name: CI

on:
  pull_request:
    branches: [main]
  push:
    branches: [main]
  schedule:
    - cron: "23 6 * * 1"
  workflow_dispatch:

permissions:
  contents: read

jobs:
  lint-smoke:
    name: Lint & Smoke
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7.0.0

      - uses: actions/setup-python@v6.2.0
        with:
          python-version: "3.11"

      - uses: actions/setup-node@v6.4.0
        with:
          node-version: "22"

      - name: Install lint tools
        run: pip install ruff==0.6.9

      - name: Ruff check
        run: ruff check .

      - name: Compile all (syntax smoke)
        run: python -m compileall -q -x '(\.venv|forks|upscaler_FIX/github_repos|nuke_CAM_exporter)' .

      - name: Run JS smoke tests
        run: |
          node tests/js/test_ai_pipeline_preview.mjs
          node tests/js/test_draft_guard.mjs
          node tests/js/test_update_check.mjs

  security-gate:
    name: Security Gate
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7.0.0

      - uses: actions/setup-python@v6.2.0
        with:
          python-version: "3.11"

      - name: Install security tools
        run: pip install bandit==1.7.10 pip-audit -c constraints-test.txt

      - name: Bandit scan
        run: bandit -r . -x ./.venv,./forks,./upscaler_FIX,./nuke_CAM_exporter -ll

      - name: Dependency audit
        run: pip-audit -r constraints-test.txt

  preflight:
    name: Pre-flight Release
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7.0.0

      - uses: actions/setup-python@v6.2.0
        with:
          python-version: "3.11"

      - name: Run pre-flight (static + dispatch + workflow fixtures)
        # manager-meta is skipped on PRs because the upstream node-map drift
        # is owned by an external repo (ltdrdata/ComfyUI-Manager) and is
        # tracked separately via issue #44. Re-enable by removing --skip
        # once that issue is resolved upstream.
        run: python tools/preflight_release.py --skip manager-meta -v

  pytest:
    name: Pytest
    runs-on: ${{ matrix.os }}
    strategy:
      # Keep both lanes reporting even when one fails — a Windows-only
      # failure with a green ubuntu lane is exactly the signal this
      # matrix exists to surface.
      fail-fast: false
      matrix:
        os: [ubuntu-latest, windows-latest]
    steps:
      - uses: actions/checkout@v7.0.0

      - uses: actions/setup-python@v6.2.0
        with:
          python-version: "3.11"

      - name: Install test deps
        # Install from the committed test lock so CI exercises the same
        # dependency set that local bootstrap audits.
        run: pip install -e ".[test]" -c constraints-test.txt

      - name: Run pytest
        run: pytest -q