name: CI/CD

on:
  push:
    branches: [main]
    tags: ["v*"]
  pull_request:
    branches: [main]

jobs:
  ci:
    runs-on: ubuntu-latest
    strategy:
      matrix:
        python-version: ["3.10", "3.11", "3.12", "3.13"]

    steps:
      - uses: actions/checkout@v4

      - name: Install uv
        uses: astral-sh/setup-uv@v4
        with:
          enable-cache: true

      - name: Set up Python ${{ matrix.python-version }}
        run: uv python install ${{ matrix.python-version }}

      - name: Verify Python version
        run: uv run --python ${{ matrix.python-version }} python -c "import sys; print(sys.version)"

      - name: Install dependencies
        run: uv sync --group dev --python ${{ matrix.python-version }}

      - name: Lint
        run: uv run --python ${{ matrix.python-version }} ruff check src tests

      - name: Format check
        run: uv run --python ${{ matrix.python-version }} ruff format --check src tests

      - name: Type check
        run: uv run --python ${{ matrix.python-version }} pyright

      - name: Run tests
        run: uv run --python ${{ matrix.python-version }} pytest

  quality:
    needs: ci
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Install uv
        uses: astral-sh/setup-uv@v4
        with:
          enable-cache: true

      - name: Set up Python 3.13
        run: uv python install 3.13

      - name: Install dependencies
        run: uv sync --group dev --python 3.13

      - name: Coverage gate
        run: uv run --python 3.13 pytest --cov=src/llmdebug --cov-report=term-missing --cov-report=xml --cov-fail-under=75

      - name: Diff coverage gate (PR only)
        if: github.event_name == 'pull_request'
        run: |
          git fetch origin main --depth=1
          uv run --python 3.13 diff-cover coverage.xml --compare-branch=origin/main --fail-under=80

      - name: Dependency hygiene
        run: uv run --python 3.13 deptry src/llmdebug

      - name: Dependency vulnerability scan
        run: uv run --python 3.13 pip-audit

      - name: Docs drift check
        run: uv run --python 3.13 python -m evals.doc_sync --check

      - name: SLURM deployment checks
        run: |
          bash -n slurm/eval_gguf_eval.sh
          bash -n slurm/check_env_gguf_eval.sh
          bash -n slurm/run_gguf_smoke.sh
          bash -n slurm/submit_gguf_sweep.sh
          bash -n slurm/submit_gguf_resume_chain.sh
          bash -n slurm/collect_gguf_debug_bundle.sh
          bash -n slurm/eval_glm47flash.sh
          bash -n slurm/check_env_glm47flash.sh
          bash -n slurm/run_glm47flash_smoke.sh
          bash -n slurm/submit_glm47flash_sweep.sh
          bash -n slurm/submit_glm47flash_resume_chain.sh
          bash -n slurm/collect_glm47flash_debug.sh
          test -f docs/haicore_enroot_eval_runbook.md
          test -f slurm/README.md

      - name: Dead code check
        run: uv run --python 3.13 vulture src/llmdebug vulture_whitelist.py --min-confidence 90

      - name: Complexity report
        run: uv run --python 3.13 radon cc -s -a src/llmdebug

      - name: Complexity gate
        run: uv run --python 3.13 xenon --max-absolute C --max-modules C --max-average B src/llmdebug

      - name: Security scan
        run: uv run --python 3.13 bandit -c pyproject.toml -r src/llmdebug
