pr-checks.yml

name: PR Checks

on:
  pull_request:
    branches:
      - main
      - develop
  push:
    branches:
      - main
      - develop

permissions:
  contents: read
  pull-requests: write
  issues: write

jobs:
  test:
    name: Test Python ${{ matrix.python-version }}
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        python-version: ['3.10', '3.11', '3.12', '3.13']
    
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
      
      - name: Set up Python ${{ matrix.python-version }}
        uses: actions/setup-python@v5
        with:
          python-version: ${{ matrix.python-version }}
          cache: 'pip'
      
      - name: Install dependencies
        run: |
          python -m pip install --upgrade pip
          pip install -e ".[dev]"
      
      - name: Run linting (ruff)
        run: |
          ruff check .
        continue-on-error: true
      
      - name: Run type checking (mypy)
        run: |
          mypy capiscio_sdk
        continue-on-error: true
      
      - name: Run unit tests
        run: |
          pytest tests/unit/ -v --tb=short --cov=capiscio_sdk --cov-report=xml --cov-report=term --cov-fail-under=70
      
      # Server-dependent integration/E2E coverage is owned by capiscio-e2e-tests.
      # This job keeps fast contract coverage for SDK-only integration behavior.
      - name: Run integration contract tests (server-independent)
        run: |
          # Only run tests that don't require server connection or external binaries
          pytest tests/integration/ -v --tb=short -k "not server" \
            --ignore=tests/integration/test_server_integration.py \
            --ignore=tests/integration/test_dv_badge_flow.py \
            --ignore=tests/integration/test_dv_order_api.py \
            --ignore=tests/integration/test_dv_sdk.py \
            --ignore=tests/integration/test_mcp_service.py
        continue-on-error: true
      
      - name: Upload coverage to Codecov
        if: matrix.python-version == '3.11'
        uses: codecov/codecov-action@v4
        with:
          file: ./coverage.xml
          flags: unittests
          name: codecov-umbrella
          fail_ci_if_error: false
        env:
          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
  
  security-scan:
    name: Security Scan
    runs-on: ubuntu-latest
    
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
      
      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: '3.11'
      
      - name: Install dependencies
        run: |
          python -m pip install --upgrade pip
          pip install -e ".[dev]"
      
      - name: Run safety check
        run: |
          safety check --json || true
        continue-on-error: true
      
      - name: Run bandit security scan
        run: |
          bandit -r capiscio_sdk -f json -o bandit-report.json || true
        continue-on-error: true
      
      - name: Upload bandit report
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: bandit-report
          path: bandit-report.json
  
  build-check:
    name: Build Check
    runs-on: ubuntu-latest
    
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
      
      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: '3.11'
      
      - name: Install build dependencies
        run: |
          python -m pip install --upgrade pip
          python -m pip install build twine
      
      - name: Build package
        run: python -m build
      
      - name: Check package with twine
        run: python -m twine check dist/*
      
      - name: Upload build artifacts
        uses: actions/upload-artifact@v4
        with:
          name: dist
          path: dist/
  
  docs-check:
    name: Documentation Check
    runs-on: ubuntu-latest
    
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
      
      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: '3.11'
      
      - name: Install dependencies
        run: |
          pip install --upgrade pip
          pip install mkdocs-material "mkdocstrings[python]>=0.24"
      
      - name: Build documentation
        run: mkdocs build --strict
      
      - name: Check for broken links
        uses: gaurav-nelson/github-action-markdown-link-check@v1
        with:
          use-quiet-mode: 'yes'
          folder-path: 'docs'
          config-file: '.github/markdown-link-check-config.json'
        continue-on-error: true
  
  all-checks-passed:
    name: All Checks Passed
    needs: [test, security-scan, build-check, docs-check]
    runs-on: ubuntu-latest
    if: always()
    
    steps:
      - name: Check if all jobs passed
        run: |
          if [ "${{ needs.test.result }}" != "success" ] || \
             [ "${{ needs.build-check.result }}" != "success" ] || \
             [ "${{ needs.docs-check.result }}" != "success" ]; then
            echo "Some required checks failed"
            exit 1
          fi
          echo "All required checks passed!"
      
      - name: Add PR comment
        if: github.event_name == 'pull_request'
        uses: actions/github-script@v7
        with:
          script: |
            github.rest.issues.createComment({
              issue_number: context.issue.number,
              owner: context.repo.owner,
              repo: context.repo.repo,
              body: '✅ All checks passed! Ready for review.'
            })