ci.yml

name: CI

on:
  push:
    branches: ['*']
  pull_request:
    branches: [main]

permissions:
  contents: read

env:
  PYTHON_VERSION: "3.12"

jobs:
  lint:
    name: Code Quality (Ruff)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: ${{ env.PYTHON_VERSION }}

      - name: Install ruff
        run: pip install ruff

      - name: Collect changed Python files
        id: changed
        run: |
          python - <<'PY'
          import json
          import os
          import subprocess

          def collect_files(command):
              result = subprocess.run(command, capture_output=True, check=False, text=True)
              if result.returncode == 0:
                  return [line.strip() for line in result.stdout.splitlines() if line.strip()]
              return None

          event = os.environ["GITHUB_EVENT_NAME"]
          if event == "pull_request":
              with open(os.environ["GITHUB_EVENT_PATH"], encoding="utf-8") as fh:
                  payload = json.load(fh)
              base_sha = payload["pull_request"]["base"]["sha"]
              head_sha = payload["pull_request"]["head"]["sha"]
              files = collect_files(["git", "diff", "--name-only", f"{base_sha}...{head_sha}", "--", "*.py"])
              if files is None:
                  files = collect_files(["git", "diff", "--name-only", f"{base_sha}..{head_sha}", "--", "*.py"])
              if files is None:
                  files = []
          else:
              has_parent = subprocess.run(
                  ["git", "rev-parse", "--verify", "HEAD^"],
                  stdout=subprocess.DEVNULL,
                  stderr=subprocess.DEVNULL,
              ).returncode == 0
              if has_parent:
                  files = collect_files(["git", "diff", "--name-only", "HEAD^", "HEAD", "--", "*.py"]) or []
              else:
                  files = collect_files(["git", "ls-files", "*.py"]) or []
          with open(os.environ["GITHUB_OUTPUT"], "a", encoding="utf-8") as fh:
              fh.write(f"files={json.dumps(files)}\n")
              fh.write(f"count={len(files)}\n")
          PY

      - name: Run ruff check
        if: steps.changed.outputs.count != '0'
        run: ruff check ${{ join(fromJson(steps.changed.outputs.files), ' ') }}

      - name: Run ruff format check
        if: steps.changed.outputs.count != '0'
        run: ruff format --check ${{ join(fromJson(steps.changed.outputs.files), ' ') }}

      - name: Skip ruff when no Python files changed
        if: steps.changed.outputs.count == '0'
        run: echo "No Python file changes detected."

  security:
    name: Security Scanning (Bandit)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: ${{ env.PYTHON_VERSION }}

      - name: Install bandit
        run: pip install "bandit[toml]"

      - name: Collect changed Python files
        id: changed
        run: |
          python - <<'PY'
          import json
          import os
          import subprocess

          def collect_files(command):
              result = subprocess.run(command, capture_output=True, check=False, text=True)
              if result.returncode == 0:
                  return [line.strip() for line in result.stdout.splitlines() if line.strip()]
              return None

          event = os.environ["GITHUB_EVENT_NAME"]
          if event == "pull_request":
              with open(os.environ["GITHUB_EVENT_PATH"], encoding="utf-8") as fh:
                  payload = json.load(fh)
              base_sha = payload["pull_request"]["base"]["sha"]
              head_sha = payload["pull_request"]["head"]["sha"]
              files = collect_files(["git", "diff", "--name-only", f"{base_sha}...{head_sha}", "--", "*.py"])
              if files is None:
                  files = collect_files(["git", "diff", "--name-only", f"{base_sha}..{head_sha}", "--", "*.py"])
              if files is None:
                  files = []
          else:
              has_parent = subprocess.run(
                  ["git", "rev-parse", "--verify", "HEAD^"],
                  stdout=subprocess.DEVNULL,
                  stderr=subprocess.DEVNULL,
              ).returncode == 0
              if has_parent:
                  files = collect_files(["git", "diff", "--name-only", "HEAD^", "HEAD", "--", "*.py"]) or []
              else:
                  files = collect_files(["git", "ls-files", "*.py"]) or []
          with open(os.environ["GITHUB_OUTPUT"], "a", encoding="utf-8") as fh:
              fh.write(f"files={json.dumps(files)}\n")
              fh.write(f"count={len(files)}\n")
          PY

      - name: Run bandit security scan
        if: steps.changed.outputs.count != '0'
        run: bandit -c pyproject.toml ${{ join(fromJson(steps.changed.outputs.files), ' ') }}

      - name: Skip bandit when no Python files changed
        if: steps.changed.outputs.count == '0'
        run: echo "No Python file changes detected."

  test:
    name: Beta Tests
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Set up Miniconda
        uses: conda-incubator/setup-miniconda@v3
        with:
          auto-update-conda: true
          python-version: ${{ env.PYTHON_VERSION }}
          activate-environment: BLOOM
          environment-file: bloom_env.yaml
          auto-activate-base: false

      - name: Install bloom in editable mode
        shell: bash -el {0}
        run: |
          pip install -e .

      - name: Initialize local Bloom database
        shell: bash -el {0}
        run: |
          bloom db init

      - name: Run beta-critical tests
        shell: bash -el {0}
        run: |
          pytest --no-cov \
            tests/test_config_runtime.py \
            tests/test_api_atlas_bridge.py \
            tests/test_atlas_lookup_resilience.py \
            tests/test_queue_flow.py \
            tests/test_run_resolver.py