name: CI

on:
  push:
    branches: [main, master]
  pull_request:
    branches: [main, master]

jobs:
  lint:
    runs-on: ubuntu-latest
    container:
      image: gitea-job-image
    steps:
      - name: Clone repo
        run: |
          rm -rf $GITHUB_WORKSPACE/*
          git clone --depth 1 https://git.example.com/jarianc/youtube-cli $GITHUB_WORKSPACE
          git -C $GITHUB_WORKSPACE checkout $GITHUB_SHA 2>/dev/null || true

      - name: Install dependencies
        run: |
          python3 -m pip install --upgrade pip
          pip3 install ruff mypy
          pip3 install -e ".[dev]"
          pip3 install textual

      - name: Run ruff
        run: ruff check .

      - name: Run mypy
        run: mypy youtube_tui/ --config-file youtube_tui/pyproject.toml

  test:
    runs-on: ubuntu-latest
    container:
      image: gitea-job-image
    steps:
      - name: Clone repo
        run: |
          rm -rf $GITHUB_WORKSPACE/*
          git clone --depth 1 https://git.example.com/jarianc/youtube-cli $GITHUB_WORKSPACE
          git -C $GITHUB_WORKSPACE checkout $GITHUB_SHA 2>/dev/null || true

      - name: Install dependencies
        run: |
          python3 -m pip install --upgrade pip
          pip3 install -e ".[dev]"
          pip3 install -r requirements-api.txt
          pip3 install textual

      - name: Run pytest
        run: python3 -m pytest tests/ web/server/tests/ -v --tb=short

  docker-build:
    runs-on: ubuntu-latest
    steps:
      - name: Clone repo
        run: |
          rm -rf $GITHUB_WORKSPACE/*
          git clone --depth 1 https://git.example.com/jarianc/youtube-cli $GITHUB_WORKSPACE
          git -C $GITHUB_WORKSPACE checkout $GITHUB_SHA 2>/dev/null || true

      - name: Build Docker image
        run: |
          docker build -t youtube-cli:test --no-cache .

  security:
    runs-on: ubuntu-latest
    container:
      image: gitea-job-image
    steps:
      - name: Clone repo
        run: |
          rm -rf $GITHUB_WORKSPACE/*
          git clone --depth 1 https://git.example.com/jarianc/youtube-cli $GITHUB_WORKSPACE
          git -C $GITHUB_WORKSPACE checkout $GITHUB_SHA 2>/dev/null || true

      - name: Run bandit (Python SAST)
        run: |
          pip3 install bandit
          bandit -r youtube_cli/ youtube_tui/ web/server/ --severity-level high --confidence-level high

  build-result:
    needs: [lint, test, docker-build, security]
    runs-on: ubuntu-latest
    container:
      image: gitea-job-image
    if: always()
    steps:
      - name: Summary
        run: echo "All CI checks passed successfully"