ci.yml

name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

permissions:
  contents: read

jobs:
  lint:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
        with:
          python-version: "3.11"
      - name: Install dependencies
        run: |
          python -m pip install --upgrade pip
          # Install the project so `mypy --strict` type-checks against the real
          # numpy / pydantic stubs (NDArray dtype args, the BaseModel base class).
          # Linting only against `ruff black mypy` left numpy/pydantic uninstalled,
          # so --strict raised disallow_subclassing_any on the BaseModel subclass.
          # Consistent with the test / security / docs jobs. CPU torch keeps it lean.
          .github/scripts/install_torch_cpu.sh
          pip install -e ".[dev]"
      - name: Run ruff
        run: ruff check .
      - name: Run black check
        run: black --check .
      - name: Run mypy (strict)
        run: mypy --strict groupoid/ --ignore-missing-imports

  test:
    runs-on: ubuntu-latest
    strategy:
      matrix:
        python-version: ["3.10", "3.11", "3.12"]
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
        with:
          python-version: ${{ matrix.python-version }}
      - name: Install dependencies
        run: |
          python -m pip install --upgrade pip
          .github/scripts/install_torch_cpu.sh
          pip install -e ".[dev]"
      - name: Run tests with coverage gate
        run: >-
          pytest tests/ -v --tb=short -x
          --cov=groupoid --cov-branch
          --cov-report=term-missing --cov-fail-under=100

  security:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
        with:
          python-version: "3.11"
      - name: Install dependencies
        run: |
          python -m pip install --upgrade pip
          # Install the project's real runtime closure so pip-audit scans the
          # packages GROUPOID actually depends on. The previous `safety` step
          # installed only the tools and never the project, so it audited the
          # wrong environment. CPU torch keeps the install lean.
          .github/scripts/install_torch_cpu.sh
          pip install -e .
          pip install bandit pip-audit
          # Pin setuptools LAST. torch requires setuptools<82 and pulls in a
          # runner-bundled setuptools that can predate the PYSEC-2025-49 fix
          # (78.1.1); upgrading before `pip install -e .` is simply undone by torch.
          # The window >=78.1.1,<82 clears the advisory while staying
          # dependency-consistent with torch (verified: pip check clean).
          python -m pip install --upgrade "setuptools>=78.1.1,<82"
      - name: Run bandit
        run: bandit -r groupoid/ -c pyproject.toml
      - name: Audit dependencies for known vulnerabilities (pip-audit)
        # pip-audit (OSV-backed, maintained) replaces the deprecated `safety check`
        # (deprecated in safety 3.x in favour of the account-gated `safety scan`).
        # HARD gate: any advisory with a fix version fails the job. The single
        # documented exception is CVE-2025-3000 (torch): no fixed release exists
        # upstream, and OSV expresses the affected range (listed versions up to
        # v2.6.0) as a Git/commit boundary pip-audit cannot version-resolve, so it
        # conservatively flags the installed torch. Disclosed in SECURITY.md; the
        # torch.load / JIT deserialization path is not exercised by GROUPOID. Revisit
        # the ignore once upstream publishes a fixed release.
        run: pip-audit --ignore-vuln CVE-2025-3000

  pre-commit:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
        with:
          python-version: "3.11"
      - name: Install pre-commit
        run: pip install pre-commit
      - name: Run pre-commit
        run: pre-commit run --all-files

  benchmark:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
        with:
          python-version: "3.11"
      - name: Install dependencies
        run: |
          python -m pip install --upgrade pip
          .github/scripts/install_torch_cpu.sh
          pip install -e ".[dev]"
      # Benchmarks run for information only. There is no regression gate:
      # timing baselines recorded on one machine are not comparable to a
      # different CI runner, so gating CI against such a baseline would be a
      # meaningless pass/fail. The benchmark JSON is uploaded as an artifact
      # for inspection. A real cross-run regression gate can be added later
      # (e.g. github-action-benchmark with continuous baselines), at which
      # point a committed, machine-tagged baseline becomes meaningful.
      - name: Run benchmarks (informational only, not a gate)
        run: |
          pytest benchmarks/ -v --benchmark-json=benchmark_results.json || true
      - name: Upload benchmark results
        if: always()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: benchmark-results
          path: benchmark_results.json
          if-no-files-found: ignore

  docs:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
        with:
          python-version: "3.11"
      - name: Install dependencies
        run: |
          python -m pip install --upgrade pip
          .github/scripts/install_torch_cpu.sh
          pip install -e ".[docs]"
      - name: Build docs
        run: mkdocs build --strict