# This workflow will install Python dependencies, run tests and lint with a variety of Python versions
# For more information see: https://docs.github.com/en/actions/automating-builds-and-tests/building-and-testing-python

name: Python package

on:
  push:
    branches: ["main", "dev"]
  pull_request:
    branches: ["main", "dev"]

jobs:
  # Step 1: Code formatting and pre-commit validation (fast failure)
  code-format:
    name: Code formatting and pre-commit validation
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v5

      - name: Set up Python
        uses: actions/setup-python@v6
        with:
          python-version: "3.10" # Use minimum version for consistency

      - name: Install dependencies
        run: |
          python -m pip install --upgrade pip
          pip install -e .[dev]

      - name: Run pre-commit hooks
        uses: pre-commit/action@v3.0.1
        with:
          extra_args: --all-files

  # Step 2: Basic build and test with minimum Python version (3.10)
  basic-build:
    name: Basic build (Python 3.10, Ubuntu)
    runs-on: ubuntu-latest
    needs: [code-format] # Only run after code formatting passes

    steps:
      - uses: actions/checkout@v5

      - name: Set up Python 3.10
        uses: actions/setup-python@v6
        with:
          python-version: "3.10"

      - name: Cache pip dependencies
        uses: actions/cache@v4
        with:
          path: ~/.cache/pip
          key: ubuntu-pip-3.10-${{ hashFiles('**/pyproject.toml') }}
          restore-keys: |
            ubuntu-pip-3.10-

      - name: Install dependencies
        run: |
          python -m pip install --upgrade pip
          python -m pip install pytest
          pip install -e .[dev]

      - name: Test with pytest
        run: |
          pytest -v

  # Step 3: Security scan
  security:
    name: Security scan
    runs-on: ubuntu-latest
    needs: [basic-build] # Run in parallel with other tests after basic build

    steps:
      - uses: actions/checkout@v5

      - name: Set up Python
        uses: actions/setup-python@v6
        with:
          python-version: "3.10"

      - name: Run Safety CLI to check for vulnerabilities
        uses: pyupio/safety-action@v1
        with:
          api-key: ${{ secrets.SAFETY_CHECK }}
          output-format: json
          args: --detailed-output --output-format json
        continue-on-error: true

      - name: Upload security reports
        uses: actions/upload-artifact@v4
        with:
          name: security-reports
          path: |
            safety-report.json
        if: always()

  # Step 4: Package build check
  package-build:
    name: Package build check
    runs-on: ubuntu-latest
    needs: [basic-build] # Run in parallel with other checks

    steps:
      - uses: actions/checkout@v5

      - name: Set up Python
        uses: actions/setup-python@v6
        with:
          python-version: "3.10" # Use minimum version for consistency

      - name: Install build dependencies
        run: |
          python -m pip install --upgrade pip
          pip install build twine

      - name: Build package
        run: python -m build

      - name: Check package
        run: twine check dist/*

      - name: Upload build artifacts
        uses: actions/upload-artifact@v4
        with:
          name: dist
          path: dist/

  # Step 5: Full matrix build (only after all basic checks pass)
  full-matrix-build:
    name: Test Python ${{ matrix.python-version }} on ${{ matrix.os }}
    runs-on: ${{ matrix.os }}
    needs: [security, package-build] # Wait for all prerequisite checks
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, windows-latest, macos-latest]
        python-version: ["3.10", "3.11", "3.12", "3.13"]
        exclude:
          # Skip the combination we already tested in basic-build
          - os: ubuntu-latest
            python-version: "3.10"

    steps:
      - uses: actions/checkout@v5

      - name: Set up Python ${{ matrix.python-version }}
        uses: actions/setup-python@v6
        with:
          python-version: ${{ matrix.python-version }}

      - name: Cache pip dependencies
        uses: actions/cache@v4
        with:
          path: ~/.cache/pip
          key: ${{ runner.os }}-pip-${{ matrix.python-version }}-${{ hashFiles('**/pyproject.toml') }}
          restore-keys: |
            ${{ runner.os }}-pip-${{ matrix.python-version }}-
            ${{ runner.os }}-pip-

      - name: Install dependencies
        run: |
          python -m pip install --upgrade pip
          python -m pip install flake8 pytest
          pip install -e .[dev]

      - name: Lint with flake8
        run: |
          # stop the build if there are Python syntax errors or undefined names
          flake8 . --count --select=E9,F63,F7,F82 --show-source --statistics
          # exit-zero treats all errors as warnings
          flake8 . --count --exit-zero --max-line-length=200 --extend-ignore=E203,W503,F401,E402,E721,F841 --statistics

      - name: Type checking with mypy
        run: |
          mypy elevator_saga --disable-error-code=unused-ignore
        continue-on-error: true

      - name: Test with pytest
        run: |
          pytest