python-app.yml

name: Python CI

on:
  push:
    branches: [ "master", "main" ]
  pull_request:
    branches: [ "master", "main" ]
  workflow_dispatch:

permissions:
  contents: read

jobs:
  quality:
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
    - uses: actions/checkout@v4
    - name: Set up Python 3.13
      uses: actions/setup-python@v5
      with:
        python-version: "3.13"
        cache: 'pip'
    - name: Install dependencies
      run: |
        python -m pip install --upgrade pip
        pip install -r requirements.txt
        pip install -r requirements-dev.txt
        pip install -e .
    - name: Lint with Ruff
      run: ruff check .
    - name: Type check with Mypy
      run: mypy src
    - name: Security check with Bandit
      run: bandit -r src

  tests:
    runs-on: ubuntu-latest
    permissions:
      contents: read
    strategy:
      matrix:
        python-version: ["3.11", "3.12", "3.13"]
    steps:
    - uses: actions/checkout@v4
    - name: Set up Python ${{ matrix.python-version }}
      uses: actions/setup-python@v5
      with:
        python-version: ${{ matrix.python-version }}
        cache: 'pip'
    - name: Install dependencies
      run: |
        python -m pip install --upgrade pip
        pip install -r requirements.txt
        pip install -r requirements-dev.txt
        pip install -e .
    - name: Run tests
      env:
        NUMBA_DISABLE_JIT: 1
      run: |
        pytest --junitxml=test-results-${{ matrix.python-version }}.xml --cov=src --cov-report=xml
    - name: Upload Test Results
      uses: actions/upload-artifact@v4
      with:
        name: test-results-${{ matrix.python-version }}
        path: |
          test-results-${{ matrix.python-version }}.xml
          coverage.xml
      if: always()

  assets:
    needs: tests
    runs-on: ubuntu-latest
    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
    permissions:
      contents: write
    steps:
    - uses: actions/checkout@v4
      with:
        fetch-depth: 0
        token: ${{ secrets.TOKEN_GH || github.token }}
    
    - name: Set up Python 3.13
      uses: actions/setup-python@v5
      with:
        python-version: "3.13"
        cache: 'pip'
        
    - name: Install dependencies
      run: |
        python -m pip install --upgrade pip
        pip install -r requirements.txt
        pip install -e .
        
    - name: Regenerate all assets
      run: |
        python generate_graphs.py
        python scripts/benchmark_filters.py
        
    - name: Commit and Push changes
      run: |
        git config --global user.name "github-actions[bot]"
        git config --global user.email "github-actions[bot]@users.noreply.github.com"
        
        # Check for changes in assets
        git add .github/images/ filter_benchmark_report.md
        
        if git diff --staged --quiet; then
          echo "No changes in assets detected."
        else
          echo "Changes detected, pushing updates..."
          
          if [ "${{ github.event_name }}" == "pull_request" ]; then
            # Standard commit for PRs (no amend to avoid rebase hell)
            git commit -m "chore: update assets for PR [skip ci]"
            git push origin HEAD:${{ github.head_ref }}
          else
            # Clean amend for main branch
            # Append [skip ci] to the original message to prevent loops
            orig_msg=$(git log -1 --pretty=%B)
            if [[ "$orig_msg" != *"[skip ci]"* ]]; then
              git commit --amend -m "$orig_msg [skip ci]"
            else
              git commit --amend --no-edit
            fi
            git push origin ${{ github.ref_name }} --force
          fi
        fi

  sonar:
    needs: tests
    runs-on: ubuntu-latest
    if: github.event_name == 'pull_request' || github.ref == 'refs/heads/master' || github.ref == 'refs/heads/main'
    steps:
    - uses: actions/checkout@v4
      with:
        fetch-depth: 0
    - name: Download coverage report
      uses: actions/download-artifact@v4
      with:
        name: test-results-3.13
    - name: SonarCloud Scan
      uses: SonarSource/sonarqube-scan-action@master
      env:
        GITHUB_TOKEN: ${{ secrets.TOKEN_GH }}
        SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}

  pr-comment:
    needs: [quality, tests]
    runs-on: ubuntu-latest
    if: always() && github.event_name == 'pull_request'
    permissions:
      contents: read
      pull-requests: write
      issues: write
    steps:
    - uses: actions/checkout@v4
    - name: Download Test Results
      uses: actions/download-artifact@v4
      with:
        pattern: test-results-*
        path: test-results
      continue-on-error: true
    
    - name: Generate Comment Body
      run: python .github/scripts/comment_pr.py
      env:
        GITHUB_REPOSITORY: ${{ github.repository }}
        GITHUB_RUN_ID: ${{ github.run_id }}

    - name: Post PR Comment
      uses: actions/github-script@v7
      with:
        script: |
          const fs = require('fs');
          const body = fs.readFileSync('pr_comment_body.md', 'utf8');
          
          github.rest.issues.createComment({
            issue_number: context.issue.number,
            owner: context.repo.owner,
            repo: context.repo.repo,
            body: body
          })