name: Python tests

on:
  push:
    branches: [ main, master ]
  pull_request:
    branches: [ main, master ]

permissions: {}

jobs:
  quality:
    runs-on: ubuntu-22.04
    permissions:
      contents: read
    env:
      GIT_HTTP_LOW_SPEED_LIMIT: "1000"
      GIT_HTTP_LOW_SPEED_TIME: "60"
    steps:
      - name: Tune Git HTTP settings
        run: |
          git config --global http.lowSpeedLimit "$GIT_HTTP_LOW_SPEED_LIMIT"
          git config --global http.lowSpeedTime "$GIT_HTTP_LOW_SPEED_TIME"
          git config --global http.version HTTP/1.1

      - name: Checkout repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0

      - name: Set up Python
        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: "3.12"

      - name: Set up Node.js
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: "22"
          cache: "npm"

      - name: Install quality tools
        run: |
          python -m pip install --upgrade pip
          pip install -r requirements.txt
          pip install .[dev]

      - name: Install JS dependencies for changed-file gate and audit
        run: npm ci --ignore-scripts

      - name: Run changed-file quality gate on pull requests
        if: github.event_name == 'pull_request'
        shell: bash
        run: |
          set -o pipefail
          python scripts/run_changed_quality_gate.py 2>&1 | tee quality-gate.log

      - name: Run canonical quality gate on pushes
        if: github.event_name == 'push'
        shell: bash
        run: |
          set -o pipefail
          python scripts/run_quality_gate.py --python-only --skip-tests 2>&1 | tee quality-gate.log

      - name: Audit JS dependencies
        run: npm audit --audit-level=high

  js-test:
    runs-on: ubuntu-22.04
    permissions:
      contents: read
    env:
      GIT_HTTP_LOW_SPEED_LIMIT: "1000"
      GIT_HTTP_LOW_SPEED_TIME: "60"
    steps:
      - name: Tune Git HTTP settings
        run: |
          git config --global http.lowSpeedLimit "$GIT_HTTP_LOW_SPEED_LIMIT"
          git config --global http.lowSpeedTime "$GIT_HTTP_LOW_SPEED_TIME"
          git config --global http.version HTTP/1.1

      - name: Checkout repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0

      - name: Set up Node.js
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: "22"
          cache: "npm"

      - name: Install JS dependencies
        run: npm ci --ignore-scripts

      - name: Typecheck frontend
        run: npx tsc -p tsconfig.json --noEmit --pretty false

      - name: Build frontend bundle
        run: npm run build

      - name: Report generated frontend bundle drift
        run: |
          if ! git diff --quiet -- dist; then
            echo "::notice::Frontend bundle differs after the Linux CI build; verify dist before release."
            git diff --stat -- dist
          fi

      - name: Run JS tests (vitest)
        run: npm run test:js

  test:
    runs-on: ubuntu-22.04
    permissions:
      contents: read
    env:
      GIT_HTTP_LOW_SPEED_LIMIT: "1000"
      GIT_HTTP_LOW_SPEED_TIME: "60"
    strategy:
      fail-fast: false
      matrix:
        python-version: ["3.10", "3.11", "3.12", "3.13"]
    steps:
      - name: Tune Git HTTP settings
        run: |
          git config --global http.lowSpeedLimit "$GIT_HTTP_LOW_SPEED_LIMIT"
          git config --global http.lowSpeedTime "$GIT_HTTP_LOW_SPEED_TIME"
          git config --global http.version HTTP/1.1

      - name: Checkout repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0

      - name: Set up Python ${{ matrix.python-version }}
        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: ${{ matrix.python-version }}

      - name: Install ExifTool and FFmpeg (includes ffprobe)
        run: |
          sudo apt-get update
          sudo apt-get install -y libimage-exiftool-perl ffmpeg

      - name: Verify ExifTool and ffprobe
        run: |
          echo "ExifTool version:"
          exiftool -ver || true
          echo "ffprobe version:"
          ffprobe -version || true

      - name: Install dependencies
        run: |
          python -m pip install --upgrade pip
          pip install -r requirements.txt
          pip install .[dev]

      - name: Run pytest
        run: python -m pytest -q --timeout=300 --cov=mjr_am_backend --cov=mjr_am_shared --cov-branch --cov-fail-under=60 --cov-report=xml --cov-report=term-missing:skip-covered

      - name: Upload coverage report
        if: matrix.python-version == '3.12'
        uses: actions/upload-artifact@v7
        with:
          name: coverage-xml
          path: coverage.xml
          retention-days: 14

  typecheck:
    runs-on: ubuntu-22.04
    permissions:
      contents: read
    env:
      GIT_HTTP_LOW_SPEED_LIMIT: "1000"
      GIT_HTTP_LOW_SPEED_TIME: "60"
    steps:
      - name: Tune Git HTTP settings
        run: |
          git config --global http.lowSpeedLimit "$GIT_HTTP_LOW_SPEED_LIMIT"
          git config --global http.lowSpeedTime "$GIT_HTTP_LOW_SPEED_TIME"
          git config --global http.version HTTP/1.1

      - name: Checkout repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0

      - name: Set up Python
        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: "3.12"

      - name: Install dependencies
        run: |
          python -m pip install --upgrade pip
          pip install -r requirements.txt
          pip install .[dev]

      - name: Run mypy
        run: python -m mypy --config-file mypy.ini