ci.yml

name: CI

on:
  push:
    branches: [master, main, develop]
  pull_request:
    branches: [master, main, develop]

permissions:
  contents: read

concurrency:
  group: ci-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  # ====================
  # Format & Lint Check
  # ====================
  lint:
    name: Lint & Format Check
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: '3.12'
          cache: pip

      - name: Install dependencies
        run: |
          python -m pip install --upgrade pip
          python -m pip install black==24.4.2 flake8==7.0.0 isort==5.13.2

      - name: Check code formatting with black
        run: |
          python -m black --check --diff src/ main.py tests/

      - name: Check import sorting with isort
        run: |
          python -m isort --check-only --diff src/ main.py tests/

      - name: Lint with flake8
        run: |
          python -m flake8 src/ main.py --max-line-length=120 --count --select=E9,F63,F7,F82 --show-source --statistics

  # ====================
  # Type Check
  # ====================
  typecheck:
    name: Type Check
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: '3.12'
          cache: pip

      - name: Install dependencies
        run: |
          python -m pip install --upgrade pip
          python -m pip install mypy==1.10.0 types-requests types-PyYAML
          python -m pip install -r requirements.txt

      - name: Run mypy type check
        run: |
          python -m mypy src/ main.py --ignore-missing-imports || true

  # ====================
  # Security Scan
  # ====================
  security:
    name: Security Scan
    runs-on: ubuntu-latest
    permissions:
      actions: read
      contents: read
      security-events: write
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: '3.12'

      - name: Install dependencies
        run: |
          python -m pip install --upgrade pip
          python -m pip install bandit[toml] safety pip-audit

      - name: Run Bandit security scan
        run: |
          python -m bandit -r src/ -f json -o bandit-report.json || true
          python -m bandit -r src/

      - name: Run pip-audit
        run: |
          python -m pip install --upgrade pip-audit
          python -m pip-audit --desc || true

  # ====================
  # Secret Detection
  # ====================
  secrets:
    name: Secret Detection
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Run GitLeaks
        uses: trufflesecurity/trufflehog@main
        with:
          path: ./
          base: ${{ github.event.repository.default_branch }}
          head: HEAD
          extra_args: --only-verified

  # ====================
  # Test Suite
  # ====================
  test:
    name: Test (Python ${{ matrix.python-version }})
    runs-on: ubuntu-latest
    needs: [lint, typecheck]
    strategy:
      fail-fast: false
      matrix:
        python-version: ['3.10', '3.11', '3.12']

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Set up Python ${{ matrix.python-version }}
        uses: actions/setup-python@v5
        with:
          python-version: ${{ matrix.python-version }}
          cache: pip

      - name: Install dependencies
        run: |
          python -m pip install --upgrade pip
          python -m pip install ".[dev]"

      - name: Run tests with coverage
        run: |
          python -m pytest -q --tb=short --cov=src --cov-report=xml --cov-report=term

      - name: Upload coverage to Codecov
        if: matrix.python-version == '3.12'
        uses: codecov/codecov-action@v4
        with:
          file: ./coverage.xml
          flags: unittests
          name: codecov-umbrella
          fail_ci_if_error: false

  # ====================
  # Build Verification
  # ====================
  build:
    name: Build Verification
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: '3.12'

      - name: Install build dependencies
        run: |
          python -m pip install --upgrade pip
          python -m pip install build twine

      - name: Build package
        run: |
          python -m build

      - name: Check package with twine
        run: |
          python -m twine check dist/*

      - name: Test installation
        run: |
          python -m pip install dist/*.whl
          cleanbook --version
          cleanbook-wizard --version