name: Python tests

on:
  push:
    branches: [ main, master ]
  pull_request:
    branches: [ main, master ]

permissions: {}

jobs:
  quality:
    runs-on: ubuntu-22.04
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

      - name: Set up Python
        uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b # v5.3.0
        with:
          python-version: "3.12"

      - name: Install quality tools
        run: |
          python -m pip install --upgrade pip
          pip install -r requirements.txt
          pip install xenon radon flake8 flake8-cognitive-complexity pip-audit bandit

      - name: Check Python files encoding (no UTF-8 BOM)
        run: python scripts/check_no_bom.py mjr_am_backend mjr_am_shared tests __init__.py scripts

      - name: Complexity gate (stage A)
        run: python -m xenon -b F -m D -a C mjr_am_backend mjr_am_shared tests __init__.py

      - name: Complexity gate (new files, CC <= 10)
        run: python scripts/check_cc_changed.py

      - name: Audit Python dependencies
        run: pip-audit --strict

      - name: SAST scan (bandit)
        run: bandit -r mjr_am_backend -ll -ii -x tests

      - name: Install JS dependencies for audit
        run: npm ci --ignore-scripts

      - name: Audit JS dependencies
        run: npm audit --audit-level=high

  test:
    runs-on: ubuntu-22.04
    permissions:
      contents: read
    strategy:
      fail-fast: false
      matrix:
        python-version: ["3.10", "3.12", "3.13", "3.14"]
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

      - name: Set up Python ${{ matrix.python-version }}
        uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b # v5.3.0
        with:
          python-version: ${{ matrix.python-version }}

      - name: Install ExifTool and FFmpeg (includes ffprobe)
        run: |
          sudo apt-get update
          sudo apt-get install -y libimage-exiftool-perl ffmpeg

      - name: Verify ExifTool and ffprobe
        run: |
          echo "ExifTool version:"
          exiftool -ver || true
          echo "ffprobe version:"
          ffprobe -version || true

      - name: Install dependencies
        run: |
          python -m pip install --upgrade pip
          pip install -r requirements.txt
          pip install pytest pytest-asyncio

      - name: Run pytest
        run: python -m pytest -q

  typecheck:
    runs-on: ubuntu-22.04
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

      - name: Set up Python
        uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b # v5.3.0
        with:
          python-version: "3.12"

      - name: Install dependencies
        run: |
          python -m pip install --upgrade pip
          pip install -r requirements.txt
          pip install mypy

      - name: Run mypy
        run: python -m mypy --config-file mypy.ini