name: Test

on: [push, pull_request]

concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true

env:
  PROJECT_PATH: src/secretzero
  UV_CACHE_DIR: ~/.cache/uv

permissions:
  contents: read

jobs:
  unit-tests:
    name: Unit Tests - ${{ matrix.os }} - ${{ matrix.python-version }} - ${{ github.ref_name }}
    runs-on: ${{ matrix.os }}
    strategy:
      matrix:
        os: [ubuntu-latest, macos-latest]
        python-version: ["3.13"]
    steps:
      - uses: actions/checkout@v4

      - name: Python ${{ matrix.python-version }} on ${{ matrix.os }}
        uses: actions/setup-python@v5
        with:
          python-version: ${{ matrix.python-version }}

      - name: Cache uv
        uses: actions/cache@v4
        with:
          path: ${{ env.UV_CACHE_DIR }}
          key: uv-${{ runner.os }}-${{ matrix.python-version }}-${{ hashFiles('pyproject.toml', 'uv.lock') }}
          restore-keys: |
            uv-${{ runner.os }}-${{ matrix.python-version }}-

      - name: Install dependencies
        run: |
          pip install uv
          uv sync --all-extras

      - name: Unit Tests - ${{ matrix.os }}
        run: uv run pytest --maxfail=1 --disable-warnings -v tests

  lint-checks:
    name: Lint Checks - ${{ matrix.os }} - ${{ matrix.python-version }}
    runs-on: ${{ matrix.os }}
    strategy:
      matrix:
        os: [ubuntu-latest, macos-latest]
        python-version: ["3.13"]
    steps:
      - uses: actions/checkout@v4

      - name: Python ${{ matrix.python-version }} on ${{ matrix.os }}
        uses: actions/setup-python@v5
        with:
          python-version: ${{ matrix.python-version }}

      - name: Cache uv
        uses: actions/cache@v4
        with:
          path: ${{ env.UV_CACHE_DIR }}
          key: uv-${{ runner.os }}-${{ matrix.python-version }}-${{ hashFiles('pyproject.toml', 'uv.lock') }}
          restore-keys: |
            uv-${{ runner.os }}-${{ matrix.python-version }}-

      - name: Install dependencies
        run: |
          pip install uv
          uv sync --extra dev

      - name: Lint Checks - ${{ matrix.os }}
        run: |
          uv run black --check ${{ env.PROJECT_PATH }}
          uv run ruff format --check ${{ env.PROJECT_PATH }}

  security-scans:
    name: Security Scans - ${{ matrix.os }} - ${{ matrix.python-version }}
    runs-on: ${{ matrix.os }}
    strategy:
      matrix:
        os: [ubuntu-latest, macos-latest]
        python-version: ["3.13"]
    steps:
      - uses: actions/checkout@v4

      - name: Python ${{ matrix.python-version }} on ${{ matrix.os }}
        uses: actions/setup-python@v5
        with:
          python-version: ${{ matrix.python-version }}

      - name: Cache uv
        uses: actions/cache@v4
        with:
          path: ${{ env.UV_CACHE_DIR }}
          key: uv-${{ runner.os }}-${{ matrix.python-version }}-${{ hashFiles('pyproject.toml', 'uv.lock') }}
          restore-keys: |
            uv-${{ runner.os }}-${{ matrix.python-version }}-

      - name: Install dependencies
        run: |
          pip install uv
          uv sync --extra security

      - name: Security Scans - ${{ matrix.os }}
        run: |
          uv run pip-audit
          uv run bandit -r ${{ env.PROJECT_PATH }} -ll

  build-tests:
    name: Build Tests - ${{ matrix.os }} - ${{ matrix.python-version }}
    runs-on: ${{ matrix.os }}
    strategy:
      matrix:
        os: [ubuntu-latest, macos-latest]
        python-version: ["3.13"]
    steps:
      - uses: actions/checkout@v4

      - name: Python ${{ matrix.python-version }} on ${{ matrix.os }}
        uses: actions/setup-python@v5
        with:
          python-version: ${{ matrix.python-version }}

      - name: Cache uv
        uses: actions/cache@v4
        with:
          path: ${{ env.UV_CACHE_DIR }}
          key: uv-${{ runner.os }}-${{ matrix.python-version }}-${{ hashFiles('pyproject.toml', 'uv.lock') }}
          restore-keys: |
            uv-${{ runner.os }}-${{ matrix.python-version }}-

      - name: Build Tests - ${{ matrix.os }}
        run: |
          pip install uv
          uv build
