name: CI

on:
  pull_request:
    branches: [main]
  push:
    branches: [main]
  schedule:
    - cron: "23 6 * * 1"
  workflow_dispatch:

permissions:
  contents: read

jobs:
  lint-smoke:
    name: Lint & Smoke
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: "3.11"

      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: "22"

      - name: Install lint tools
        run: pip install ruff==0.6.9

      - name: Ruff check
        run: ruff check .

      - name: Compile all (syntax smoke)
        run: python -m compileall -q -x '(\.venv|forks|upscaler_FIX/github_repos|nuke_CAM_exporter)' .

      - name: Run JS smoke tests
        run: |
          node tests/js/test_ai_pipeline_preview.mjs
          node tests/js/test_draft_guard.mjs
          node tests/js/test_update_check.mjs

  security-gate:
    name: Security Gate
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: "3.11"

      - name: Install security tools
        run: pip install bandit==1.7.10 pip-audit -c constraints-test.txt

      - name: Bandit scan
        run: bandit -r . -x ./.venv,./forks,./upscaler_FIX,./nuke_CAM_exporter -ll

      - name: Dependency audit
        run: pip-audit -r constraints-test.txt

      - name: Audit all platform dependency pins
        run: |
          sed -E 's/[[:space:]]*;.*$//' constraints-test.txt > /tmp/constraints-all-platforms.txt
          pip-audit --no-deps -r /tmp/constraints-all-platforms.txt

  preflight:
    name: Pre-flight Release
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: "3.11"

      - name: Run pre-flight (static + dispatch + workflow fixtures)
        # manager-meta is skipped on PRs because the upstream node-map drift
        # is owned by an external repo (ltdrdata/ComfyUI-Manager) and is
        # tracked separately via issue #44. Re-enable by removing --skip
        # once that issue is resolved upstream.
        run: python tools/preflight_release.py --skip manager-meta -v

  pytest:
    name: Pytest
    runs-on: ${{ matrix.os }}
    strategy:
      # Keep both lanes reporting even when one fails — a Windows-only
      # failure with a green ubuntu lane is exactly the signal this
      # matrix exists to surface.
      fail-fast: false
      matrix:
        os: [ubuntu-latest, windows-latest]
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: "3.11"

      - name: Install test deps
        # Install from the committed test lock so CI exercises the same
        # dependency set that local bootstrap audits.
        run: pip install -e ".[test]" -c constraints-test.txt

      - name: Run pytest
        run: pytest -q