name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
  workflow_call:  # allow release.yml to invoke this workflow

jobs:
  lint-and-test:
    runs-on: ubuntu-latest

    strategy:
      matrix:
        python-version: ["3.12"]

    steps:
      - uses: actions/checkout@v4

      - name: Set up Python ${{ matrix.python-version }}
        uses: actions/setup-python@v5
        with:
          python-version: ${{ matrix.python-version }}

      - name: Install dependencies
        run: |
          python -m pip install --upgrade pip
          pip install -e ".[dev]"

      - name: Lint with ruff
        run: ruff check .

      - name: Type check with mypy
        # Informational for now — 9 pre-existing errors from third-party
        # SDK type mismatches (anthropic, presidio, faster-whisper).
        # Runs so regressions show in the log; does not block the build.
        continue-on-error: true
        run: mypy bristlenose/ --ignore-missing-imports

      - name: Audit dependencies for known vulnerabilities
        # Informational — flags known CVEs in the log but doesn't block
        # the build. Transitive deps (torch, protobuf) often have unfixed
        # advisories that we can't act on. Review on each run.
        continue-on-error: true
        run: |
          pip install pip-audit
          pip-audit

      - name: Check man page version matches __version__
        run: |
          VERSION=$(python3 -c "import bristlenose; print(bristlenose.__version__)")
          grep -q "bristlenose $VERSION" man/bristlenose.1 || {
            echo "::error::Man page version doesn't match __version__ ($VERSION)"
            echo "Update the .TH line in man/bristlenose.1"
            exit 1
          }

      - name: Run tests
        run: pytest --tb=short -q
