name: CI

on:
  push:
    branches: [main]
  pull_request:

env:
  PYTHON_VERSION: "3.12"

jobs:
  lint:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: ${{ env.PYTHON_VERSION }}
          cache: pip
      - run: pip install -e ".[dev]"
      - run: ruff check app migrations tests

  typecheck:
    runs-on: ubuntu-latest
    needs: lint
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: ${{ env.PYTHON_VERSION }}
          cache: pip
      - run: pip install -e ".[dev]"
      - run: mypy app

  unit-tests:
    runs-on: ubuntu-latest
    needs: lint
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: ${{ env.PYTHON_VERSION }}
          cache: pip
      - run: pip install -e ".[dev]"
      - run: pytest tests/unit -v

  # Also proves migrations apply cleanly to an empty database (section 27):
  # this job's Postgres service starts empty, and the first step to touch
  # it is `alembic upgrade head`.
  integration-tests:
    runs-on: ubuntu-latest
    needs: unit-tests
    services:
      postgres:
        image: postgres:17-alpine
        env:
          POSTGRES_USER: aurora
          POSTGRES_PASSWORD: aurora
          POSTGRES_DB: aurora_core_test
        ports: ["5432:5432"]
        options: >-
          --health-cmd "pg_isready -U aurora"
          --health-interval 5s
          --health-timeout 5s
          --health-retries 10
      redis:
        image: redis:7-alpine
        ports: ["6379:6379"]
        options: >-
          --health-cmd "redis-cli ping"
          --health-interval 5s
          --health-timeout 5s
          --health-retries 10
    env:
      DATABASE_URL: postgresql+asyncpg://aurora:aurora@localhost:5432/aurora_core_test
      DATABASE_URL_SYNC: postgresql+psycopg2://aurora:aurora@localhost:5432/aurora_core_test
      TEST_DATABASE_URL: postgresql+asyncpg://aurora:aurora@localhost:5432/aurora_core_test
      REDIS_URL: redis://localhost:6379/0
      TEST_REDIS_URL: redis://localhost:6379/15
      AURORA_SECRET_KEY: ci-secret
      AURORA_ADMIN_API_KEYS: ci-admin-key
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: ${{ env.PYTHON_VERSION }}
          cache: pip
      - run: pip install -e ".[dev]"
      - name: Run migrations against an empty database
        run: alembic upgrade head
      - name: Start the API and smoke-test it
        run: |
          uvicorn app.main:app --host 0.0.0.0 --port 8000 &
          for i in $(seq 1 20); do
            curl -fsS http://localhost:8000/health && break
            sleep 1
          done
          curl -fsS http://localhost:8000/ready
          curl -fsS "http://localhost:8000/api/v1/search?q=test"
          kill %1
      - name: Run integration tests
        run: pytest tests/integration -v

  container-build:
    runs-on: ubuntu-latest
    needs: [typecheck, integration-tests]
    steps:
      - uses: actions/checkout@v4
      - uses: docker/setup-buildx-action@v3
      - name: Build API image
        uses: docker/build-push-action@v6
        with:
          context: .
          file: docker/api.Dockerfile
          push: false
          tags: aurora-core-api:ci
          cache-from: type=gha
          cache-to: type=gha,mode=max
      - name: Build worker image
        uses: docker/build-push-action@v6
        with:
          context: .
          file: docker/worker.Dockerfile
          push: false
          tags: aurora-core-worker:ci
          cache-from: type=gha
          cache-to: type=gha,mode=max

  dependency-audit:
    runs-on: ubuntu-latest
    needs: lint
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: ${{ env.PYTHON_VERSION }}
          cache: pip
      - run: pip install -e "."
      - run: pip install pip-audit
      - run: pip-audit --strict