ci.yml

name: CI

on:
  push:
    branches: [ main ]
  pull_request:
    branches: [ main ]

jobs:
  quality:
    runs-on: ubuntu-latest
    env:
      TZ: UTC
      LC_ALL: C.UTF-8
      PYTHONHASHSEED: "0"

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup Python
        uses: actions/setup-python@v5
        with:
          python-version: "3.11"
          cache: pip

      - name: Setup Node
        uses: actions/setup-node@v4
        with:
          node-version: "20"

      - name: Install system tools
        run: |
          sudo apt-get update -y
          sudo apt-get install -y jq

      - name: Install project + tooling
        run: |
          python -m pip install --upgrade pip
          python -m pip install -e ".[dev]"
          python -m pip install ruff mypy pytest-cov radon import-linter autoflake pyupgrade reorder-python-imports pre-commit

      - name: Pre-commit clean
        run: pre-commit clean

      - name: Pre-commit (repo policy)
        uses: pre-commit/action@v3.0.1

      # === PASS B: CI BARRIERS TO PREVENT REGRESSION ===

      - name: "BARRIER: File size limit (max 500 LOC)"
        run: |
          echo "🛡️ Enforcing file size limits to prevent regression..."
          chmod +x scripts/check-file-size.sh
          scripts/check-file-size.sh

      - name: "BARRIER: Ruff complexity and quality rules (strict)"
        run: |
          echo "🛡️ Enforcing strict complexity and quality rules..."
          # Complexity rules (C901) and pylint refactor rules (PLR)
          python -m ruff check . --select PLR0913,PLR0912,PLR0911,PLR0915,C901 --no-cache
          # All configured quality rules as errors
          python -m ruff check . --no-cache

      - name: "BARRIER: No magic numbers in tests"
        run: |
          echo "🛡️ Checking for magic numbers in tests..."
          # Allow some magic numbers but fail on excessive use
          VIOLATIONS=$(python -m ruff check . --select PLR2004 --format=json | python -c "import sys, json; print(len(json.load(sys.stdin)))")
          echo "Magic number violations: $VIOLATIONS"
          if [ "$VIOLATIONS" -gt 350 ]; then
            echo "::error::Too many magic numbers ($VIOLATIONS > 350). Refactor to use constants."
            exit 1
          fi

      - name: "BARRIER: Code duplication limit (max 1%)"
        run: |
          echo "🛡️ Enforcing code duplication limits..."
          npx --yes jscpd@4.0.4 --min-lines 9 --pattern "autorepro/**/*.py" --reporters json --output /tmp/jscpd || true
          RATE=$(jq -r '.statistics.total.duplicatedRate // 0' /tmp/jscpd/jscpd-report.json 2>/dev/null || echo 0)
          echo "Duplicated rate: $RATE"
          RATE="$RATE" python - <<'PY'
          import os, sys
          try:
              rate = float(os.environ.get("RATE", "0") or 0)
          except Exception:
              rate = 0.0
          if rate > 0.01:
              print(f"::error::Code duplication {rate:.4f} > 0.01 (1%) - refactor duplicated code")
              sys.exit(1)
          PY

      # === PASS C: COMPREHENSIVE TESTING ===

      # === PASS C: COMPREHENSIVE TESTING ===

      - name: Mypy (type check)
        run: mypy autorepro tests || true

      - name: Export PYTHON_BIN
        run: echo "PYTHON_BIN=$(which python)" >> $GITHUB_ENV

      - name: Tests + Coverage
        run: |
          coverage erase || true
          pytest --cov=autorepro --cov-branch --cov-report=term-missing:skip-covered
          coverage combine || true
          coverage report -m | tee /tmp/cov.txt
          echo "---- Coverage summary ----"
          grep -E "^TOTAL" /tmp/cov.txt || true

      - name: Pytest quiet + goldens validation
        run: |
          pytest -q
          python scripts/regold.py --write
          git diff --exit-code || (echo "::error::Golden tests have drifted. Run 'python scripts/regold.py --write' to update." && exit 1)

      - name: "BARRIER: Coverage floor (>= 50%)"
        run: |
          echo "🛡️ Enforcing minimum coverage requirements..."
          PCT=$(grep -E "^TOTAL" /tmp/cov.txt | awk '{print $4}' | tr -d '%')
          echo "Coverage: ${PCT:-0}%"
          if [ "${PCT:-0}" -lt "50" ]; then
            echo "::error::Coverage ${PCT:-0}% < 50% - add more tests"; exit 1; fi

      - name: Enforce module boundaries (import-linter)
        run: lint-imports

      - name: "BARRIER: LOC per PR (<= 300 added)"
        if: ${{ github.event_name == 'pull_request' }}
        run: |
          echo "🛡️ Enforcing PR size limits to prevent large changes..."
          git fetch --no-tags --prune --depth=1 origin +refs/heads/${{ github.base_ref }}:refs/remotes/origin/${{ github.base_ref }}
          # Calculate added lines, excluding deletions and modifications
          ADDED=$(git diff --diff-filter=A --numstat origin/${{ github.base_ref }}... | awk '{s+=$1} END {print s+0}')
          echo "Added lines: $ADDED"
          if [ "${ADDED:-0}" -gt "300" ]; then
            echo "::error::PR adds $ADDED LOC (>300). Split into smaller PRs to maintain reviewability."; exit 1; fi

      - name: "BARRIER: Critical function complexity check"
        run: |
          echo "🛡️ Checking for overly complex functions that need refactoring..."
          # Find functions with very high complexity using radon
          COMPLEX_FUNCS=$(python -m radon cc autorepro/ -a -nc -s | grep -E "^F|^C" | wc -l || echo 0)
          echo "Functions with F/C complexity: $COMPLEX_FUNCS"
          if [ "$COMPLEX_FUNCS" -gt "3" ]; then
            echo "::error::Too many complex functions ($COMPLEX_FUNCS > 3). Refactor high complexity code."
            python -m radon cc autorepro/ -a -nc -s | grep -E "^F|^C" || true
            exit 1
          fi

      - name: Verify CLI functionality
        run: |
          autorepro --help
          autorepro --version

      - name: Build report artifact
        continue-on-error: true
        run: |
          autorepro report --desc "CI repro bundle" --exec --timeout 60 --out autorepro_report.zip

      - name: Collect reports
        if: always()
        run: |
          cp /tmp/cov.txt coverage.txt 2>/dev/null || true
          if [ -d /tmp/jscpd ]; then
            cp -r /tmp/jscpd jscpd-report || true
          fi

      - name: Upload artifacts
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: ci-artifacts
          path: |
            autorepro_report.zip
            coverage.txt
            jscpd-report/
          if-no-files-found: ignore