name: Coverage Baseline

on:
  push:
    branches:
      - main
      - dev
    paths:
      - '**/*.py'
      - 'pyproject.toml'
      - 'package.json'
      - 'package-lock.json'
      - 'requirements-dev.txt'
      - 'scripts/run_coverage_baseline.py'
      - '.github/workflows/coverage-baseline.yml'
  pull_request:
    paths:
      - '**/*.py'
      - 'pyproject.toml'
      - 'package.json'
      - 'package-lock.json'
      - 'requirements-dev.txt'
      - 'scripts/run_coverage_baseline.py'
      - '.github/workflows/coverage-baseline.yml'
  workflow_dispatch:

permissions:
  contents: read

jobs:
  coverage-baseline:
    runs-on: ubuntu-latest
    timeout-minutes: 10

    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: '3.10'
          cache: pip
          cache-dependency-path: requirements-dev.txt

      - name: Supply-chain dependency gate
        run: |
          python scripts/check_supply_chain.py --skip-install-trees

      - name: Install dev dependencies
        run: |
          python -m pip install --upgrade pip
          python -m pip install -r requirements-dev.txt

      - name: Run coverage baseline
        run: |
          python scripts/run_coverage_baseline.py --xml coverage.xml

      - name: Upload coverage XML
        uses: actions/upload-artifact@v4
        with:
          name: coverage-xml
          path: coverage.xml
          if-no-files-found: error
          retention-days: 7