test.yml

name: CI

on:
  push:
  pull_request:

jobs:
  backend-quality:
    name: Backend lint/typecheck
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6

      - name: Set up Python 3.11
        uses: actions/setup-python@v6
        with:
          python-version: "3.11"

      - name: Set up uv
        uses: astral-sh/setup-uv@v7
        with:
          enable-cache: true

      - name: Install dependencies
        run: make python-sync

      - name: Check Python lockfile
        run: make python-lock-check

      - name: Check release version consistency
        run: make release-check

      - name: Run backend lint
        run: make lint

      - name: Run release hygiene guard
        run: make hygiene

      - name: Check document authority
        run: make doc-check

      - name: Run backend typecheck
        run: make typecheck

  backend-tests:
    name: Backend tests
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6

      - name: Set up Python 3.11
        uses: actions/setup-python@v6
        with:
          python-version: "3.11"

      - name: Set up uv
        uses: astral-sh/setup-uv@v7
        with:
          enable-cache: true

      - name: Install dependencies
        run: make python-sync

      - name: Bootstrap database schema
        run: PYTHONPATH=. .venv/bin/python backend/data/database.py

      - name: Run backend tests with coverage
        run: make coverage

      - name: Publish coverage summary
        if: always()
        run: |
          if [ -f coverage.xml ]; then
            pct=$(python3 -c "import xml.etree.ElementTree as ET; print(round(float(ET.parse('coverage.xml').getroot().get('line-rate')) * 100, 1))")
            echo "### Backend coverage" >> $GITHUB_STEP_SUMMARY
            echo "Line coverage: **${pct}%** (gate: fail_under in pyproject.toml)" >> $GITHUB_STEP_SUMMARY
          fi

      - name: Upload coverage artifact
        uses: actions/upload-artifact@v7
        with:
          name: backend-coverage
          path: coverage.xml

  python-compat:
    name: Python ${{ matrix.python-version }} compatibility
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        python-version: ["3.12", "3.13"]
    steps:
      - uses: actions/checkout@v6

      - uses: actions/setup-python@v6
        with:
          python-version: ${{ matrix.python-version }}

      - uses: astral-sh/setup-uv@v7
        with:
          enable-cache: true

      - name: Install locked test environment
        run: uv sync --frozen --extra test --python ${{ matrix.python-version }}

      - name: Run compatibility contract suite
        run: >-
          PYTHONPATH=. .venv/bin/python -m pytest -q
          tests/test_schema_authority.py
          tests/test_runtime_identity_and_job_ledger.py
          tests/test_m61_p3_research.py

  docker:
    name: Docker build and health smoke
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6

      - name: Build backend and frontend images
        run: |
          docker build --target backend -t mingcang-backend:ci .
          docker build --target frontend -t mingcang-frontend:ci .

      - name: Verify backend container health
        run: |
          set -euo pipefail
          docker run --detach --rm --name mingcang-backend-ci -p 18000:8000 mingcang-backend:ci
          trap 'docker logs mingcang-backend-ci || true; docker stop mingcang-backend-ci || true' EXIT
          for attempt in $(seq 1 30); do
            if curl --fail --silent http://127.0.0.1:18000/health | grep -q '"status":"ok"'; then
              exit 0
            fi
            sleep 2
          done
          exit 1

  security:
    name: Security and dependency audit
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6

      - name: Set up Python 3.11
        uses: actions/setup-python@v6
        with:
          python-version: "3.11"

      - name: Set up uv
        uses: astral-sh/setup-uv@v7
        with:
          enable-cache: true

      - name: Install dependencies
        run: make python-sync

      - name: Run low-noise security snapshot
        run: make security

      - name: Run dependency audit
        run: |
          make dependency-audit
          echo "### Dependency audit" >> $GITHUB_STEP_SUMMARY
          echo "Audit completed at $(date -u '+%Y-%m-%dT%H:%M:%SZ'). No known vulnerabilities found." >> $GITHUB_STEP_SUMMARY

  frontend:
    name: Frontend test/build
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6

      - name: Set up Node
        uses: actions/setup-node@v6
        with:
          node-version: "20"
          cache: "npm"
          cache-dependency-path: frontend/package-lock.json

      - name: Install dependencies
        working-directory: frontend
        run: npm ci

      - name: Install browser runtime
        working-directory: frontend
        run: npx playwright install --with-deps chromium

      - name: Run frontend tests
        run: make frontend-test

      - name: Run frontend ESLint gate
        run: make frontend-lint

      - name: Run frontend build
        run: make build

      - name: Run demo and live-mode browser smoke
        run: make frontend-smoke