ci.yml

name: CI Pipeline

on:
  push:
    branches: [ main, master ]
  pull_request:
    branches: [ main, master ]
  workflow_dispatch:

jobs:
  test-and-security-gate:
    name: CI Gate (Python ${{ matrix.python-version }})
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        python-version: ["3.11", "3.12"]

    steps:
      - name: Checkout Source
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Set up Python ${{ matrix.python-version }}
        uses: actions/setup-python@v5
        with:
          python-version: ${{ matrix.python-version }}
          cache: "pip"

      - name: Install Dependencies
        run: |
          python -m pip install --upgrade pip
          pip install -e ".[dev]" cyclonedx-bom

      - name: 🔒 1. Secret Scanning (Gitleaks)
        uses: gitleaks/gitleaks-action@v2
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: 🛡️ 2. Static Application Security Testing (Bandit)
        run: |
          bandit -r . -ll -c pyproject.toml

      - name: 🔍 3. Static Type Verification (MyPy)
        run: |
          mypy cli.py

      - name: 🧪 4. Unit & Integration Test Suite (Coverage >= 90%)
        run: |
          # Cada subpaquete lleva su propia suite en packages/*/tests con
          # basenames repetidos y conftest.py dedicados: se ejecutan en
          # invocaciones separadas (importlib) acumulando cobertura.
          coverage erase
          pytest tests -v --cov --cov-append
          for d in packages/*/tests; do
            pytest -c pyproject.toml "$d" -v -p no:cacheprovider \
              --import-mode=importlib --cov --cov-append
          done
          coverage report --fail-under=90

      - name: 📦 5. Software Bill of Materials (CycloneDX SBOM)
        run: |
          cyclonedx-py environment -o sbom.json

      - name: 📊 6. End-to-End Pipeline Demo Verification
        run: |
          python cli.py demo