name: CI

on:
  push:
    branches: [dev, main]
  pull_request:
    branches: [main]

jobs:
  backend-lint-and-test:
    # Runner must have Python 3.14 + ruff + Node 22 pre-installed. The
    # python-ci runner image lives at CI-Runner/CI-python/ in the operator's
    # workspace; see that Dockerfile + Makefile to roll/push the image.
    runs-on: python-ci
    services:
      postgres:
        image: pgvector/pgvector:pg16
        env:
          POSTGRES_USER: fabledcurator
          POSTGRES_PASSWORD: ci_test_password
          POSTGRES_DB: fabledcurator_test
        options: >-
          --health-cmd "pg_isready -U fabledcurator"
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5
      redis:
        image: redis:7-alpine
        options: >-
          --health-cmd "redis-cli ping"
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5
    env:
      DB_USER: fabledcurator
      DB_PASSWORD: ci_test_password
      DB_HOST: postgres
      DB_PORT: "5432"
      DB_NAME: fabledcurator_test
      CELERY_BROKER_URL: redis://redis:6379/0
      CELERY_RESULT_BACKEND: redis://redis:6379/0
      SECRET_KEY: ci_test_secret_not_for_prod
    steps:
      - uses: actions/checkout@v4

      - name: Install Python deps
        # ruff is pre-installed in the python-ci runner image (see
        # CI-Runner/CI-python/Dockerfile's RUFF_VERSION). Per FabledRulebook
        # forgejo.md, toolchain versions live on the runner image, not here.
        run: pip install -r requirements.txt pytest pytest-asyncio

      - name: Ruff lint
        run: ruff check backend/ tests/ alembic/

      - name: Alembic upgrade (smoke)
        run: alembic upgrade head

      - name: Pytest (unit only)
        run: pytest tests/ -v

  frontend-build:
    runs-on: python-ci
    defaults:
      run:
        working-directory: frontend
    steps:
      - uses: actions/checkout@v4
      # No package-lock.json is tracked yet (we don't run npm locally per
      # feedback-no-local-runs). Using `npm install` instead of `npm ci`.
      # If we want strict lockfile-based reproducibility later, commit a
      # package-lock.json and flip this back to `npm ci`.
      - run: npm install --no-audit --no-fund
      - run: npm run check
      - run: npm run build