name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

jobs:
  # ──────────────────────────────────────────────
  # Secret leak scan — first line of defense
  # 在跑任何其他东西之前先扫秘钥，省 CI 分钟
  # ──────────────────────────────────────────────
  secret-scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0  # gitleaks 需要完整历史
      - name: Run gitleaks
        uses: gitleaks/gitleaks-action@v2
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          # GITLEAKS_LICENSE only needed for org-level; OSS repo runs free
          GITLEAKS_CONFIG: .github/gitleaks.toml

  # ──────────────────────────────────────────────
  # Python tests on 3.10/3.11/3.12
  # ──────────────────────────────────────────────
  test:
    runs-on: ubuntu-latest
    needs: secret-scan
    strategy:
      fail-fast: false
      matrix:
        python-version: ["3.10", "3.11", "3.12"]
    steps:
      - uses: actions/checkout@v4
      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: ${{ matrix.python-version }}
          cache: pip
      - name: Install lambdagent (src-layout) + agentpaas[dev]
        run: |
          pip install -e lambdagent/
          # [dev] pulls in httpx — required by fastapi.testclient.TestClient
          # used by tests/test_api_endpoints.py (audit critical #6 coverage).
          pip install -e "agentpaas/[dev]"
          pip install pytest pytest-asyncio
      # AUDIT_2026-06-11 ⑨: collected 数下限 — 防止依赖缺失/收集错误让
      # 测试"静默蒸发"还绿灯（本地曾因缺 pytest-asyncio 8 个鉴权测试没在跑）。
      # 新增测试只会让数字涨，阈值取当前数的约 95% 留余量。
      - name: Run platform tests (tests/)
        run: |
          N=$(python -m pytest tests/ --collect-only -q 2>/dev/null | grep -Eo '[0-9]+ tests? collected' | grep -Eo '^[0-9]+' || echo 0)
          echo "tests/ collected: $N"
          test "$N" -ge 240 || { echo "::error::tests/ collected only $N (< 240) — did tests silently vanish?"; exit 1; }
          python -m pytest tests/ -v --tb=short
      - name: Run lambdagent core tests (lambdagent/tests/)
        run: |
          N=$(python -m pytest lambdagent/tests/ --collect-only -q 2>/dev/null | grep -Eo '[0-9]+ tests? collected' | grep -Eo '^[0-9]+' || echo 0)
          echo "lambdagent/tests/ collected: $N"
          test "$N" -ge 540 || { echo "::error::lambdagent/tests/ collected only $N (< 540) — did tests silently vanish?"; exit 1; }
          python -m pytest lambdagent/tests/ --tb=short
      - name: Lint module loads
        run: python -c "from lambdagent.fromconfig import lint_config; print('Lint module OK')"

  # ──────────────────────────────────────────────
  # Package import smoke test
  # ──────────────────────────────────────────────
  imports:
    runs-on: ubuntu-latest
    needs: secret-scan
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: "3.12"
          cache: pip
      - name: Install both packages
        run: |
          pip install -e lambdagent/
          pip install -e agentpaas/   # agentpaas needs fastapi/uvicorn/pydantic
      - name: Verify package surface
        run: |
          python -c "import lambdagent; print(f'lambdagent OK: {len(lambdagent.__all__)} exports')"
          python -c "from agentpaas.api.app import app; print(f'AgentPaaS OK: {len([r for r in app.routes if hasattr(r, \"methods\")])} routes')"

  # ──────────────────────────────────────────────
  # Web UI build (catch broken frontend before merge)
  # ──────────────────────────────────────────────
  webui:
    runs-on: ubuntu-latest
    needs: secret-scan
    defaults:
      run:
        working-directory: webui
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: "20"
          cache: npm
          cache-dependency-path: webui/package-lock.json
      - run: npm ci
      - run: npm run build