name: ci

on:
  push:
    branches: [main]
  pull_request:

jobs:
  lint-test-leaks:
    runs-on: ubuntu-latest
    services:
      postgres:
        image: postgres:16
        env:
          POSTGRES_USER: cayce
          POSTGRES_PASSWORD: ci-only-not-a-secret
          POSTGRES_DB: cayce_ops
        ports:
          - 5432:5432
        options: >-
          --health-cmd "pg_isready -U cayce -d cayce_ops"
          --health-interval 5s --health-timeout 3s --health-retries 10
    env:
      CAYCE_OPS_DATABASE_URL: postgresql+psycopg://cayce:ci-only-not-a-secret@127.0.0.1:5432/cayce_ops
      PGPASSWORD: ci-only-not-a-secret
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0  # gitleaks needs full history

      - uses: astral-sh/setup-uv@v5
        with:
          python-version: "3.12"

      - name: Install (locked)
        run: uv sync --frozen

      - name: Lint (ruff)
        run: uv run ruff check .

      - name: Migrations upgrade/downgrade round-trip (Postgres 16)
        run: |
          uv run alembic upgrade head
          uv run alembic downgrade 0001
          uv run alembic upgrade head
          uv run alembic downgrade base
          uv run alembic upgrade head

      - name: Alembic smoke (SQLite)
        run: uv run alembic upgrade head

      - name: Unit tests (pytest)
        run: uv run pytest -m "not integration"

      - name: Integration tests — roles.sql + daemon cycles (Postgres 16)
        run: |
          sudo apt-get update && sudo apt-get install -y postgresql-client
          uv run pytest -m integration -v

      - name: Secret scan (gitleaks, full history)
        run: |
          curl -sSfL https://github.com/gitleaks/gitleaks/releases/download/v8.30.1/gitleaks_8.30.1_linux_x64.tar.gz | tar -xz gitleaks
          ./gitleaks detect --source . --log-opts="--all" -v