name: Run Tests & Linting

on: [push, pull_request]

jobs:
  test:
    runs-on: ubuntu-latest
    services:
      redis:
        image: redis:7
        ports:
          - 6379:6379
        options: >-
          --health-cmd "redis-cli ping"
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5
      rabbitmq:
        image: rabbitmq:3-management
        ports:
          - 5672:5672
          - 15672:15672
        options: >-
          --health-cmd "rabbitmq-diagnostics -q ping"
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5
    steps:
      - name: Checkout Code
        uses: actions/checkout@v3

      - name: Set up Python
        uses: actions/setup-python@v4
        with:
          python-version: "3.11"

      - name: Install Dependencies
        run: |
          python -m pip install --upgrade pip
          pip install -r requirements-dev.txt

      - name: Run Tests
        # Exclude E2E tests (-m "not e2e") as they require Docker-in-Docker (testcontainers)
        # which isn't well-supported in GitHub Actions without additional DinD configuration.
        # E2E tests can be run locally with: pytest -m e2e
        run: pytest tests/ -v --cov=app --cov-report=xml --cov-report=term --junitxml=junit.xml -o junit_family=legacy -m "not e2e"

      - name: Upload coverage reports to Codecov
        uses: codecov/codecov-action@v5
        with:
          token: ${{ secrets.CODECOV_TOKEN }}
          file: ./coverage.xml
          fail_ci_if_error: false

      - name: Upload test results to Codecov
        if: ${{ !cancelled() }}
        uses: codecov/test-results-action@v1
        with:
          token: ${{ secrets.CODECOV_TOKEN }}

      - name: Run Linter (Flake8)
        run: flake8 app/ --max-line-length=120 --extend-ignore=E203,W503
        continue-on-error: false

      - name: Run Code Formatter (Black)
        run: black --check app/ --line-length=120
        continue-on-error: false

      - name: Run Type Checker (Mypy)
        run: mypy app/ --ignore-missing-imports
        continue-on-error: true

      - name: Run Linter (Pylint)
        run: pylint app/ --max-line-length=120 --disable=C0111,C0103,R0903
        continue-on-error: true
      
      - name: Run Security Linter (Bandit) - Full Report
        run: |
          echo "Running Bandit security scan..."
          bandit -r app/ -f json -o bandit-report.json || true
        continue-on-error: true
      
      - name: Run Security Linter (Bandit) - Fail on High/Medium
        run: |
          echo "Running Bandit security scan (fail on high/medium severity)..."
          bandit -r app/ -ll
        continue-on-error: false
      
      - name: Upload Bandit Report
        uses: actions/upload-artifact@v4
        if: always()
        with:
          name: bandit-report
          path: bandit-report.json