ci.yml

name: CI

on:
  push:
    branches: [main, dev]
  pull_request:
  workflow_dispatch:

concurrency:
  group: ci-${{ github.ref }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

permissions:
  contents: read

jobs:
  audit:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7.0.1
      - name: Install uv
        uses: astral-sh/setup-uv@v9.0.0
      - name: Export locked runtime dependencies
        run: uv export --frozen --no-dev --all-extras --no-emit-project --no-hashes --format requirements-txt -o audit-requirements.txt
      # The export is already a fully resolved tree, so --no-deps audits the pins
      # directly without a hash-checked reinstall of platform-specific wheels.
      - name: Audit dependencies for known vulnerabilities
        run: uvx pip-audit --strict --no-deps --requirement audit-requirements.txt

  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7.0.1
        with:
          fetch-depth: 0
      - name: Install uv
        uses: astral-sh/setup-uv@v9.0.0
      - name: Lint
        run: uv run ruff check .
      - name: Format check
        run: uv run ruff format --check .
      - name: Test with coverage
        run: uv run pytest
      - name: Upload coverage report
        if: always()
        uses: actions/upload-artifact@v7
        with:
          name: coverage-report
          path: coverage.xml

  sonar:
    needs: test
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7.0.1
        with:
          fetch-depth: 0
      - name: Download coverage report
        uses: actions/download-artifact@v8
        with:
          name: coverage-report
      - name: SonarCloud Scan
        if: github.event_name != 'pull_request' || github.event.pull_request.user.login != 'dependabot[bot]'
        uses: SonarSource/sonarqube-scan-action@22918119ff8e1ca75a623e15c8296b6ea4fbe28f # v8
        env:
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
      - name: Skip SonarCloud scan for Dependabot
        if: github.event_name == 'pull_request' && github.event.pull_request.user.login == 'dependabot[bot]'
        run: echo "SonarCloud credentials are unavailable to Dependabot pull requests."