name: CI - Security, Lint & Tests

on:
  push:
  pull_request:
  workflow_dispatch:

# This workflow validates branches only. It has no deployment step and no
# write permission, so an audit-branch push cannot alter main or production.
permissions:
  contents: read

jobs:
  validate:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262  # v4

      - name: Set up Python
        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065  # v5
        with:
          python-version: '3.12'
          cache: pip

      - name: Install dependencies
        run: pip install -r requirements.txt -r requirements-dev.txt

      - name: Audit declared dependencies
        run: pip-audit -r requirements.txt

      - name: Lint and check formatting
        run: |
          ruff check .
          ruff format --check .

      - name: Run tests with coverage gate
        run: pytest --cov=app --cov-report=term-missing --cov-report=xml

      - name: Run repository security checks
        env:
          SECRET_KEY: audit-ci-key-not-for-production-1234567890
          DATABASE_URL: 'sqlite:///:memory:'
          FLASK_DEBUG: 'false'
        run: python app/supporting_scripts/security_scan.py --skip-http