tests.yml

name: Tests

on:
  push:
    branches: [master, dev, code-optimization]
  pull_request:
    branches: [master, dev, code-optimization]
  workflow_dispatch:
    inputs:
      coverage-threshold:
        description: "Minimum coverage percentage for the Ubuntu baseline suite (留空则使用 pyproject.toml 的 fail_under)"
        required: false
        default: ""

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

env:
  # 覆盖率门槛的单一事实来源是 pyproject.toml 的 [tool.coverage.report] fail_under
  # （当前 40），此处不再重复定义，避免两处数值漂移。
  SMOKE_TEST_PATHS: >-
    tests/test_bt_api_quality.py
    tests/test_forwarding_schema.py
    tests/test_forwarding_bus_router_client.py
    tests/test_monitoring_contracts.py
  FULL_SUITE_MARKERS: "not network and not integration and not performance and not e2e and not ctp"

jobs:
  quality:
    name: Quality Gates
    runs-on: ubuntu-latest
    timeout-minutes: 15

    steps:
      # full history required: shallow clones break gitleaks PR-range scans (base^..head)
      - uses: actions/checkout@v6
        with:
          submodules: recursive
          fetch-depth: 0

      - uses: actions/setup-python@v6
        with:
          python-version: "3.11"
          cache: pip
          cache-dependency-path: pyproject.toml

      - name: Install package + quality tools
        run: |
          python -m pip install --upgrade pip
          pip install -e ".[dev]"
          pip install bandit pip-audit

      - name: Ruff lint check
        run: ruff check bt_api_py tests --output-format=github

      - name: Ruff format check
        run: ruff format --check bt_api_py tests

      - name: MyPy type check
        run: mypy bt_api_py tests --ignore-missing-imports

      - name: Bandit security scan
        run: bandit -r bt_api_py -c pyproject.toml

      - name: Dependency audit
        run: pip-audit

      - name: Secret scan (incremental gitleaks)
        if: github.event_name == 'pull_request'
        uses: gitleaks/gitleaks-action@v2
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          GITLEAKS_CONFIG: .gitleaks.toml

  # 迭代07：门禁原来只扫 bt_api_py/tests，子仓（bt_api/*/src + tests，约 25 万行）
  # 无门禁，一个月内 lint 债从 642 涨到 1303。本 job 引入"棘轮"：以入库快照为
  # 基线，任何规则数量上升即失败，债务只降不升。ruff 固定版本，保证与快照同源。
  quality-ratchet:
    name: Quality Ratchet (submodules included)
    runs-on: ubuntu-latest
    timeout-minutes: 10
    needs: quality

    steps:
      # 必须带子仓：棘轮快照覆盖 bt_api/*/src 与 bt_api/*/tests，
      # 若子仓未检出，脚本会因"范围内路径缺失"直接失败（防止假通过）。
      - uses: actions/checkout@v6
        with:
          submodules: recursive
          fetch-depth: 1

      - uses: actions/setup-python@v6
        with:
          python-version: "3.11"
          cache: pip
          cache-dependency-path: pyproject.toml

      - name: Install ruff and mypy
        run: |
          python -m pip install --upgrade pip
          pip install "ruff==0.16.2" "mypy>=1.0"

      - name: Check lint debt did not increase
        run: python scripts/ci/check_quality_ratchet.py

      # 迭代07 M4-Task13：L1 子仓的 mypy 门禁（binance 见 TECH_DEBT 的 mypy 债）。
      - name: MyPy on L1 submodules
        run: |
          for d in bt_api/bt_api_binance/src bt_api/bt_api_okx/src bt_api/bt_api_bybit/src bt_api/bt_api_gateio/src bt_api/bt_api_hyperliquid/src; do
            echo "mypy $d"
            PYTHONPATH="$d:bt_api/bt_api_base/src" mypy "$d" --ignore-missing-imports
          done

      - name: Publish ratchet summary
        if: always()
        run: |
          {
            echo "### Quality ratchet (lint debt may only decrease)"
            echo ""
            echo '```'
            python scripts/ci/check_quality_ratchet.py --report || true
            echo '```'
          } >> "$GITHUB_STEP_SUMMARY"

  format-ratchet:
    name: Format Ratchet (submodules)
    runs-on: ubuntu-latest
    timeout-minutes: 15
    needs: quality

    steps:
      - uses: actions/checkout@v6
        with:
          submodules: recursive
          fetch-depth: 1

      - uses: actions/setup-python@v6
        with:
          python-version: "3.11"
          cache: pip
          cache-dependency-path: pyproject.toml

      - name: Install pinned Ruff
        run: |
          python -m pip install --upgrade pip
          pip install "ruff==0.16.2"

      - name: Check per-module format debt did not increase
        run: python scripts/ci/check_format_ratchet.py

  compatibility:
    name: Compatibility
    needs: quality
    uses: ./.github/workflows/reusable-compat-matrix.yml

  full-suite:
    name: Full Suite (Python 3.11, Ubuntu)
    runs-on: ubuntu-latest
    timeout-minutes: 45
    needs: quality
    env:
      CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}

    defaults:
      run:
        shell: bash

    steps:
      - uses: actions/checkout@v6
        with:
          submodules: recursive

      - uses: actions/setup-python@v6
        with:
          python-version: "3.11"
          cache: pip
          cache-dependency-path: pyproject.toml

      - name: Install build tools
        run: sudo apt-get update && sudo apt-get install -y build-essential

      - name: Install package + dev deps
        run: |
          python -m pip install --upgrade pip
          # Unmarked contract cases exercise the declared reference adapters.
          pip install -e ".[dev,security,core-reference]" -r requirements-ci-core-reference.txt

      - name: Run baseline suite with coverage gate
        env:
          SKIP_LIVE_TESTS: "true"
          COVERAGE_THRESHOLD: ${{ github.event.inputs['coverage-threshold'] }}
        shell: bash
        run: |
          set -euo pipefail
          # 覆盖率门槛以 pyproject.toml 的 [tool.coverage.report] fail_under 为
          # 单一事实来源（当前 40）。仅当 workflow_dispatch 显式传入
          # coverage-threshold 时才临时覆盖，避免两处数值各写一份而漂移。
          coverage_threshold_re='^(0|[1-9][0-9]?)([.][0-9]+)?$|^100([.]0+)?$'
          extra_args=()
          if [[ -n "$COVERAGE_THRESHOLD" ]]; then
            if [[ ! "$COVERAGE_THRESHOLD" =~ $coverage_threshold_re ]]; then
              echo "::error::coverage-threshold must be a decimal between 0 and 100"
              exit 2
            fi
            extra_args+=("--cov-fail-under=${COVERAGE_THRESHOLD}")
          fi

          pytest_args=(
            tests -v -n 8
            -m "$FULL_SUITE_MARKERS"
            --cov=bt_api_py
            --cov-branch
            --cov-report=xml:coverage-full.xml
            --cov-report=html
            --cov-report=term-missing
          )
          if [[ -n "$COVERAGE_THRESHOLD" ]]; then
            pytest_args+=("${extra_args[0]}")
          fi
          python -m pytest "${pytest_args[@]}"

      - name: Validate coverage reports
        if: always()
        shell: bash
        run: |
          set -euo pipefail
          test -s coverage-full.xml
          test -s htmlcov/index.html

      - name: Upload coverage to Codecov
        if: always() && env.CODECOV_TOKEN != ''
        uses: codecov/codecov-action@v6
        with:
          token: ${{ secrets.CODECOV_TOKEN }}
          files: ./coverage-full.xml
          flags: ubuntu-py3.11
          fail_ci_if_error: false
          verbose: true

      - name: Archive coverage report
        if: always()
        uses: actions/upload-artifact@v7
        with:
          name: coverage-report-ubuntu-py3.11
          path: |
            coverage-full.xml
            htmlcov/
          if-no-files-found: error
          retention-days: 30

  wheel-contract:
    name: Wheel Contract (Python 3.11, Ubuntu)
    runs-on: ubuntu-latest
    timeout-minutes: 20
    needs: quality

    steps:
      - uses: actions/checkout@v6

      - uses: actions/setup-python@v6
        with:
          python-version: "3.11"
          cache: pip
          cache-dependency-path: pyproject.toml

      - name: Build candidate artifacts
        run: |
          python -m pip install --upgrade pip
          python -m pip install build
          python -m build --outdir dist

      - name: Verify installed wheel resource contract
        run: |
          python scripts/ci/verify_wheel_contract.py \
            --dist-dir dist \
            --receipt wheel-contract-receipt.json

      - name: Archive wheel contract receipt
        if: always()
        uses: actions/upload-artifact@v7
        with:
          name: wheel-contract-ubuntu-py3.11
          path: |
            dist/
            wheel-contract-receipt.json
          retention-days: 30

  quality-gate:
    name: Tests / Quality Gate
    runs-on: ubuntu-latest
    needs: [quality, quality-ratchet, compatibility, full-suite, wheel-contract, format-ratchet]
    if: always()

    steps:
      - name: Check job results
        run: |
          if [ "${{ needs.quality.result }}" != "success" ]; then
            echo "::error::Quality checks failed"
            exit 1
          fi
          if [ "${{ needs.quality-ratchet.result }}" != "success" ]; then
            echo "::error::Quality ratchet failed"
            exit 1
          fi
          if [ "${{ needs.compatibility.result }}" != "success" ]; then
            echo "::error::Compatibility matrix failed"
            exit 1
          fi
          if [ "${{ needs.full-suite.result }}" != "success" ]; then
            echo "::error::Full baseline suite failed"
            exit 1
          fi
          if [ "${{ needs.wheel-contract.result }}" != "success" ]; then
            echo "::error::Installed wheel contract failed"
            exit 1
          fi
          if [ "${{ needs.format-ratchet.result }}" != "success" ]; then
            echo "::error::Submodule format ratchet failed"
            exit 1
          fi

      - name: Generate summary
        run: |
          echo "## CI Summary" >> "$GITHUB_STEP_SUMMARY"
          echo "" >> "$GITHUB_STEP_SUMMARY"
          echo "| Job | Status |" >> "$GITHUB_STEP_SUMMARY"
          echo "|-----|--------|" >> "$GITHUB_STEP_SUMMARY"
          echo "| Quality | ${{ needs.quality.result == 'success' && 'Passed' || 'Failed' }} |" >> "$GITHUB_STEP_SUMMARY"
          echo "| Quality ratchet | ${{ needs.quality-ratchet.result == 'success' && 'Passed' || 'Failed' }} |" >> "$GITHUB_STEP_SUMMARY"
          echo "| Compatibility matrix | ${{ needs.compatibility.result == 'success' && 'Passed' || 'Failed' }} |" >> "$GITHUB_STEP_SUMMARY"
          echo "| Ubuntu baseline suite | ${{ needs.full-suite.result == 'success' && 'Passed' || 'Failed' }} |" >> "$GITHUB_STEP_SUMMARY"
          echo "| Installed wheel contract | ${{ needs.wheel-contract.result == 'success' && 'Passed' || 'Failed' }} |" >> "$GITHUB_STEP_SUMMARY"
          echo "| Submodule format ratchet | ${{ needs.format-ratchet.result == 'success' && 'Passed' || 'Failed' }} |" >> "$GITHUB_STEP_SUMMARY"
          echo "" >> "$GITHUB_STEP_SUMMARY"
          echo "Compatibility matrix: macOS, Linux, Windows x Python 3.11-3.13 (blocking) + 3.14 (canary)." >> "$GITHUB_STEP_SUMMARY"