ci.yml

name: CI

on:
  push:
    branches: [ main, develop ]
  pull_request:
    branches: [ main, develop ]

permissions:
  contents: read
  pull-requests: read
  checks: write

env:
  CARGO_TERM_COLOR: always
  RUST_BACKTRACE: 1
  REDIS_DISABLE_HIREDIS: true
  DEFAULT_PYTHON_VERSION: "3.12"

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  # Fast version consistency check
  version-check:
    name: Version Sync
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
    - uses: actions/checkout@v4

    - name: Check Python ↔ Rust version consistency
      run: |
        PYTHON_VERSION=$(grep -E "^version = " pyproject.toml | head -1 | cut -d'"' -f2)
        RUST_VERSION=$(grep -E "^version = " rust/Cargo.toml | head -1 | cut -d'"' -f2)

        echo "Python: $PYTHON_VERSION"
        echo "Rust: $RUST_VERSION"

        if [ "$PYTHON_VERSION" != "$RUST_VERSION" ]; then
          echo "❌ Version mismatch!"
          exit 1
        fi
        echo "✅ Versions in sync: $PYTHON_VERSION"

  # Fast format & lint checks (parallel)
  quick-check:
    name: Format & Lint
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
    - uses: actions/checkout@v4

    - name: Install uv
      uses: astral-sh/setup-uv@v3
      with:
        enable-cache: true

    - name: Set up Python
      run: uv python install ${{ env.DEFAULT_PYTHON_VERSION }}

    - name: Set up Rust
      uses: dtolnay/rust-toolchain@stable
      with:
        components: rustfmt, clippy

    - name: Cache Rust dependencies
      uses: Swatinem/rust-cache@v2
      with:
        workspaces: rust

    - name: Cache Python virtual environment
      uses: actions/cache@v4
      with:
        path: .venv
        key: venv-${{ runner.os }}-py${{ env.DEFAULT_PYTHON_VERSION }}-${{ hashFiles('**/pyproject.toml', '**/uv.lock', 'rust/**/*.rs', 'rust/**/Cargo.toml') }}
        restore-keys: |
          venv-${{ runner.os }}-py${{ env.DEFAULT_PYTHON_VERSION }}-

    - name: Install dependencies (if not cached)
      run: |
        uv sync --group dev

    - name: Check Python formatting
      run: |
        uv run ruff format --check .

    - name: Lint Python
      if: success() || failure()
      run: |
        uv run ruff check .

    - name: Scan Python dependencies for CVEs
      if: success() || failure()
      run: |
        uv run pip-audit --desc

    - name: Type check Python
      if: success() || failure()
      run: |
        uv run basedpyright --level error

    - name: Check Rust formatting
      if: success() || failure()
      run: |
        cd rust && cargo fmt --check

    - name: Lint Rust
      if: success() || failure()
      run: |
        cd rust && cargo clippy -- -D warnings

  # Critical test suite (parallel matrix)
  test-critical:
    name: Tests (Python ${{ matrix.python-version }})
    runs-on: ubuntu-latest
    timeout-minutes: 15
    strategy:
      fail-fast: false
      matrix:
        python-version: ["3.9", "3.10", "3.11", "3.12", "3.13", "3.14"]

    services:
      redis:
        image: redis:7-alpine
        ports:
          - 6379:6379
        options: >-
          --health-cmd "redis-cli ping"
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5

    steps:
    - uses: actions/checkout@v4

    - name: Install uv
      uses: astral-sh/setup-uv@v3
      with:
        enable-cache: true

    - name: Set up Python
      run: uv python install ${{ matrix.python-version }}

    - name: Set up Rust
      uses: dtolnay/rust-toolchain@stable

    - name: Cache Rust dependencies
      uses: Swatinem/rust-cache@v2
      with:
        workspaces: rust

    - name: Cache Python virtual environment
      uses: actions/cache@v4
      with:
        path: .venv
        key: venv-${{ runner.os }}-py${{ matrix.python-version }}-${{ hashFiles('**/pyproject.toml', '**/uv.lock', 'rust/**/*.rs', 'rust/**/Cargo.toml') }}
        restore-keys: |
          venv-${{ runner.os }}-py${{ matrix.python-version }}-

    - name: Install dependencies (if not cached)
      run: |
        uv sync --group dev

    - name: Run critical tests
      env:
        REDIS_URL: redis://localhost:6379
      run: |
        make test-critical

  # Markdown documentation tests
  test-docs:
    name: Documentation Examples
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
    - uses: actions/checkout@v4

    - name: Install uv
      uses: astral-sh/setup-uv@v3
      with:
        enable-cache: true

    - name: Set up Python
      run: uv python install ${{ env.DEFAULT_PYTHON_VERSION }}

    - name: Set up Rust
      uses: dtolnay/rust-toolchain@stable

    - name: Cache Rust dependencies
      uses: Swatinem/rust-cache@v2
      with:
        workspaces: rust

    - name: Cache Python virtual environment
      uses: actions/cache@v4
      with:
        path: .venv
        key: venv-${{ runner.os }}-py${{ env.DEFAULT_PYTHON_VERSION }}-${{ hashFiles('**/pyproject.toml', '**/uv.lock', 'rust/**/*.rs', 'rust/**/Cargo.toml') }}
        restore-keys: |
          venv-${{ runner.os }}-py${{ env.DEFAULT_PYTHON_VERSION }}-

    - name: Install dependencies (if not cached)
      run: |
        uv sync --group dev

    - name: Run markdown documentation tests
      run: |
        make test-docs-examples

  # Summary job (required for branch protection)
  ci-success:
    name: CI Success
    runs-on: ubuntu-latest
    needs: [version-check, quick-check, test-critical, test-docs]
    if: always()
    steps:
    - name: Check all jobs succeeded
      run: |
        if [[ "${{ needs.version-check.result }}" != "success" ]] || \
           [[ "${{ needs.quick-check.result }}" != "success" ]] || \
           [[ "${{ needs.test-critical.result }}" != "success" ]] || \
           [[ "${{ needs.test-docs.result }}" != "success" ]]; then
          echo "❌ One or more jobs failed"
          exit 1
        fi
        echo "✅ All CI checks passed"