name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

concurrency:
  group: ci-${{ github.ref }}
  cancel-in-progress: true

env:
  PYTHON_VERSION: "3.11"

jobs:
  lint:
    name: Lint (ruff)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: ${{ env.PYTHON_VERSION }}
      - name: Install ruff
        run: pip install ruff==0.15.11
      - name: Ruff check
        run: ruff check src/absa tests scripts
      - name: Ruff format check
        run: ruff format --check src/absa tests scripts

  typecheck:
    name: Typecheck (mypy)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: ${{ env.PYTHON_VERSION }}
      - name: Install dev deps
        run: |
          pip install --upgrade pip
          pip install -e ".[dev]"
      - name: Mypy
        run: mypy src/absa

  security:
    name: Security (bandit)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: ${{ env.PYTHON_VERSION }}
      - name: Install bandit
        run: pip install bandit
      - name: Bandit scan
        run: bandit -r src/absa

  test:
    name: Tests (pytest) — py${{ matrix.python }}
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        python: ["3.10", "3.11"]
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: ${{ matrix.python }}
          cache: pip
      - name: Install package + dev deps
        run: |
          pip install --upgrade pip
          pip install -e ".[dev]"
      - name: Run tests
        run: pytest tests/unit/ -v