ci.yml

name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

jobs:
  lint-typecheck-test:
    name: Python ${{ matrix.python-version }} – lint / typecheck / test
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        python-version: ["3.11", "3.12"]

    steps:
      - uses: actions/checkout@v4

      - name: Set up Python ${{ matrix.python-version }}
        uses: actions/setup-python@v5
        with:
          python-version: ${{ matrix.python-version }}
          cache: pip

      - name: Install dependencies
        run: |
          python -m pip install --upgrade pip
          pip install -e ".[dev]"

      # ── Lint ────────────────────────────────────────────────────────────────
      - name: Ruff lint
        run: ruff check app tests

      - name: Ruff format check
        run: ruff format --check app tests

      # ── Type checking ────────────────────────────────────────────────────────
      - name: Mypy
        run: mypy app/

      # ── Security scan ────────────────────────────────────────────────────────
      # Issue #55: run bandit at -ll against a committed baseline so the
      # scanner is on by default and NEW findings fail the build. The baseline
      # (bandit-baseline.json) currently records zero issues and may only grow
      # when a finding is reviewed and explicitly accepted with justification.
      - name: Bandit security scan
        run: bandit -r app -ll -b bandit-baseline.json -c pyproject.toml

      # ── Tests + coverage ─────────────────────────────────────────────────────
      - name: Pytest with branch coverage
        run: |
          pytest \
            --cov=app \
            --cov-branch \
            --cov-fail-under=80 \
            --cov-report=term-missing \
            --cov-report=xml:coverage.xml \
            -v

      - name: Upload coverage report
        uses: actions/upload-artifact@v4
        if: matrix.python-version == '3.11'
        with:
          name: coverage-report
          path: coverage.xml
          retention-days: 7

      # ── OpenAPI contract test ────────────────────────────────────────────────
      - name: OpenAPI contract test
        run: pytest tests/test_openapi_contract.py -v

      # ── OpenAPI drift check ──────────────────────────────────────────────────
      - name: OpenAPI drift check
        if: matrix.python-version == '3.11'
        env:
          DATABASE_URL: postgresql://user:pass@localhost:5432/apexchainx
          JWT_SECRET_KEY: openapi-drift-check-key
          STELLAR_NETWORK: testnet
          CONTRACT_EXECUTION_MODE: local_adapter
          CELERY_TASK_ALWAYS_EAGER: "true"
          API_V1_PREFIX: /api/v1
          ALLOWED_ORIGINS: '["http://localhost:3000"]'
        run: python scripts/openapi_diff.py