ci.yml

name: CI

on:
  push:
    branches: [main, feature/*, fix/*, refactor/*]
  pull_request:
    branches: [main]

concurrency:
  group: ci-${{ github.ref }}
  cancel-in-progress: true

jobs:
  # ── Backend Lint & Type Check ──────────────────────────────
  backend-lint:
    name: Backend Lint & Type Check
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: "3.11"
          cache: pip

      - name: Install dev tools
        run: pip install ruff mypy

      # ── Gate: format 必须通过 ──
      - name: Ruff format check
        run: ruff format --check src/ tests/

      # ── Report: lint 错误仅报告（存量 434 个，逐步修复） ──
      - name: Ruff lint check
        run: ruff check src/ tests/ --exit-zero

      # ── Report: mypy 仅报告 ──
      - name: Mypy type check
        run: mypy src/ --ignore-missing-imports --no-error-summary
        continue-on-error: true

  # ── Backend Unit Tests ─────────────────────────────────────
  backend-test:
    name: Backend Unit Tests
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: astral-sh/setup-uv@v5
        with:
          enable-cache: true

      - name: Set up Python
        run: uv python install 3.11

      - name: Install dependencies
        run: uv sync --dev

      # ── Gate: 核心测试必须通过（排除已知 broken 文件） ──
      - name: Run unit tests
        run: |
          uv run pytest tests/ \
            -q --tb=short \
            --ignore=tests/test_realtime_kline.py \
            --ignore=tests/test_realtime_minute.py \
            --ignore=tests/test_realtime_minute_integration.py \
            --ignore=tests/test_extractor.py \
            --ignore=tests/test_http_service.py \
            --ignore=tests/test_schemas.py \
            --ignore=tests/test_screener.py \
            --ignore=tests/test_etf_integration.py

  # ── Frontend Build Check ───────────────────────────────────
  frontend-check:
    name: Frontend Build Check
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: frontend
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-node@v4
        with:
          node-version: 20
          cache: npm
          cache-dependency-path: frontend/package-lock.json

      - name: Install dependencies
        run: npm ci

      # ── Report: TS 类型检查仅报告 ──
      - name: TypeScript check
        run: npx vue-tsc --noEmit
        continue-on-error: true

      # ── Gate: 构建必须成功 ──
      - name: Vite build
        run: npx vite build

  # ── Security Scan ──────────────────────────────────────────
  security-scan:
    name: Security Scan
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      # ── Report: gitleaks 仅报告 ──
      - name: Gitleaks scan
        uses: gitleaks/gitleaks-action@v2
        continue-on-error: true
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: "3.11"

      # ── Report: 依赖漏洞仅报告 ──
      - name: pip-audit
        run: |
          pip install pip-audit
          pip-audit --desc
        continue-on-error: true

      # ── Report: npm 漏洞仅报告 ──
      - name: npm audit
        run: |
          cd frontend
          npm audit --audit-level=high
        continue-on-error: true

  # ── Docker Build Verify ────────────────────────────────────
  docker-verify:
    name: Docker Build Verify
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      # ── Gate: Docker 构建必须成功 ──
      - name: Build backend image
        run: docker build -f docker/Dockerfile.backend --target production -t stock-backend:verify .

      - name: Build frontend image
        run: docker build -f docker/Dockerfile.frontend --target production -t stock-frontend:verify frontend/