MajoorWaldi-ComfyUI-Majoor-AssetsManager/.github/workflows/python-tests.yml

name: Python tests

on:
  push:
    branches: [ main, master ]
  pull_request:
    branches: [ main, master ]

permissions: {}

jobs:
  quality:
    runs-on: ubuntu-22.04
    permissions:
      contents: read
    env:
      GIT_HTTP_LOW_SPEED_LIMIT: "1000"
      GIT_HTTP_LOW_SPEED_TIME: "60"
    steps:
      - name: Tune Git HTTP settings
        run: |
          git config --global http.lowSpeedLimit "$GIT_HTTP_LOW_SPEED_LIMIT"
          git config --global http.lowSpeedTime "$GIT_HTTP_LOW_SPEED_TIME"
          git config --global http.version HTTP/1.1

      - name: Checkout repository
        id: checkout_primary
        continue-on-error: true
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          fetch-depth: 0

      - name: Retry checkout after transient failure
        if: steps.checkout_primary.outcome == 'failure'
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          fetch-depth: 0

      - name: Set up Python
        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
        with:
          python-version: "3.12"

      - name: Install quality tools
        run: |
          python -m pip install --upgrade pip
          pip install -r requirements.txt
          pip install xenon radon flake8 flake8-cognitive-complexity pip-audit bandit

      - name: Check Python files encoding (no UTF-8 BOM)
        run: python scripts/check_no_bom.py mjr_am_backend mjr_am_shared tests __init__.py scripts

      - name: Complexity gate (stage A)
        run: python -m xenon -b F -m D -a C mjr_am_backend mjr_am_shared tests __init__.py

      - name: Complexity gate (new files, CC <= 10)
        run: python scripts/check_cc_changed.py

      - name: Audit Python dependencies
        run: pip-audit --strict

      - name: SAST scan (bandit)
        run: bandit -r mjr_am_backend -ll -ii -x tests

      - name: Install JS dependencies for audit
        run: npm ci --ignore-scripts

      - name: Audit JS dependencies
        run: npm audit --audit-level=high

  js-test:
    runs-on: ubuntu-22.04
    permissions:
      contents: read
    env:
      GIT_HTTP_LOW_SPEED_LIMIT: "1000"
      GIT_HTTP_LOW_SPEED_TIME: "60"
    steps:
      - name: Tune Git HTTP settings
        run: |
          git config --global http.lowSpeedLimit "$GIT_HTTP_LOW_SPEED_LIMIT"
          git config --global http.lowSpeedTime "$GIT_HTTP_LOW_SPEED_TIME"
          git config --global http.version HTTP/1.1

      - name: Checkout repository
        id: checkout_primary
        continue-on-error: true
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          fetch-depth: 0

      - name: Retry checkout after transient failure
        if: steps.checkout_primary.outcome == 'failure'
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          fetch-depth: 0

      - name: Set up Node.js
        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
        with:
          node-version: "20"
          cache: "npm"

      - name: Install JS dependencies
        run: npm ci --ignore-scripts

      - name: Run JS tests (vitest)
        run: npm run test:js

  test:
    runs-on: ubuntu-22.04
    permissions:
      contents: read
    env:
      GIT_HTTP_LOW_SPEED_LIMIT: "1000"
      GIT_HTTP_LOW_SPEED_TIME: "60"
    strategy:
      fail-fast: false
      matrix:
        python-version: ["3.10", "3.11", "3.12", "3.13", "3.14"]
    steps:
      - name: Tune Git HTTP settings
        run: |
          git config --global http.lowSpeedLimit "$GIT_HTTP_LOW_SPEED_LIMIT"
          git config --global http.lowSpeedTime "$GIT_HTTP_LOW_SPEED_TIME"
          git config --global http.version HTTP/1.1

      - name: Checkout repository
        id: checkout_primary
        continue-on-error: true
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          fetch-depth: 0

      - name: Retry checkout after transient failure
        if: steps.checkout_primary.outcome == 'failure'
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          fetch-depth: 0

      - name: Set up Python ${{ matrix.python-version }}
        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
        with:
          python-version: ${{ matrix.python-version }}

      - name: Install ExifTool and FFmpeg (includes ffprobe)
        run: |
          sudo apt-get update
          sudo apt-get install -y libimage-exiftool-perl ffmpeg

      - name: Verify ExifTool and ffprobe
        run: |
          echo "ExifTool version:"
          exiftool -ver || true
          echo "ffprobe version:"
          ffprobe -version || true

      - name: Install dependencies
        run: |
          python -m pip install --upgrade pip
          pip install -r requirements.txt
          pip install pytest pytest-asyncio pytest-cov

      - name: Run pytest
        run: python -m pytest -q --cov=mjr_am_backend --cov=mjr_am_shared --cov-report=xml --cov-report=term-missing:skip-covered

      - name: Upload coverage report
        if: matrix.python-version == '3.12'
        uses: actions/upload-artifact@v7
        with:
          name: coverage-xml
          path: coverage.xml
          retention-days: 14

  typecheck:
    runs-on: ubuntu-22.04
    permissions:
      contents: read
    env:
      GIT_HTTP_LOW_SPEED_LIMIT: "1000"
      GIT_HTTP_LOW_SPEED_TIME: "60"
    steps:
      - name: Tune Git HTTP settings
        run: |
          git config --global http.lowSpeedLimit "$GIT_HTTP_LOW_SPEED_LIMIT"
          git config --global http.lowSpeedTime "$GIT_HTTP_LOW_SPEED_TIME"
          git config --global http.version HTTP/1.1

      - name: Checkout repository
        id: checkout_primary
        continue-on-error: true
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          fetch-depth: 0

      - name: Retry checkout after transient failure
        if: steps.checkout_primary.outcome == 'failure'
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          fetch-depth: 0

      - name: Set up Python
        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
        with:
          python-version: "3.12"

      - name: Install dependencies
        run: |
          python -m pip install --upgrade pip
          pip install -r requirements.txt
          pip install mypy

      - name: Run mypy
        run: python -m mypy --config-file mypy.ini