ci.yml

name: CI

"on":
  push:
    branches: [main]
  pull_request:
    branches: ['**']

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  # ============================================================================
  # LAYER 1: Fast feedback (~1-2 min)
  # ============================================================================

  pre-commit:
    name: Pre-commit hooks
    runs-on: ubuntu-latest
    timeout-minutes: 10
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
        with:
          python-version: "3.12"

      - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v5
        with:
          path: ~/.cache/pre-commit
          key: pre-commit-${{ env.pythonLocation }}-${{ hashFiles('.pre-commit-config.yaml') }}

      - run: pip install pre-commit

      - run: pre-commit run --show-diff-on-failure --color=always --all-files

  # ============================================================================
  # LAYER 2: Testing
  # CI = all Python versions on Linux only (minimal, cheap: 1x minutes).
  # macOS (10x) / Windows (2x) spot-checks run at RELEASE time in cd.yml
  # (pre-release-tests), not on every push.
  # ============================================================================

  test:
    name: Test (Python ${{ matrix.python-version }} / ${{ matrix.os }})
    needs: [pre-commit]
    runs-on: ${{ matrix.os }}
    timeout-minutes: 20
    permissions:
      contents: read
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest]
        python-version: ['3.11', '3.12', '3.13']

    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
        with:
          python-version: ${{ matrix.python-version }}

      - uses: astral-sh/setup-uv@d31148d669074a8d0a63714ba94f3201e7020bc3 # v8.3.0
        with:
          enable-cache: true

      - name: Install dependencies
        run: uv pip install -e ".[dev,gui]" --system

      - name: Check dependency hygiene (deptry)
        if: runner.os == 'Linux' && matrix.python-version == '3.12'
        run: deptry src tests

      - name: Run tests with coverage
        shell: bash
        run: |
          pytest tests/ -v \
            --cov=src/certamen \
            --cov-report=xml \
            --cov-report=term-missing \
            --cov-branch \
            --junitxml=test-results.xml

      - name: Enforce coverage threshold
        if: runner.os == 'Linux' && matrix.python-version == '3.12'
        run: coverage report --fail-under=30

      - name: Upload coverage report
        if: runner.os == 'Linux' && matrix.python-version == '3.12'
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: coverage-report
          path: |
            coverage.xml
            test-results.xml
          retention-days: 1

  # ============================================================================
  # LAYER 3: Quality analysis (non-blocking, main only)
  # ============================================================================

  mutation-testing:
    name: Mutation Testing
    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
    runs-on: ubuntu-latest
    timeout-minutes: 30
    continue-on-error: true
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
        with:
          python-version: "3.12"

      - uses: astral-sh/setup-uv@d31148d669074a8d0a63714ba94f3201e7020bc3 # v8.3.0
        with:
          enable-cache: true

      - name: Install dependencies
        run: |
          uv pip install -e ".[dev]" --system
          uv pip install pytest-timeout --system

      - name: Run mutation testing
        env:
          PYTHONPATH: ${{ github.workspace }}/src
        run: |
          echo "=== Running Mutation Testing ==="
          cd ${{ github.workspace }}
          mutmut run || true

      - name: Generate mutation report
        run: |
          echo "=== Mutation Testing Results ==="
          mutmut results || true
          echo ""
          echo "=== Survived Mutants ==="
          mutmut results --survived 2>/dev/null || true

  complexity-checks:
    name: Complexity & Maintainability
    runs-on: ubuntu-latest
    timeout-minutes: 10
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
        with:
          python-version: "3.12"

      - run: pip install radon

      - name: Check cyclomatic complexity
        run: |
          echo "=== Cyclomatic Complexity Report ==="
          radon cc src/certamen/ --min B --show-complexity --total-average

      - name: Check maintainability index
        run: |
          echo "=== Maintainability Index Report ==="
          radon mi src/certamen/ --min B --show

      - name: Fail on high complexity
        run: |
          radon cc src/certamen/ --min C --total-average || \
            (echo "::warning::High complexity detected (grade C or worse)" && exit 0)

  architecture-checks:
    name: Architecture & Import Contracts
    runs-on: ubuntu-latest
    timeout-minutes: 10
    continue-on-error: true
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
        with:
          python-version: "3.12"

      - uses: astral-sh/setup-uv@d31148d669074a8d0a63714ba94f3201e7020bc3 # v8.3.0
        with:
          enable-cache: true

      - name: Install dependencies
        run: |
          uv pip install -e . --system
          uv pip install import-linter --system

      - name: Validate architecture
        run: lint-imports || echo "::warning::Architecture violations detected"

  frontend:
    name: Frontend (Biome + types)
    needs: [pre-commit]
    runs-on: ubuntu-latest
    timeout-minutes: 10
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version: "22"
          cache: npm
          cache-dependency-path: frontend/package-lock.json

      - name: Install dependencies
        run: npm ci
        working-directory: frontend

      - name: Biome check (lint + format)
        run: npx biome ci .
        working-directory: frontend

      - name: Type check
        run: npx tsc -b
        working-directory: frontend

      - name: Unit tests (Vitest)
        run: npx vitest run
        working-directory: frontend