codelens-ci.yml

name: CodeLens CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

permissions:
  contents: read
  security-events: write
  actions: read

jobs:
  # ─── Lint & Test ───────────────────────────────────────────────
  test:
    name: Test Suite
    runs-on: ubuntu-latest
    timeout-minutes: 30

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Set up Python 3.11
        uses: actions/setup-python@v5
        with:
          python-version: "3.11"
          cache: pip
          cache-dependency-path: |
            pyproject.toml
            requirements.txt

      - name: Install dependencies
        run: |
          python -m pip install --upgrade pip
          # tree-sitter pinned <0.26: core 0.26.0 changed Node lifetime handling
          # and causes a native use-after-free SIGSEGV in tree_sitter_python._binding
          # even on shallow files (issue #235). python_parser.py's keep_alive
          # mitigation is insufficient for 0.26; 0.25.x is known-safe.
          # pytest-timeout: names the hanging test instead of letting the job
          # burn the 6h ceiling in silence (issue #303).
          pip install "tree-sitter>=0.21.0,<0.26" pyyaml pytest pytest-cov pytest-timeout pygls lsprotocol
          # Install optional grammar packages for full parser coverage
          pip install tree-sitter-python tree-sitter-javascript tree-sitter-html tree-sitter-css || true
          pip install tree-sitter-typescript tree-sitter-rust || true

      - name: Run test suite
        run: |
          # --timeout: the whole suite runs in ~160s locally, so any single
          # test past 120s is stuck, not slow. `thread` method dumps its stack.
          cd scripts && python -m pytest ../tests/ -v --tb=short \
            --timeout=120 --timeout-method=thread \
            --ignore=../tests/test_integration.py

  # ─── Benchmark ─────────────────────────────────────────────────
  benchmark:
    name: Quick Benchmark
    runs-on: ubuntu-latest
    timeout-minutes: 30
    needs: test

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Set up Python 3.11
        uses: actions/setup-python@v5
        with:
          python-version: "3.11"
          cache: pip
          cache-dependency-path: |
            pyproject.toml
            requirements.txt

      - name: Install dependencies
        run: |
          python -m pip install --upgrade pip
          pip install "tree-sitter>=0.21.0,<0.26" pyyaml
          pip install tree-sitter-python tree-sitter-javascript tree-sitter-html tree-sitter-css || true
          pip install tree-sitter-typescript tree-sitter-rust || true

      - name: Run quick benchmarks
        run: |
          cd benchmarks && python run_benchmarks.py --quick

  # ─── Self-Analysis ─────────────────────────────────────────────
  self-check:
    name: CodeLens Self-Check
    runs-on: ubuntu-latest
    timeout-minutes: 30
    needs: test

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Set up Python 3.11
        uses: actions/setup-python@v5
        with:
          python-version: "3.11"
          cache: pip
          cache-dependency-path: |
            pyproject.toml
            requirements.txt

      - name: Install dependencies
        run: |
          python -m pip install --upgrade pip
          pip install "tree-sitter>=0.21.0,<0.26" pyyaml
          pip install tree-sitter-python tree-sitter-javascript tree-sitter-html tree-sitter-css || true
          pip install tree-sitter-typescript tree-sitter-rust || true

      - name: Run codelens self-analysis
        run: |
          cd scripts && python codelens.py audit . --check dead-code,smell --severity high --format json
        continue-on-error: true

      - name: Generate SARIF output
        run: |
          cd scripts && python codelens.py audit . --check dead-code,smell --format sarif > ../codelens-results.sarif
        continue-on-error: true

      - name: Upload SARIF as artifact
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: codelens-sarif
          path: codelens-results.sarif
          retention-days: 30

  # ─── Upload SARIF to GitHub Code Scanning (main only) ──────────
  upload-sarif:
    name: Upload SARIF to Code Scanning
    runs-on: ubuntu-latest
    timeout-minutes: 30
    needs: self-check
    if: github.event_name == 'push' && github.ref == 'refs/heads/main'

    permissions:
      security-events: write
      actions: read
      contents: read

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Download SARIF artifact
        uses: actions/download-artifact@v4
        with:
          name: codelens-sarif

      - name: Validate SARIF file exists
        run: |
          if [ ! -f codelens-results.sarif ]; then
            echo "::warning::SARIF file not found, skipping upload"
            exit 0
          fi
          # Basic validation: check it's valid JSON
          python3 -c "import json; json.load(open('codelens-results.sarif'))" || {
            echo "::warning::SARIF file is not valid JSON, skipping upload"
            exit 0
          }

      - name: Upload SARIF to GitHub code scanning
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: codelens-results.sarif
          category: codelens