" in loc, f"imported source, not wheel: {loc}"
          md.version("python-agent-web")
          print("wheel import OK:", loc)
          PY

      - name: Upload distributions
        uses: actions/upload-artifact@v7
        with:
          name: dist
          path: dist/*

  audit:
    name: pip-audit (dependency CVEs)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7

      - uses: actions/setup-python@v7
        with:
          python-version: "3.12"

      - name: Install pip-audit
        run: |
          python -m pip install --upgrade pip
          pip install "pip-audit>=2.7"

      # Audit the PROJECT's dependency closure resolved from pyproject.toml
      # (fastapi, uvicorn, sqlalchemy, ... + transitives) — NOT the whole
      # runner environment, which would flag unrelated tooling like
      # pip/setuptools. Record accepted/unfixable advisories in
      # .pip-audit-known-vulnerabilities.
      - name: pip-audit
        run: |
          IGNORE_VULNS=""
          if [ -f .pip-audit-known-vulnerabilities ]; then
            while IFS= read -r vuln_id || [ -n "$vuln_id" ]; do
              # Skip blank lines and comments
              case "$vuln_id" in ''|\#*) continue ;; esac
              IGNORE_VULNS="$IGNORE_VULNS --ignore-vuln $vuln_id"
            done < .pip-audit-known-vulnerabilities
          fi
          pip-audit . --strict --progress-spinner=off $IGNORE_VULNS