name: CI

# Per FabledRulebook/forgejo.md: "CI runs analyzers + short unit tests.
# Integration tests that need real Postgres/ffmpeg run locally via
# docker-compose." So this workflow deliberately does NOT spin up service
# containers; DB-dependent tests are marked `@pytest.mark.integration` and
# excluded with `-m "not integration"`. To run integration tests, operator
# uses docker-compose locally.

on:
  push:
    branches: [dev, main]
  pull_request:
    branches: [main]

jobs:
  backend-lint-and-test:
    # Runner must have Python 3.14 + ruff + Node 22 pre-installed. The
    # python-ci runner image lives at CI-Runner/CI-python/ in the operator's
    # workspace; see that Dockerfile + Makefile to roll/push the image.
    runs-on: python-ci
    env:
      # DB_PASSWORD and SECRET_KEY are required by config.py at import time
      # even though unit tests don't actually touch the DB or use the secret.
      DB_PASSWORD: ci_unit_test_placeholder
      SECRET_KEY: ci_unit_test_placeholder
    steps:
      - uses: actions/checkout@v4

      - name: Install Python deps
        # ruff is pre-installed in the python-ci runner image (see
        # CI-Runner/CI-python/Dockerfile's RUFF_VERSION). Per FabledRulebook
        # forgejo.md, toolchain versions live on the runner image, not here.
        run: pip install -r requirements.txt pytest pytest-asyncio

      - name: Ruff lint
        run: ruff check backend/ tests/ alembic/

      - name: Pytest (unit tests only — integration tests run locally)
        run: pytest tests/ -v -m "not integration"

  frontend-build:
    runs-on: python-ci
    defaults:
      run:
        working-directory: frontend
    steps:
      - uses: actions/checkout@v4
      # No package-lock.json is tracked yet (we don't run npm locally per
      # feedback-no-local-runs). Using `npm install` instead of `npm ci`.
      # If we want strict lockfile-based reproducibility later, commit a
      # package-lock.json and flip this back to `npm ci`.
      - run: npm install --no-audit --no-fund
      # `npm run check` (vue-tsc --noEmit) skipped: the frontend is pure JS
      # with no .ts files and no JSDoc annotations, so vue-tsc has nothing
      # to type-check. Re-enable once we add a tsconfig.json and either
      # convert to TS or add JSDoc.
      - run: npm run build