# Gitea Actions workflow: lint, types, secret scan and unit tests with and without the compiled kernels.
name: ci
on:
  push:
  pull_request:

jobs:
  test:
    runs-on: ubuntu-latest
    strategy:
      matrix:
        python: ["3.12", "3.13"]
    steps:
      - uses: actions/checkout@v4
      - uses: astral-sh/setup-uv@v5
        with:
          python-version: ${{ matrix.python }}
      - name: Secret scan (no cloud keys or private keys in the repository)
        run: |
          if git grep -nIE '(AKIA|ASIA)[A-Z0-9]{16}|aws_secret_access_key *=|BEGIN [A-Z ]*PRIVATE KEY'; then
            echo "::error::credential-like content found"; exit 1
          fi
      - name: Install
        # setup-uv >= 5.x already creates and activates .venv when python-version is set; --clear works either way
        run: uv venv --clear && uv pip install -e ".[dev]"
      - name: Lint
        run: uv run ruff check src tests && uv run ruff format --check src tests
      - name: Type check
        run: uv run mypy
      - name: Unit tests (no downloaded data needed)
        run: uv run pytest tests/unit -q
      - name: Build the compiled kernels (rust/simurg-core)
        run: |
          command -v cc >/dev/null || { apt-get update -qq && apt-get install -y -qq gcc >/dev/null; }  # Rust needs a C linker
          curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --profile minimal
          PATH="$HOME/.cargo/bin:$PATH" uv pip install ./rust/simurg-core
      - name: Unit tests with the compiled kernels (must equal the pure-Python results)
        run: uv run pytest tests/unit -q