ci.yml

name: CI

on:
  push:
    branches: ["**"]
  pull_request:
    branches: ["**"]
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: ci-${{ github.ref }}
  cancel-in-progress: true

jobs:
  lint:
    name: Lint (ruff, py311)
    runs-on: ubuntu-latest
    timeout-minutes: 15
    env:
      PYTHONPATH: src
      UV_HTTP_TIMEOUT: 120

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: "3.11"

      - name: Install uv
        uses: astral-sh/setup-uv@v7
        with:
          enable-cache: true

      - name: Sync dependencies with uv
        run: |
          uv sync --frozen

      - name: Show environment
        run: |
          uv --version
          python --version

      - name: Install ruff
        run: |
          uv pip install ruff

      - name: Lint with ruff
        run: |
          uv run ruff check src

  test:
    name: Test (Python ${{ matrix.python-version }})
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        python-version: ["3.10", "3.11", "3.12"]
    timeout-minutes: 25
    env:
      PYTHONPATH: src
      UV_HTTP_TIMEOUT: 120

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: ${{ matrix.python-version }}

      - name: Install uv
        uses: astral-sh/setup-uv@v7
        with:
          enable-cache: true

      - name: Sync dependencies with uv
        run: |
          uv sync --frozen

      - name: Show environment
        run: |
          uv --version
          python --version

      - name: Run tests with coverage
        shell: bash
        run: |
          uv pip install pytest coverage
          set +e
          # Run pytest under coverage; only measure project sources under src/ and
          # ignore proxy_test.py, which expects a local SOCKS proxy (Tor).
          uv run coverage run --source=src -m pytest --ignore=proxy_test.py
          rc=$?
          set -e
          if [ "$rc" -eq 5 ]; then
            echo "No tests collected. Skipping pytest."
            exit 0
          fi
          # Show coverage summary in CI logs and enforce minimum threshold
          uv run coverage report -m --fail-under=30
          # Export XML report for artifacts or external tools
          uv run coverage xml -o coverage.xml
          exit "$rc"

      - name: Upload coverage report
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: coverage-${{ matrix.python-version }}
          path: coverage.xml

  typecheck:
    name: Type check (mypy, py311)
    runs-on: ubuntu-latest
    needs: [lint]
    timeout-minutes: 15
    env:
      PYTHONPATH: src
      UV_HTTP_TIMEOUT: 120

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: "3.11"

      - name: Install uv
        uses: astral-sh/setup-uv@v7
        with:
          enable-cache: true

      - name: Sync dependencies with uv
        run: |
          uv sync --frozen

      - name: Run mypy
        run: |
          uv pip install mypy
          uv run mypy

  build:
    name: Build checks (py311)
    runs-on: ubuntu-latest
    needs: [lint, test, typecheck]
    timeout-minutes: 20
    env:
      PYTHONPATH: src
      UV_HTTP_TIMEOUT: 120

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: "3.11"

      - name: Install uv
        uses: astral-sh/setup-uv@v7
        with:
          enable-cache: true

      - name: Sync dependencies with uv
        run: |
          uv sync --frozen

      - name: Show environment
        run: |
          uv --version
          python --version

      - name: Syntax check (compile all)
        run: |
          uv run python -m compileall -q src scripts

      - name: Verify core packages importable
        shell: bash
        run: |
          uv run python - <<'PY'
          import sys, importlib
          sys.path.append('src')
          for pkg in ("helpers", "scrapers", "runpod", "ui", "db"):
              importlib.import_module(pkg)
          print("Core packages imported successfully")
          # Verify database module works
          from db import init_db, get_setting, set_setting
          init_db()
          set_setting("ci.test", "ok")
          assert get_setting("ci.test") == "ok"
          print("Database module verified")
          PY

  security:
    name: Dependency audit (pip-audit)
    runs-on: ubuntu-latest
    needs: [lint, test]
    timeout-minutes: 20
    env:
      UV_HTTP_TIMEOUT: 120

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: "3.11"

      - name: Install uv
        uses: astral-sh/setup-uv@v7
        with:
          enable-cache: true

      - name: Sync dependencies with uv
        run: |
          uv sync --frozen

      - name: Run pip-audit
        shell: bash
        run: |
          uv pip install pip-audit
          # Audit the installed environment for known vulnerabilities.
          # Ignore specific CVEs that are currently present only via transitive
          # dependencies and tracked separately:
          # - CVE-2025-6176 (brotli 1.1.0; fixed in 1.2.0)
          # - CVE-2025-62727 (starlette 0.48.0; fixed in 0.49.1)
          # - CVE-2025-66418 (urllib3 2.5.0; fixed in 2.6.0)
          # - CVE-2025-66471 (urllib3 2.5.0; fixed in 2.6.0)
          # - GHSA-f83h-ghpp-7wcc (pdfminer-six <=20251107; no fix yet, local privesc only)
          # All other vulnerabilities will still cause this job to fail.
          uv run pip-audit \
            --ignore-vuln CVE-2025-6176 \
            --ignore-vuln CVE-2025-62727 \
            --ignore-vuln CVE-2025-66418 \
            --ignore-vuln CVE-2025-66471 \
            --ignore-vuln GHSA-f83h-ghpp-7wcc

  docs:
    name: Docs (format, links, spelling)
    runs-on: ubuntu-latest
    needs: [lint]
    timeout-minutes: 15
    env:
      UV_HTTP_TIMEOUT: 120

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: "3.11"

      - name: Install uv
        uses: astral-sh/setup-uv@v7
        with:
          enable-cache: true

      - name: Sync dependencies with uv
        run: |
          uv sync --frozen

      - name: Install docs tooling
        run: |
          uv pip install mdformat codespell

      - name: Check Markdown formatting (mdformat)
        run: |
          uv run mdformat --check README.md docs

      - name: Spell-check docs (codespell)
        run: |
          uv run codespell README.md docs

      - name: Check documentation links (lychee)
        uses: lycheeverse/lychee-action@v2
        with:
          args: --no-progress --exclude https://huggingface.co/settings/tokens --exclude https://www.reddit.com/r/LocalLLaMA/ README.md docs/**/*.md
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}