ci.yml

name: ci

on:
  push:
  pull_request:

jobs:
  backend:
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-python@v5
        with:
          python-version: '3.11'

      - name: Install backend dependencies
        run: |
          python -m pip install --upgrade pip
          pip install -e .[dev]

      - name: Compile backend sources
        run: python -m compileall src tests

      - name: Run backend contract lane
        run: |
          PYTEST_DISABLE_PLUGIN_AUTOLOAD=1 pytest \
            tests/test_web_utils.py \
            tests/test_web_api.py \
            tests/test_pipeline_status_api.py \
            tests/test_training_ui_routes.py \
            tests/test_web_api_presets.py \
            tests/test_web_app_lifecycle.py \
            tests/test_websocket_contract.py \
            tests/test_api_docs_contract.py -q

  frontend:
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-node@v4
        with:
          node-version: '20'
          cache: 'npm'
          cache-dependency-path: frontend/package-lock.json

      - name: Install frontend dependencies
        working-directory: frontend
        run: npm ci

      - name: Lint frontend
        working-directory: frontend
        run: npm run lint

      - name: Typecheck frontend
        working-directory: frontend
        run: npm run typecheck

      - name: Build frontend
        working-directory: frontend
        run: npm run build

  coverage:
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-python@v5
        with:
          python-version: '3.11'

      - name: Install backend dependencies
        run: |
          python -m pip install --upgrade pip
          pip install -e .[dev]

      - name: Run critical-module coverage gate
        run: python scripts/run_remaining_module_coverage.py

      - name: Validate experimental evidence registry
        run: python scripts/validate_experimental_evidence.py

      - name: Upload coverage artifacts
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: coverage-artifacts
          path: |
            coverage.remaining.json
            .coverage
            reports/experimental_evidence/validation.json
          if-no-files-found: ignore

  benchmark-evidence:
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-python@v5
        with:
          python-version: '3.11'

      - name: Install backend dependencies
        run: |
          python -m pip install --upgrade pip
          pip install -e .[dev]

      - name: Generate canonical benchmark dashboard fixture
        run: |
          mkdir -p reports/benchmarks/ci-bundles
          python - <<'PY'
          import json
          from pathlib import Path
          root = Path("reports/benchmarks/ci-bundles")
          bundles = {
              "quality_seedvc": {
                  "title": "quality_seedvc",
                  "fixture_tier": "smoke",
                  "fixture_suite": "ci-smoke",
                  "summary": {
                      "sample_count": 1,
                      "speaker_similarity_mean": 0.91,
                      "pitch_corr_mean": 0.93,
                      "mcd_mean": 4.1,
                      "latency_ms_mean": 120.0,
                  },
              },
              "realtime": {
                  "title": "realtime",
                  "fixture_tier": "smoke",
                  "fixture_suite": "ci-smoke",
                  "summary": {
                      "sample_count": 1,
                      "speaker_similarity_mean": 0.87,
                      "pitch_corr_mean": 0.91,
                      "mcd_mean": 4.5,
                      "latency_ms_mean": 42.0,
                  },
              },
              "hq_svc": {
                  "title": "hq_svc",
                  "fixture_tier": "smoke",
                  "fixture_suite": "ci-smoke",
                  "summary": {
                      "sample_count": 1,
                      "speaker_similarity_mean": 0.95,
                      "pitch_corr_mean": 0.96,
                      "mcd_mean": 3.8,
                      "latency_ms_mean": 41.0,
                  },
              },
          }
          for name, payload in bundles.items():
              (root / f"{name}.json").write_text(json.dumps(payload), encoding="utf-8")
          PY

      - name: Build benchmark dashboard artifacts
        run: |
          python scripts/build_benchmark_dashboard.py \
            --bundle quality_seedvc=reports/benchmarks/ci-bundles/quality_seedvc.json \
            --bundle realtime=reports/benchmarks/ci-bundles/realtime.json \
            --bundle hq_svc=reports/benchmarks/ci-bundles/hq_svc.json \
            --output-dir reports/benchmarks/latest

      - name: Validate benchmark dashboard artifacts
        run: python scripts/validate_benchmark_dashboard.py --current-git-sha

      - name: Validate experimental evidence registry
        run: python scripts/validate_experimental_evidence.py

      - name: Upload benchmark evidence artifacts
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: benchmark-evidence-artifacts
          path: |
            reports/benchmarks/latest
            reports/experimental_evidence/validation.json
          if-no-files-found: ignore

  security-sbom:
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-python@v5
        with:
          python-version: '3.11'

      - uses: actions/setup-node@v4
        with:
          node-version: '20'
          cache: 'npm'
          cache-dependency-path: frontend/package-lock.json

      - name: Install backend dependencies and security tooling
        run: |
          python -m pip install --upgrade pip
          pip install -e .[dev]
          pip install pip-audit cyclonedx-bom

      - name: Install frontend dependencies
        working-directory: frontend
        run: npm ci

      - name: Generate Python SBOM and audit report
        run: |
          mkdir -p reports/platform
          cyclonedx-py environment --of JSON -o reports/platform/python-sbom.json
          pip-audit --format json --output reports/platform/pip-audit.json || true
          if [ ! -s reports/platform/pip-audit.json ]; then \
            echo '{}' > reports/platform/pip-audit.json ; \
          fi

      - name: Generate frontend SBOM
        working-directory: frontend
        run: npm sbom --omit=dev --sbom-format cyclonedx > ../reports/platform/frontend-sbom.json

      - name: Run frontend supply-chain vulnerability policy gate
        working-directory: frontend
        run: |
          npm audit --omit=dev --audit-level high --json > ../reports/platform/npm-audit.json || true
          if [ ! -s ../reports/platform/npm-audit.json ]; then \
            echo '{"metadata":{"vulnerabilities":{"high":0}}}' > ../reports/platform/npm-audit.json ; \
          fi

      - name: Enforce supply-chain policy in dependency contract
        run: |
          python scripts/check_dependency_contract.py \
            --pip-audit-report reports/platform/pip-audit.json \
            --npm-audit-report reports/platform/npm-audit.json

      - name: Upload security and SBOM artifacts
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: security-sbom-artifacts
          path: reports/platform
          if-no-files-found: ignore

  deployment-smoke:
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-python@v5
        with:
          python-version: '3.11'

      - name: Install backend dependencies
        run: |
          python -m pip install --upgrade pip
          pip install -e .[dev]

      - name: Prepare compose environment
        run: |
          : > .env
          echo "AUTOVOICE_DB_PASS=ci-dry-run-password" >> .env
          echo "SECRET_KEY=ci-compose-smoke-secret" >> .env
          echo "GRAFANA_PASSWORD=ci-compose-grafana-password" >> .env

      - name: Validate docker compose config
        run: docker compose -f docker-compose.yaml config -q

      - name: Run deployment script validation lane
        run: AUTOVOICE_DB_PASS=ci-dry-run-password PYTEST_DISABLE_PLUGIN_AUTOLOAD=1 pytest tests/test_platform_scripts.py -q

      - name: Start deterministic backend harness
        run: |
          python tests/live_backend_server.py --port 5050 > /tmp/autovoice-live-backend.log 2>&1 &
          echo $! > /tmp/autovoice-live-backend.pid
          sleep 5

      - name: Run backend harness smoke validation
        run: |
          python scripts/validate_release_candidate.py \
            --base-url http://127.0.0.1:5050 \
            --report-dir reports/platform \
            --report-name backend-harness-smoke.json \
            --skip-compose \
            --skip-evidence

      - name: Stop deterministic backend harness
        if: always()
        run: |
          if [ -f /tmp/autovoice-live-backend.pid ]; then
            kill "$(cat /tmp/autovoice-live-backend.pid)" || true
          fi

      - name: Upload backend harness smoke artifacts
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: backend-harness-smoke-artifacts
          path: |
            reports/platform/backend-harness-smoke.json
            /tmp/autovoice-live-backend.log
          if-no-files-found: ignore

  browser-live:
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-python@v5
        with:
          python-version: '3.11'

      - uses: actions/setup-node@v4
        with:
          node-version: '20'
          cache: 'npm'
          cache-dependency-path: frontend/package-lock.json

      - name: Install backend dependencies
        run: |
          python -m pip install --upgrade pip
          pip install -e .[dev]

      - name: Install frontend dependencies
        working-directory: frontend
        run: npm ci

      - name: Install Playwright browser
        working-directory: frontend
        run: npx playwright install --with-deps chromium

      - name: Run live browser acceptance lane
        working-directory: frontend
        run: npm run test:e2e:live -- --reporter=line

      - name: Upload Playwright live artifacts
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: playwright-live-artifacts
          path: |
            frontend/playwright-report-live
            frontend/test-results
          if-no-files-found: ignore