test.yml

name: Tests

on:
  push:
    branches: [main, develop]
  pull_request:
    branches: [main, develop]
  workflow_dispatch:
  workflow_call:

permissions:
  contents: read

jobs:
  test:
    runs-on: ubuntu-latest

    strategy:
      max-parallel: 1
      matrix:
        python-version: ["3.10", "3.11", "3.12"]

    steps:
      - name: Checkout repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6

      - name: Set up Python ${{ matrix.python-version }}
        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405  # v6
        with:
          python-version: ${{ matrix.python-version }}

      - name: Install uv
        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78  # v7

      - name: Install dependencies
        run: uv sync

      - name: Run linting
        run: |
          echo "Running code quality checks..."
          uv run ruff check src/ tests/ scripts/
          uv run ruff format --check src/ tests/ scripts/

      - name: Run unit tests
        run: |
          echo "Running unit tests (no API calls)..."
          uv run pytest -m unit -v --tb=short --no-header

      - name: Run integration tests with coverage
        env:
          ORGANIZATION_ACCESS_TOKEN: ${{ secrets.ORGANIZATION_ACCESS_TOKEN }}
          ORGANIZATION_ID: ${{ secrets.ORGANIZATION_ID }}
          AUTHLETE_API_URL: "https://jp.authlete.com"
          AUTHLETE_IDP_URL: "https://login.authlete.com"
          AUTHLETE_API_SERVER_ID: "53285"
        run: |
          echo "Running integration tests with coverage..."
          if [ -z "$ORGANIZATION_ACCESS_TOKEN" ]; then
            echo "❌ ORGANIZATION_ACCESS_TOKEN secret not configured"
            echo "Running all tests without coverage as fallback"
            uv run pytest --tb=short --no-header
          else
            if [ -z "$ORGANIZATION_ID" ]; then
              echo "❌ ORGANIZATION_ID secret not configured"
              exit 1
            fi
            echo "🔑 Using configured secrets - running integration tests with coverage"
            uv run coverage erase
            uv run pytest -m integration -v --tb=short --no-header
            uv run coverage combine
            uv run coverage report --show-missing
          fi


      - name: Test MCP server startup
        env:
          ORGANIZATION_ACCESS_TOKEN: ${{ secrets.ORGANIZATION_ACCESS_TOKEN }}
          ORGANIZATION_ID: ${{ secrets.ORGANIZATION_ID }}
        run: |
          echo "Testing MCP server startup..."
          timeout 10s uv run python main.py --help > /dev/null 2>&1 || true
          echo "MCP server startup test completed"

      - name: Test OpenAPI spec update script
        run: |
          echo "Testing OpenAPI spec update script..."
          # Test script execution (will likely fail to download but tests the code)
          timeout 30s uv run python scripts/update_openapi_spec.py || true
          echo "OpenAPI update script test completed"

  test-docker:
    runs-on: ubuntu-latest
    needs: test

    steps:
      - name: Checkout repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6

      - name: Test Docker build (if Dockerfile exists)
        run: |
          if [ -f Dockerfile ]; then
            echo "Testing Docker build..."
            docker build -t authlete-mcp-test .
            echo "Docker build successful"
          else
            echo "No Dockerfile found - skipping Docker test"
          fi

  lint-yaml:
    runs-on: ubuntu-latest

    steps:
      - name: Checkout repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6

      - name: Set up Python
        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405  # v6
        with:
          python-version: "3.10"

      - name: Install uv
        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78  # v7

      - name: Install dependencies
        run: uv sync

      - name: Lint YAML files
        run: uv run yamllint .github/

  security-scan:
    runs-on: ubuntu-latest
    needs: test

    steps:
      - name: Checkout repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6

      - name: Set up Python
        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405  # v6
        with:
          python-version: "3.10"

      - name: Install uv
        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78  # v7

      - name: Install dependencies
        run: uv sync

      - name: Run security scan with bandit
        run: |
          echo "Running security scan..."
          uv add bandit
          uv run bandit -r src/ scripts/ -f json -o bandit-report.json || true

          if [ -f bandit-report.json ]; then
            echo "Security scan completed. Results:"
            uv run bandit -r src/ scripts/ || true
          fi

      - name: Upload security scan results
        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f  # v7
        if: always()
        with:
          name: security-scan-results
          path: bandit-report.json
          retention-days: 30

  cleanup-test-services:
    runs-on: ubuntu-latest
    needs: [test]
    if: always() && (needs.test.result == 'success' || needs.test.result == 'failure')

    steps:
      - name: Checkout repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6

      - name: Set up Python
        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405  # v6
        with:
          python-version: "3.10"

      - name: Install uv
        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78  # v7

      - name: Install dependencies
        run: uv sync

      - name: Cleanup test services
        env:
          ORGANIZATION_ACCESS_TOKEN: ${{ secrets.ORGANIZATION_ACCESS_TOKEN }}
          ORGANIZATION_ID: ${{ secrets.ORGANIZATION_ID }}
          AUTHLETE_API_URL: "https://jp.authlete.com"
          AUTHLETE_IDP_URL: "https://login.authlete.com"
          AUTHLETE_API_SERVER_ID: "53285"
        run: |
          echo "🧹 Cleaning up pytest services..."
          if [ -z "$ORGANIZATION_ACCESS_TOKEN" ]; then
            echo "⚠️ ORGANIZATION_ACCESS_TOKEN not configured - cleanup will be skipped in CI"
            echo "Real cleanup only runs with actual Authlete credentials"
          else
            echo "🔑 Using real credentials - performing cleanup"
            uv run python scripts/cleanup_test_services.py || true
          fi
          echo "✅ Cleanup job completed"

  summary:
    runs-on: ubuntu-latest
    needs: [test, test-docker, lint-yaml, security-scan, cleanup-test-services]
    if: always()

    steps:
      - name: Test Results Summary
        run: |
          echo "## Test Results Summary" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "| Job | Status |" >> $GITHUB_STEP_SUMMARY
          echo "|-----|--------|" >> $GITHUB_STEP_SUMMARY
          echo "| Unit & Integration Tests | ${{ needs.test.result }} |" >> $GITHUB_STEP_SUMMARY
          echo "| Docker Build Test | ${{ needs.test-docker.result }} |" >> $GITHUB_STEP_SUMMARY
          echo "| YAML Linting | ${{ needs.lint-yaml.result }} |" >> $GITHUB_STEP_SUMMARY
          echo "| Security Scan | ${{ needs.security-scan.result }} |" >> $GITHUB_STEP_SUMMARY
          echo "| Test Cleanup | ${{ needs.cleanup-test-services.result }} |" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY

          if [ "${{ needs.test.result }}" = "success" ]; then
            echo "✅ All tests passed successfully!" >> $GITHUB_STEP_SUMMARY
          else
            echo "❌ Some tests failed. Please check the logs above." >> $GITHUB_STEP_SUMMARY
          fi