ci.yaml

name: CI

on:
  workflow_dispatch:
  push:
    branches: [main]
  pull_request:
    branches: [main]

jobs:
  version-consistency:
    name: Version consistency
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: "3.12"
      - name: Verify package/changelog version consistency
        run: python scripts/verify_version_consistency.py --check-unreleased-link

  readiness-checklist:
    name: Production checklist (validate)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: "3.12"
      - name: Install checker dependency
        run: pip install pyyaml
      - name: Validate production readiness checklist shape
        run: python scripts/production_readiness_gate.py --mode validate

  openapi-compat:
    name: API compatibility (OpenAPI)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: "3.12"
      - name: Install dependencies
        run: pip install -e ".[dev]"
      - name: Check OpenAPI compatibility
        run: python scripts/check_openapi_compat.py --baseline schemas/openapi_baseline.json
      - name: Verify generated API reference is up to date
        run: python scripts/generate_api_reference.py --check

  security-dependency-audit:
    name: Security dependency audit
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: "3.12"
      - name: Install dependencies
        run: pip install -e ".[dev]"
      - name: Install pip-audit
        run: pip install pip-audit
      - name: Run dependency audit
        run: pip-audit

  security-secret-scan:
    name: Security secret scan
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Run gitleaks
        uses: gitleaks/gitleaks-action@v2
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  security-sast:
    name: Security SAST (bandit)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: "3.12"
      - name: Install bandit
        run: pip install bandit
      - name: Run bandit
        run: bandit -r python/hpcopt/ -ll -ii

  lint:
    name: Lint (ruff)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: "3.12"
      - name: Install ruff
        run: pip install ruff
      - name: Run ruff check
        run: ruff check python/

  typecheck:
    name: Type-check (mypy)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: "3.12"
      - name: Install dependencies
        run: pip install -e ".[dev]"
      - name: Run mypy
        run: mypy python/hpcopt/

  typecheck-critical:
    name: Type-check critical packages
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: "3.12"
      - name: Install dependencies
        run: pip install -e ".[dev]"
      - name: Run mypy on critical paths
        run: mypy python/hpcopt/api python/hpcopt/models python/hpcopt/simulate

  test:
    name: Tests (Python ${{ matrix.python-version }})
    runs-on: ubuntu-latest
    strategy:
      matrix:
        python-version: ["3.11", "3.12"]
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: ${{ matrix.python-version }}
      - name: Install dependencies
        # gymnasium (small, pure-Python) lets the RL env tests run without
        # pulling the full [rl] extra (torch/sb3 are ~2.5 GB and GPU-oriented).
        run: pip install -e ".[dev]" "gymnasium>=0.29.0,<2.0"
      - name: Run tests with coverage
        run: pytest tests/ -v --cov=hpcopt --cov-report=term-missing --cov-report=xml:coverage.xml --cov-fail-under=86
      - name: Build quality evidence bundle
        if: matrix.python-version == '3.12'
        run: |
          mkdir -p outputs/quality-evidence
          python scripts/check_coverage_thresholds.py \
            --coverage-xml coverage.xml \
            --global-fail-under 86 \
            --package-threshold api=88 \
            --package-threshold models=89 \
            --package-threshold simulate=86 \
            | tee outputs/quality-evidence/coverage-gates.txt
          python scripts/check_docs_consistency.py | tee outputs/quality-evidence/docs-consistency.txt
          python scripts/check_openapi_compat.py --baseline schemas/openapi_baseline.json | tee outputs/quality-evidence/openapi-compat.txt
          python scripts/production_readiness_gate.py --mode validate | tee outputs/quality-evidence/readiness-validate.txt
      - name: Upload coverage artifact
        if: matrix.python-version == '3.12'
        uses: actions/upload-artifact@v4
        with:
          name: coverage-report
          path: coverage.xml
      - name: Upload quality evidence artifact
        if: matrix.python-version == '3.12'
        uses: actions/upload-artifact@v4
        with:
          name: quality-evidence
          path: outputs/quality-evidence/
      - name: Upload coverage to Codecov
        if: matrix.python-version == '3.12'
        uses: codecov/codecov-action@v4
        with:
          files: coverage.xml
          fail_ci_if_error: false
          token: ${{ secrets.CODECOV_TOKEN }}

  rust-check:
    name: Rust check + clippy + test + build
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: rust
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
        with:
          components: clippy
      - name: Cargo check
        run: cargo check --workspace
      - name: Clippy (deny warnings)
        run: cargo clippy --workspace -- -D warnings
      - name: Run tests
        run: cargo test --workspace
      - name: Build release
        run: cargo build --release

  cross-language-test:
    name: Cross-language adapter parity
    runs-on: ubuntu-latest
    needs: [rust-check, test]
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
      - uses: actions/setup-python@v5
        with:
          python-version: "3.12"
      - name: Install Python dependencies
        run: pip install -e ".[dev]"
      - name: Build Rust binaries
        run: cargo build --release
        working-directory: rust
      - name: Run cross-language parity test
        run: pytest tests/unit/test_cross_language_adapter_parity.py -v

  load-test:
    name: Load tests (main only)
    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
    runs-on: ubuntu-latest
    needs: [test]
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: "3.12"
      - name: Install dependencies
        run: pip install -e ".[dev]"
      - name: Run load tests
        run: pytest tests/load/ -v -m load

  e2e-smoke:
    name: E2E smoke test
    runs-on: ubuntu-latest
    needs: [test]
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: "3.12"
      - name: Install dependencies
        run: pip install -e ".[dev]"
      - name: Run E2E pipeline smoke test
        run: pytest tests/integration/test_e2e_pipeline.py -v -m integration

  docker-build:
    name: Docker build (no push)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
      - name: Build Docker image
        uses: docker/build-push-action@v6
        with:
          context: .
          push: false
          load: true
          tags: hpc-workload-optimizer:ci-${{ github.sha }}
          cache-from: type=gha
          cache-to: type=gha,mode=max

  docker-smoke:
    name: Docker container smoke test
    runs-on: ubuntu-latest
    needs: [docker-build]
    steps:
      - uses: actions/checkout@v4
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
      - name: Build Docker image
        uses: docker/build-push-action@v6
        with:
          context: .
          push: false
          load: true
          tags: hpc-workload-optimizer:smoke
      - name: Run container
        run: |
          docker run -d --name hpcopt-smoke -p 8080:8080 hpc-workload-optimizer:smoke
          sleep 10
      - name: Verify /health
        run: curl --fail --retry 5 --retry-delay 2 http://localhost:8080/health
      - name: Verify /ready
        run: curl --fail http://localhost:8080/ready
      - name: Verify prediction endpoint
        run: |
          curl --fail -X POST http://localhost:8080/v1/runtime/predict \
            -H 'Content-Type: application/json' \
            -d '{"requested_cpus": 8, "requested_runtime_sec": 1200}'
      - name: Cleanup
        if: always()
        run: docker rm -f hpcopt-smoke || true

  validate-dashboards:
    name: Validate Grafana dashboards
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Validate dashboard JSON files
        run: |
          for f in configs/monitoring/dashboards/*.json; do
            if [ -f "$f" ]; then
              python -m json.tool "$f" > /dev/null || { echo "Invalid JSON: $f"; exit 1; }
              echo "✓ $f"
            fi
          done
          echo "Dashboard validation complete."