ci.yml

 name: CI
 
 on:
   push:
   pull_request:
 
 jobs:
   test:
     runs-on: ubuntu-latest
     timeout-minutes: 15
 
     services:
       postgres:
         image: postgres:16
         env:
           POSTGRES_USER: ghost
           POSTGRES_PASSWORD: ghost
           POSTGRES_DB: ghost_bot
         ports:
           - 5432:5432
         options: >-
           --health-cmd "pg_isready -U ghost -d ghost_bot"
           --health-interval 10s
           --health-timeout 5s
           --health-retries 5
       redis:
         image: redis:7
         ports:
           - 6379:6379
         options: >-
           --health-cmd "redis-cli ping"
           --health-interval 10s
           --health-timeout 5s
           --health-retries 5
 
     env:
       # Keep CI deterministic and safe: no real tokens.
       TELEGRAM_BOT_TOKEN: "ci"
       DATABASE_URL: "postgresql+asyncpg://ghost:ghost@localhost:5432/ghost_bot"
       REDIS_URL: "redis://localhost:6379/0"
       CRON_SECRET: "ci"
       ENV: "dev"
 
     steps:
       - uses: actions/checkout@v4
 
       - name: Set up Python
         uses: actions/setup-python@v5
         with:
           python-version: "3.11"
           cache: "pip"
 
       - name: Install dependencies
         run: |
           python -m pip install --upgrade pip
           pip install -r requirements.txt
          pip install ruff mypy pre-commit
 
       - name: Ruff
        run: python -m ruff check .
 
       - name: Mypy
        run: python -m mypy
 
       - name: Pytest
        run: python -m pytest -q

  staging-smoke:
    name: Staging smoke (optional)
    runs-on: ubuntu-latest
    needs: [test]
    timeout-minutes: 10
    if: ${{ secrets.STAGING_BASE_URL != '' && secrets.CRON_SECRET != '' }}
    steps:
      - name: Smoke check /health
        run: |
          curl -fsSL "${{ secrets.STAGING_BASE_URL }}/health"

      - name: Smoke check /ready
        run: |
          curl -fsSL "${{ secrets.STAGING_BASE_URL }}/ready"

      - name: Smoke check /admin/stats (authorized)
        run: |
          curl -fsSL "${{ secrets.STAGING_BASE_URL }}/admin/stats" \
            -H "Authorization: Bearer ${{ secrets.CRON_SECRET }}"

      - name: Smoke check /admin/config (authorized)
        run: |
          curl -fsSL "${{ secrets.STAGING_BASE_URL }}/admin/config" \
            -H "Authorization: Bearer ${{ secrets.CRON_SECRET }}"