# YPMS CI — Gitea Actions (act_runner) on gitea.doesworks.net.
#
# Gates (PHASE0_PLAN 0.8; NIST SA-11, RA-5, CM-8, SR-4):
#   lint (ruff) · types (mypy strict) · tests + 80% coverage floor (includes
#   the Alembic migration-drift test) · SAST (bandit) · SCA (pip-audit on the
#   runtime dependency set) · secret scan (gitleaks, full history) ·
#   SBOM (CycloneDX 1.6, runtime-only, uploaded as an artifact).
#
# Runner: needs the `ubuntu-latest` label mapped to an act-compatible image
# (e.g. catthehacker/ubuntu:act-22.04) with outbound access to github.com for
# actions/* and the gitleaks release, and to PyPI.
#
# Suppressions are per-finding with a written reason, never blanket skips.

name: ci

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

env:
  GITLEAKS_VERSION: "8.30.1"
  # sha256 of gitleaks_8.30.1_linux_x64.tar.gz from the release checksums file
  GITLEAKS_SHA256: "551f6fc83ea457d62a0d98237cbad105af8d557003051f41f3e7ca7b3f2470eb"

jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0 # gitleaks scans full history

      - name: Set up Python 3.12
        uses: actions/setup-python@v5
        with:
          python-version: "3.12"
          cache: pip

      - name: Install
        run: |
          python -m pip install --upgrade pip
          pip install -e '.[dev]'

      - name: Lint (ruff)
        run: ruff check src tests

      - name: Type check (mypy)
        run: mypy src

      - name: Tests + coverage
        run: pytest --cov=src/ypms --cov-report=term-missing --cov-fail-under=80

      - name: SAST (bandit)
        run: bandit -r src -c pyproject.toml

      - name: SCA (pip-audit, runtime dependencies)
        run: pip-audit --strict .

      - name: Secret scan (gitleaks)
        run: |
          curl -sSfL -o gitleaks.tgz \
            "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz"
          echo "${GITLEAKS_SHA256}  gitleaks.tgz" | sha256sum -c -
          tar xzf gitleaks.tgz gitleaks
          ./gitleaks git . --redact --no-banner --exit-code 1

      - name: SBOM (CycloneDX, runtime only)
        run: |
          python -m venv /tmp/runtime
          /tmp/runtime/bin/pip install --quiet .
          cyclonedx-py environment --of JSON -o sbom.cdx.json /tmp/runtime/bin/python

      # v3 targets the GHES-style artifact API Gitea implements. Move to v4 only
      # after confirming this Gitea server accepts it.
      - uses: actions/upload-artifact@v3
        with:
          name: sbom
          path: sbom.cdx.json