pr-preview.yml

# ==============================================================================
# PR Preview — Build, Test & Report on Pull Requests
# Runs full CI suite on PRs and posts results as a PR comment.
# Does NOT deploy — preview only.
# ==============================================================================

name: PR Preview

on:
  pull_request:
    branches: [main]
    types: [opened, synchronize, reopened]

concurrency:
  group: pr-preview-${{ github.event.pull_request.number }}
  cancel-in-progress: true

permissions:
  contents: read
  pull-requests: write
  checks: write

jobs:
  # --------------------------------------------------------------------------
  # Run tests with coverage
  # --------------------------------------------------------------------------
  test:
    name: Tests & Coverage
    runs-on: ubuntu-latest

    outputs:
      coverage: ${{ steps.cov.outputs.coverage }}
      tests-passed: ${{ steps.results.outputs.passed }}
      tests-failed: ${{ steps.results.outputs.failed }}
      tests-total: ${{ steps.results.outputs.total }}

    steps:
      - uses: actions/checkout@v4

      - name: Set up Python 3.11
        uses: actions/setup-python@v5
        with:
          python-version: "3.11"

      - name: Cache pip dependencies
        uses: actions/cache@v4
        with:
          path: ~/.cache/pip
          key: pip-pr-${{ runner.os }}-py3.11-${{ hashFiles('pyproject.toml', 'setup.cfg', 'requirements*.txt') }}
          restore-keys: |
            pip-pr-${{ runner.os }}-py3.11-

      - name: Install dependencies
        run: |
          python -m pip install --upgrade pip
          pip install -e ".[dev]"

      - name: Run tests with coverage
        id: test-run
        env:
          RATE_LIMIT_ENABLED: "false"
        run: |
          pytest tests/ -v --tb=short \
            --cov=src \
            --cov-report=term-missing \
            --cov-report=xml:coverage.xml \
            --cov-report=html:htmlcov/ \
            --junitxml=test-results.xml \
            2>&1 | tee test-output.txt
          echo "exit_code=${PIPESTATUS[0]}" >> "$GITHUB_OUTPUT"

      - name: Extract coverage percentage
        id: cov
        if: always()
        run: |
          COVERAGE=$(python -m coverage report --format=total 2>/dev/null || echo "0")
          echo "coverage=${COVERAGE}" >> "$GITHUB_OUTPUT"

      - name: Parse test results
        id: results
        if: always()
        run: |
          if [ -f test-results.xml ]; then
            TOTAL=$(python -c "
          import xml.etree.ElementTree as ET
          tree = ET.parse('test-results.xml')
          root = tree.getroot()
          print(root.attrib.get('tests', '0'))
          " 2>/dev/null || echo "0")

            FAILURES=$(python -c "
          import xml.etree.ElementTree as ET
          tree = ET.parse('test-results.xml')
          root = tree.getroot()
          f = int(root.attrib.get('failures', '0'))
          e = int(root.attrib.get('errors', '0'))
          print(f + e)
          " 2>/dev/null || echo "0")

            PASSED=$((TOTAL - FAILURES))
            echo "total=${TOTAL}" >> "$GITHUB_OUTPUT"
            echo "passed=${PASSED}" >> "$GITHUB_OUTPUT"
            echo "failed=${FAILURES}" >> "$GITHUB_OUTPUT"
          else
            echo "total=0" >> "$GITHUB_OUTPUT"
            echo "passed=0" >> "$GITHUB_OUTPUT"
            echo "failed=0" >> "$GITHUB_OUTPUT"
          fi

      - name: Upload coverage artifact
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: pr-coverage-${{ github.event.pull_request.number }}
          path: |
            coverage.xml
            htmlcov/
            test-results.xml
          retention-days: 7

  # --------------------------------------------------------------------------
  # Lint check
  # --------------------------------------------------------------------------
  lint:
    name: Lint Check
    runs-on: ubuntu-latest

    outputs:
      status: ${{ steps.lint-run.outputs.status }}

    steps:
      - uses: actions/checkout@v4

      - name: Set up Python 3.11
        uses: actions/setup-python@v5
        with:
          python-version: "3.11"

      - name: Cache pip dependencies
        uses: actions/cache@v4
        with:
          path: ~/.cache/pip
          key: pip-pr-lint-${{ runner.os }}-py3.11-${{ hashFiles('pyproject.toml', 'setup.cfg', 'requirements*.txt') }}
          restore-keys: |
            pip-pr-lint-${{ runner.os }}-py3.11-

      - name: Install dependencies
        run: |
          python -m pip install --upgrade pip
          pip install -e ".[dev]"

      - name: Run lint
        id: lint-run
        run: |
          if ruff check src/ tests/ && ruff format --check src/ tests/; then
            echo "status=passed" >> "$GITHUB_OUTPUT"
          else
            echo "status=failed" >> "$GITHUB_OUTPUT"
            exit 1
          fi

  # --------------------------------------------------------------------------
  # Security quick scan
  # --------------------------------------------------------------------------
  security:
    name: Security Quick Scan
    runs-on: ubuntu-latest

    outputs:
      status: ${{ steps.sec.outputs.status }}

    steps:
      - uses: actions/checkout@v4

      - name: Set up Python 3.11
        uses: actions/setup-python@v5
        with:
          python-version: "3.11"

      - name: Install and scan
        id: sec
        run: |
          python -m pip install --upgrade pip
          pip install -e "."
          pip install pip-audit bandit

          ISSUES=0
          pip-audit --strict 2>/dev/null || ISSUES=1
          bandit -r src/ -s B101,B601 -q 2>/dev/null || ISSUES=1

          if [ "$ISSUES" -eq 0 ]; then
            echo "status=passed" >> "$GITHUB_OUTPUT"
          else
            echo "status=warnings" >> "$GITHUB_OUTPUT"
          fi

  # --------------------------------------------------------------------------
  # Post PR comment with results
  # --------------------------------------------------------------------------
  comment:
    name: Post PR Comment
    runs-on: ubuntu-latest
    needs: [test, lint, security]
    if: always()

    permissions:
      pull-requests: write

    steps:
      - name: Post results comment
        uses: actions/github-script@v7
        with:
          script: |
            const coverage = '${{ needs.test.outputs.coverage }}' || '0';
            const testsPassed = '${{ needs.test.outputs.tests-passed }}' || '0';
            const testsFailed = '${{ needs.test.outputs.tests-failed }}' || '0';
            const testsTotal = '${{ needs.test.outputs.tests-total }}' || '0';
            const lintStatus = '${{ needs.lint.outputs.status }}' || 'unknown';
            const securityStatus = '${{ needs.security.outputs.status }}' || 'unknown';
            const testResult = '${{ needs.test.result }}';
            const lintResult = '${{ needs.lint.result }}';

            // Coverage badge color
            const covNum = parseInt(coverage) || 0;
            let covColor = 'red';
            if (covNum >= 80) covColor = 'brightgreen';
            else if (covNum >= 60) covColor = 'yellow';
            else if (covNum >= 40) covColor = 'orange';

            // Status emojis
            const testEmoji = testResult === 'success' ? '' : '';
            const lintEmoji = lintResult === 'success' ? '' : '';
            const secEmoji = securityStatus === 'passed' ? '' : '';

            const body = `## PR Preview Results

            ![Coverage](https://img.shields.io/badge/coverage-${coverage}%25-${covColor})

            | Check | Status | Details |
            |-------|--------|---------|
            | ${testEmoji} Tests | **${testResult}** | ${testsPassed}/${testsTotal} passed, ${testsFailed} failed |
            | ${lintEmoji} Lint | **${lintResult}** | ruff check + format |
            | ${secEmoji} Security | **${securityStatus}** | pip-audit + bandit |

            ### Coverage: ${coverage}%

            <details>
            <summary>Details</summary>

            - **Passed:** ${testsPassed}
            - **Failed:** ${testsFailed}
            - **Total:** ${testsTotal}
            - **Coverage:** ${coverage}%

            </details>

            ---
            *Commit: \`${context.sha.substring(0, 8)}\` | [View workflow run](${context.serverUrl}/${context.repo.owner}/${context.repo.repo}/actions/runs/${context.runId})*`;

            // Find existing comment to update
            const { data: comments } = await github.rest.issues.listComments({
              owner: context.repo.owner,
              repo: context.repo.repo,
              issue_number: context.issue.number,
            });

            const botComment = comments.find(c =>
              c.user.type === 'Bot' && c.body.includes('PR Preview Results')
            );

            if (botComment) {
              await github.rest.issues.updateComment({
                owner: context.repo.owner,
                repo: context.repo.repo,
                comment_id: botComment.id,
                body: body,
              });
            } else {
              await github.rest.issues.createComment({
                owner: context.repo.owner,
                repo: context.repo.repo,
                issue_number: context.issue.number,
                body: body,
              });
            }