# Genesis CI Pipeline — Module 3
# Runs on every push to master and on all pull requests.
# Uses a self-hosted WSL2 runner so paths resolve to /mnt/e/genesis-system.
#
# VERIFICATION_STAMP
# Story: M3.01 — .github/workflows/ci.yml
# Verified By: parallel-builder
# Verified At: 2026-02-25
# Tests: see tests/infra/test_ci_config.py

name: Genesis CI

on:
  push:
    branches:
      - master
  pull_request:

env:
  PYTHONPATH: /mnt/e/genesis-system

jobs:

  # ── 1. Lint ─────────────────────────────────────────────────────────────────
  lint:
    name: Lint (ruff)
    runs-on: self-hosted
    steps:
      - uses: actions/checkout@v4

      - name: Set up Python 3.11
        uses: actions/setup-python@v5
        with:
          python-version: "3.11"
          cache: pip

      - name: Install ruff
        run: pip install ruff

      - name: ruff check
        run: ruff check --config pyproject.toml .

      - name: ruff format check
        run: ruff format --check --config pyproject.toml .

  # ── 2. Type-check ────────────────────────────────────────────────────────────
  type-check:
    name: Type-check (mypy)
    runs-on: self-hosted
    steps:
      - uses: actions/checkout@v4

      - name: Set up Python 3.11
        uses: actions/setup-python@v5
        with:
          python-version: "3.11"
          cache: pip

      - name: Install mypy + stubs
        run: pip install mypy types-requests types-PyYAML

      - name: mypy — core/
        run: mypy core/

  # ── 3. Test ──────────────────────────────────────────────────────────────────
  test:
    name: Test (pytest)
    runs-on: self-hosted
    steps:
      - uses: actions/checkout@v4

      - name: Set up Python 3.11
        uses: actions/setup-python@v5
        with:
          python-version: "3.11"
          cache: pip

      - name: Install dependencies
        run: pip install -r requirements.txt || true

      - name: Install test dependencies
        run: pip install pytest pytest-asyncio pytest-timeout pyyaml

      - name: Run infra tests
        env:
          PYTHONPATH: /mnt/e/genesis-system
        run: pytest -x --tb=short tests/infra/

  # ── 4. Security scan ─────────────────────────────────────────────────────────
  security:
    name: Security scan
    runs-on: self-hosted
    steps:
      - uses: actions/checkout@v4

      - name: Check secrets.env is not committed
        run: |
          if git ls-files --error-unmatch config/secrets.env 2>/dev/null; then
            echo "ERROR: config/secrets.env is tracked by git — remove it!"
            exit 1
          fi
          echo "OK: secrets.env is not committed."

      - name: Check no sqlite3 imports in codebase
        run: |
          if grep -r "import sqlite3" --include="*.py" .; then
            echo "ERROR: sqlite3 import detected — use Elestio PostgreSQL."
            exit 1
          fi
          echo "OK: no sqlite3 imports found."
