ci.yml

name: SkyCast CI

on:
  push:
    branches: [main]
  pull_request:
  workflow_dispatch:

permissions:
  contents: read

jobs:
  test:
    runs-on: ubuntu-latest
    timeout-minutes: 20
    env:
      PYTHONUNBUFFERED: "1"
      PLAYWRIGHT_CHANNEL: ""
    steps:
      - name: Check out source
        uses: actions/checkout@v5

      - name: Set up Python
        uses: actions/setup-python@v6
        with:
          python-version: "3.13"
          cache: pip

      - name: Install dependencies
        run: python -m pip install --disable-pip-version-check -r requirements-dev.txt

      - name: Install Chromium
        run: python -m playwright install --with-deps chromium

      - name: Compile Python
        run: python -m compileall -q server.py weather.py planner.py infrastructure.py push_service.py scripts tests

      - name: Run fast tests
        run: python -m unittest discover -s tests -t . -v

      - name: Run browser, accessibility, visual, and performance tests
        env:
          RUN_BROWSER_TESTS: "1"
        run: python -m unittest discover -s tests -p "test_browser.py" -t . -v

      - name: Scan repository text for likely secrets
        run: >-
          python -c "from pathlib import Path; from scripts.check_staged_secrets import scan_text;
          root=Path('.'); excluded={'.git','.venv','__pycache__','data','test-results'}; findings=[];
          [findings.extend((str(path),line,kind) for line,kind in scan_text(path.read_text(encoding='utf-8',errors='ignore')))
          for path in root.rglob('*') if path.is_file() and not any(part in excluded for part in path.parts) and path.name != '.env'];
          print(f'{len(findings)} secret finding(s)'); raise SystemExit(1 if findings else 0)"

      - name: Run Lighthouse accessibility and performance budgets
        shell: bash
        run: |
          npm install --global @lhci/cli@0.15.1
          SKYCAST_OPEN_BROWSER=false python server.py > /tmp/skycast-server.log 2>&1 &
          for attempt in {1..30}; do
            if curl --fail --silent http://127.0.0.1:8000/ > /dev/null; then break; fi
            sleep 1
          done
          lhci autorun --config=.lighthouserc.json

      - name: Upload Lighthouse reports
        if: always()
        uses: actions/upload-artifact@v5
        with:
          name: lighthouse-reports
          path: .lighthouseci
          if-no-files-found: ignore