ci.yml

name: ci

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

permissions:
  contents: read

jobs:
  lint:
    name: lint / Python ${{ matrix.python-version }}
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        python-version: ["3.10", "3.11", "3.12"]

    steps:
      - uses: actions/checkout@v4

      - name: Set up Python ${{ matrix.python-version }}
        uses: actions/setup-python@v5
        with:
          python-version: ${{ matrix.python-version }}
          cache: pip

      - name: Install locked runtime dependencies
        run: pip install -r requirements.txt

      - name: Install dev/lint tools from locked deps
        run: pip install -r requirements-dev.txt

      - name: Ruff — style & import checks
        run: ruff check backend

      - name: Black — formatting check (no modifications)
        run: black --check backend

      - name: py_compile — verify all backend modules parse cleanly
        run: |
          python -m py_compile backend/__init__.py
          python -m py_compile backend/app.py
          python -m py_compile backend/api.py
          python -m py_compile backend/core.py
          python -m py_compile backend/config.py
          python -m py_compile backend/models.py
          python -m py_compile backend/orbit.py
          python -m py_compile backend/constellation.py
          python -m py_compile backend/envelope.py
          python -m py_compile backend/errors.py
          python -m py_compile backend/schemas.py
          python -m py_compile backend/scenario.py
          python -m py_compile backend/auth.py
          python -m py_compile backend/rbac.py
          python -m py_compile backend/ratelimit.py
          python -m py_compile backend/resources.py
          python -m py_compile backend/openapi.py
          echo "All backend modules compiled successfully."

  frontend-syntax:
    name: frontend / node --check
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v4

      - name: Set up Node.js
        uses: actions/setup-node@v4
        with:
          node-version: "20"

      - name: Verify frontend/app.js parses without syntax errors
        run: node --check frontend/app.js

  test:
    name: pytest / Python ${{ matrix.python-version }}
    runs-on: ubuntu-latest
    needs: [lint]
    strategy:
      fail-fast: false
      matrix:
        python-version: ["3.10", "3.11", "3.12"]

    steps:
      - uses: actions/checkout@v4

      - name: Set up Python ${{ matrix.python-version }}
        uses: actions/setup-python@v5
        with:
          python-version: ${{ matrix.python-version }}
          cache: pip

      - name: Install runtime dependencies
        run: pip install -r requirements.txt

      - name: Install dev / test dependencies
        run: pip install -r requirements-dev.txt

      - name: Run pytest with coverage
        run: |
          pytest --cov=backend \
                 --cov-config=.coveragerc \
                 --cov-report=xml:coverage.xml \
                 --cov-report=term-missing \
                 --cov-fail-under=60 \
                 -q

      - name: Upload coverage report
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: coverage-${{ matrix.python-version }}
          path: coverage.xml
          retention-days: 14

  frontend-unit:
    name: vitest unit tests
    runs-on: ubuntu-latest

    defaults:
      run:
        working-directory: frontend

    steps:
      - uses: actions/checkout@v4

      - name: Set up Node.js
        uses: actions/setup-node@v4
        with:
          node-version: "20"
          cache: npm
          cache-dependency-path: frontend/package-lock.json

      - name: Install frontend dependencies
        run: npm ci --prefer-offline

      - name: Run Vitest unit tests (src/ + tests/)
        run: npm run test

      - name: Upload Vitest coverage
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: frontend-coverage
          path: frontend/coverage/
          retention-days: 14

  perf-benchmarks:
    name: pytest-benchmark regression watchdog
    runs-on: ubuntu-latest
    # Run only on Python 3.11 to keep CI fast; matrix already covers correctness
    steps:
      - uses: actions/checkout@v4

      - name: Restore benchmark baseline
        uses: actions/cache@v4
        with:
          path: .benchmarks/
          # Cache key: branch + commit so each PR gets a fresh start;
          # restore from the most recent baseline on the same branch or main.
          key: benchmarks-${{ github.ref_name }}-${{ github.sha }}
          restore-keys: |
            benchmarks-${{ github.ref_name }}-
            benchmarks-main-

      - name: Set up Python 3.11
        uses: actions/setup-python@v5
        with:
          python-version: "3.11"
          cache: pip

      - name: Install runtime + dev dependencies
        run: |
          pip install -r requirements.txt
          pip install -r requirements-dev.txt

      - name: Run performance benchmarks and save baseline
        # --benchmark-autosave writes results to .benchmarks/<machine>/<datetime>_*.json
        # --benchmark-compare-fail=mean:20% fails CI if any benchmark mean regresses > 20%
        # On the first run (no prior baseline) --benchmark-compare is a no-op.
        run: |
          pytest tests/test_perf_benchmarks.py \
            --benchmark-autosave \
            --benchmark-compare \
            --benchmark-compare-fail=mean:20% \
            --benchmark-storage=.benchmarks/ \
            --benchmark-min-rounds=3 \
            -v

      - name: Upload benchmark results
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: benchmark-results
          path: .benchmarks/
          retention-days: 30