name: CI

on:
  push:
    branches: [main]
  pull_request:
  workflow_dispatch:

permissions:
  contents: read
  security-events: write

concurrency:
  group: ci-${{ github.ref }}
  cancel-in-progress: true

jobs:
  test:
    name: Python ${{ matrix.python-version }}
    runs-on: ubuntu-latest
    timeout-minutes: 25
    strategy:
      fail-fast: false
      matrix:
        python-version: ["3.11", "3.12", "3.13"]
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: ${{ matrix.python-version }}
          cache: pip
      - run: python -m pip install --upgrade pip && pip install -e ".[dev]"
      - run: ruff check .
      - run: ruff format --check .
      - run: pytest --cov=datapilot --cov=api --cov-report=term-missing --cov-report=xml --cov-fail-under=75
      - run: python -m compileall -q datapilot api worker app.py streamlit_app.py
      - name: Generate example model card
        if: matrix.python-version == '3.12'
        run: python scripts/generate_example_model_card.py
      - uses: actions/upload-artifact@v4
        if: matrix.python-version == '3.12'
        with:
          name: evaluation-evidence
          path: |
            coverage.xml
            build/example-model-card.md

  package:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: "3.12"
      - run: pip install build twine
      - run: python -m build
      - run: twine check dist/*
      - uses: actions/upload-artifact@v4
        with:
          name: python-package
          path: dist/

  dependency-audit:
   runs-on: ubuntu-latest
   steps:
    - uses: actions/checkout@v4
    - uses: actions/setup-python@v5
      with:
        python-version: "3.12"
        cache: pip
    - run: python -m pip install --upgrade pip pip-audit
    - run: pip-audit --requirement requirements.txt

  containers:
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        include:
          - file: Dockerfile
            image: datapilot-ui
          - file: Dockerfile.api
            image: datapilot-api
          - file: Dockerfile.worker
            image: datapilot-worker
    steps:
      - uses: actions/checkout@v4
      - uses: docker/setup-buildx-action@v3
      - uses: docker/build-push-action@v6
        with:
          context: .
          file: ${{ matrix.file }}
          push: false
          load: true
          tags: ${{ matrix.image }}:ci
      - uses: aquasecurity/trivy-action@v0.36.0
        with:
          image-ref: ${{ matrix.image }}:ci
          format: sarif
          output: "trivy-${{ matrix.image }}.sarif"
          severity: HIGH,CRITICAL
          ignore-unfixed: true
      - uses: github/codeql-action/upload-sarif@v4
        if: github.actor != 'dependabot[bot]'
        with:
          sarif_file: "trivy-${{ matrix.image }}.sarif"
      - uses: actions/upload-artifact@v4
        if: always()
        with:
          name: "trivy-${{ matrix.image }}"
          path: "trivy-${{ matrix.image }}.sarif"

  secrets:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - uses: gitleaks/gitleaks-action@v2
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}