code-backend.yml

name: "Code - Backend"

on:
  pull_request:
    types:
      - synchronize
      - opened
    paths:
      - 'backend/**'

jobs:
  validation:
    name: "Validation"
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: ./backend
    strategy:
      matrix:
        python-version: [ "3.12" ]
    services:
      postgres:
        image: postgres
        env:
          POSTGRES_PASSWORD: postgres
        options: >-
          --health-cmd pg_isready
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5
        ports:
          - 5432:5432
    steps:
      - name: Checkout the repository
        uses: actions/checkout@v6
      - name: Set up Python ${{ matrix.python-version }}
        uses: actions/setup-python@v6
        with:
          python-version: ${{ matrix.python-version }}
      - name: Install uv
        uses: astral-sh/setup-uv@v7
        with:
          enable-cache: true
      - name: Install All Dependencies
        run: uv sync --frozen --all-groups
      - name: Run Ruff
        run: uv run ruff check --output-format=github
      - name: Run tests
        run: uv run pytest -q
      - name: Run Migrations
        run: |
          eval $(grep -m 4 'export' README.md | tail -n 4)
          export ENV=test
          export SQLALCHEMY_DATABASE_URI=postgresql://postgres:postgres@localhost:5432/postgres
          uv run alembic upgrade head
      - name: Export requirements for vulnerability scan
        run: >-
          uv export --format requirements-txt --all-groups --no-hashes
          --no-emit-project --frozen -o requirements-audit.txt
      - name: Check for vulnerabilities
        uses: pypa/gh-action-pip-audit@v1.1.0
        with:
          inputs: backend/requirements-audit.txt