ci.yml

# CI/CD Pipeline - UV Workspace Aware
# Runs tests, linting, type checking, and security scans for each package.
#
# Features:
#   - Path-based change detection (only test changed packages)
#   - Per-package test jobs
#   - Matrix testing (Python 3.10-3.13)
#   - Security scanning (Bandit, Safety)
#   - SonarCloud/Codecov integration
name: CI

on:
  push:
    branches: [main, master, develop]
  pull_request:
    types: [opened, synchronize, reopened]
    branches: [main, master, develop]
  workflow_dispatch:

# Cancel in-progress runs for same PR/branch
concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true

permissions:
  contents: read

jobs:
  # Detect which packages have changed
  detect-changes:
    name: Detect Changed Packages
    runs-on: ubuntu-latest
    permissions:
      contents: read
      pull-requests: read
    outputs:
      cloudflare-auth: ${{ steps.filter.outputs.cloudflare-auth }}
      gcs-utilities: ${{ steps.filter.outputs.gcs-utilities }}
      shared: ${{ steps.filter.outputs.shared }}
      any-package: >-
        ${{ steps.filter.outputs.cloudflare-auth == 'true' ||
        steps.filter.outputs.gcs-utilities == 'true' ||
        steps.filter.outputs.shared == 'true' }}
    steps:
      - name: Harden the runner
        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
        with:
          egress-policy: audit

      - name: Checkout repository
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3

      - name: Detect path changes
        uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1
        id: filter
        with:
          filters: |
            cloudflare-auth:
              - 'packages/cloudflare-auth/**'
            gcs-utilities:
              - 'packages/gcs-utilities/**'
            shared:
              - 'pyproject.toml'
              - 'uv.lock'
              - '.github/workflows/**'
              - 'src/**'

  # Test cloudflare-auth package
  test-cloudflare-auth:
    name: Test cloudflare-auth (Python ${{ matrix.python-version }})
    needs: detect-changes
    if: needs.detect-changes.outputs.cloudflare-auth == 'true' || needs.detect-changes.outputs.shared == 'true'
    runs-on: ubuntu-latest
    permissions:
      contents: read
    strategy:
      fail-fast: false
      matrix:
        python-version: ['3.10', '3.11', '3.12', '3.13']
    steps:
      - name: Harden the runner
        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
        with:
          egress-policy: audit

      - name: Checkout repository
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3

      - name: Install uv
        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
        with:
          enable-cache: true

      - name: Set up Python ${{ matrix.python-version }}
        run: uv python install ${{ matrix.python-version }}

      - name: Install workspace dependencies
        run: uv sync --all-extras

      - name: Run tests with coverage
        run: |
          uv run pytest packages/cloudflare-auth/tests \
            --cov=packages/cloudflare-auth/src/cloudflare_auth \
            --cov-report=xml:coverage-cloudflare-auth.xml \
            --cov-report=term-missing \
            --no-cov-on-fail \
            --cov-fail-under=0 \
            -v

      - name: Run type checker
        run: uv run basedpyright packages/cloudflare-auth/src/

      - name: Run linter
        run: uv run ruff check packages/cloudflare-auth/

      - name: Upload coverage artifact
        if: matrix.python-version == '3.12'
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: coverage-cloudflare-auth
          path: coverage-cloudflare-auth.xml

  # Test gcs-utilities package
  test-gcs-utilities:
    name: Test gcs-utilities (Python ${{ matrix.python-version }})
    needs: detect-changes
    if: needs.detect-changes.outputs.gcs-utilities == 'true' || needs.detect-changes.outputs.shared == 'true'
    runs-on: ubuntu-latest
    permissions:
      contents: read
    strategy:
      fail-fast: false
      matrix:
        python-version: ['3.10', '3.11', '3.12', '3.13']
    steps:
      - name: Harden the runner
        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
        with:
          egress-policy: audit

      - name: Checkout repository
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3

      - name: Install uv
        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
        with:
          enable-cache: true

      - name: Set up Python ${{ matrix.python-version }}
        run: uv python install ${{ matrix.python-version }}

      - name: Install workspace dependencies
        run: uv sync --all-extras

      - name: Run tests with coverage
        run: |
          uv run pytest packages/gcs-utilities/tests \
            --cov=packages/gcs-utilities/src/gcs_utilities \
            --cov-report=xml:coverage-gcs-utilities.xml \
            --cov-report=term-missing \
            --no-cov-on-fail \
            --cov-fail-under=0 \
            -v

      - name: Run type checker
        run: uv run basedpyright packages/gcs-utilities/src/

      - name: Run linter
        run: uv run ruff check packages/gcs-utilities/

      - name: Upload coverage artifact
        if: matrix.python-version == '3.12'
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: coverage-gcs-utilities
          path: coverage-gcs-utilities.xml

  # Security scan for entire workspace
  security:
    name: Security Scan
    needs: detect-changes
    if: needs.detect-changes.outputs.any-package == 'true'
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - name: Harden the runner
        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
        with:
          egress-policy: audit

      - name: Checkout repository
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3

      - name: Install uv
        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
        with:
          enable-cache: true

      - name: Set up Python
        run: uv python install 3.12

      - name: Install dependencies
        run: uv sync --all-extras

      - name: Run Bandit security scan
        run: |
          uv run bandit -r packages/cloudflare-auth/src/ packages/gcs-utilities/src/ -c pyproject.toml || true

  # Upload combined coverage to Codecov
  coverage:
    name: Upload Coverage
    needs: [test-cloudflare-auth, test-gcs-utilities]
    if: always() && (needs.test-cloudflare-auth.result == 'success' || needs.test-gcs-utilities.result == 'success')
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - name: Harden the runner
        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
        with:
          egress-policy: audit

      - name: Checkout repository
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3

      - name: Download coverage artifacts
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
        with:
          pattern: coverage-*
          merge-multiple: true

      - name: Upload to Codecov
        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7
        with:
          files: coverage-cloudflare-auth.xml,coverage-gcs-utilities.xml
          fail_ci_if_error: false
        env:
          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}

  # Terminal CI gate -- the single required check for branch protection.
  # Runs even when test jobs are skipped (no changed packages). Skipped
  # upstream jobs report result="skipped", which is not a failure.
  ci-gate:
    name: CI Gate
    runs-on: ubuntu-latest
    needs: [detect-changes, test-cloudflare-auth, test-gcs-utilities, security, coverage]
    if: always()
    permissions:
      contents: read
    steps:
      - name: Harden the runner
        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
        with:
          egress-policy: audit

      - name: Check all jobs
        env:
          NEEDS_JSON: ${{ toJSON(needs) }}
        run: |
          failed=$(echo "$NEEDS_JSON" | jq '[to_entries[] | select(.value.result == "failure")] | length')
          if [ "$failed" -gt 0 ]; then
            echo "::error::One or more CI jobs failed"
            exit 1
          fi
          echo "CI Gate passed"