name: PR Check

on:
  pull_request:
    branches: [main, master]

env:
  GITEA_URL: https://git.example.com

jobs:
  lint:
    runs-on: ubuntu-latest
    container:
      image: gitea-job-image
    steps:
      - name: Clone repo
        run: |
          rm -rf $GITHUB_WORKSPACE/*
          git clone --depth 1 $GITEA_URL/$GITHUB_REPOSITORY $GITHUB_WORKSPACE
          git -C $GITHUB_WORKSPACE checkout $GITHUB_SHA 2>/dev/null || true

      - name: Run ruff (Python lint)
        if: always()
        run: |
          if [[ -f requirements.txt ]] || [[ -f pyproject.toml ]]; then
            pip3 install ruff 2>/dev/null || true
            ruff check . --exit-zero 2>/dev/null || echo "ruff lint skipped"
          fi

      - name: Check version.json
        run: |
          if [[ -f version.json ]]; then
            echo "Version file found:"
            cat version.json
            jq -e '.major and .minor and .patch' version.json > /dev/null || {
              echo "ERROR: version.json is missing required fields (major, minor, patch)"
              exit 1
            }
          fi

  test:
    runs-on: ubuntu-latest
    container:
      image: gitea-job-image
    steps:
      - name: Clone repo
        run: |
          rm -rf $GITHUB_WORKSPACE/*
          git clone --depth 1 $GITEA_URL/$GITHUB_REPOSITORY $GITHUB_WORKSPACE
          git -C $GITHUB_WORKSPACE checkout $GITHUB_SHA 2>/dev/null || true

      - name: Run pytest (Python)
        run: |
          if [[ -f requirements.txt ]]; then
            pip3 install -r requirements.txt 2>/dev/null || true
            pip3 install pytest 2>/dev/null || true
            pytest tests/ -v --tb=short 2>/dev/null || echo "No tests found or pytest failed"
          fi

  docker-build:
    runs-on: ubuntu-latest
    steps:
      - name: Clone repo
        run: |
          rm -rf $GITHUB_WORKSPACE/*
          git clone --depth 1 $GITEA_URL/$GITHUB_REPOSITORY $GITHUB_WORKSPACE
          git -C $GITHUB_WORKSPACE checkout $GITHUB_SHA 2>/dev/null || true

      - name: Build Docker image
        run: |
          IMG_NAME=$(echo $GITHUB_REPOSITORY | tr '[:upper:]' '[:lower:]')
          if [[ -f Dockerfile ]]; then
            docker build -t ${IMG_NAME}:pr-${GITHUB_RUN_ID} .
            echo "Docker build successful: ${IMG_NAME}:pr-${GITHUB_RUN_ID}"
          else
            echo "No Dockerfile found, skipping"
          fi

      - name: Test container startup
        run: |
          IMG_NAME=$(echo $GITHUB_REPOSITORY | tr '[:upper:]' '[:lower:]')
          if [[ -f Dockerfile ]]; then
            docker run --rm --name pr-test-$GITHUB_RUN_ID \
              ${IMG_NAME}:pr-${GITHUB_RUN_ID} \
              true || echo "Container startup test skipped"
          fi

  security:
    runs-on: ubuntu-latest
    container:
      image: gitea-job-image
    steps:
      - name: Clone repo
        run: |
          rm -rf $GITHUB_WORKSPACE/*
          git clone --depth 1 $GITEA_URL/$GITHUB_REPOSITORY $GITHUB_WORKSPACE
          git -C $GITHUB_WORKSPACE checkout $GITHUB_SHA 2>/dev/null || true

      - name: Run bandit (Python SAST)
        run: |
          if [[ -f requirements.txt ]]; then
            pip3 install bandit 2>/dev/null || true
            bandit -r . --severity-level high --confidence-level high --exclude tests/ 2>/dev/null || echo "bandit scan skipped"
          fi

  build-result:
    needs: [lint, test, docker-build, security]
    runs-on: ubuntu-latest
    container:
      image: gitea-job-image
    if: always()
    steps:
      - name: Summary
        run: echo "All PR checks completed"