code-quality.yml

name: Code Quality

# Run on all PRs and pushes to main for comprehensive quality checks
on:
  push:
    branches: [main, develop]
  pull_request:
    branches: [main, develop]
  workflow_dispatch:

# Concurrency group to cancel previous runs
concurrency:
  group: code-quality-${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
  cancel-in-progress: true

# Environment variables
env:
  FORCE_COLOR: "1"
  PIP_DISABLE_PIP_VERSION_CHECK: "1"

  # Test environment indicators
  CI: "true"
  TESTING: "true"
  PYTEST_RUNNING: "true"

  # Mock AWS credentials (required for boto3 initialization)
  AWS_ACCESS_KEY_ID: "test-access-key-id"
  AWS_SECRET_ACCESS_KEY: "test-secret-access-key"
  AWS_DEFAULT_REGION: "us-east-1"
  AWS_REGION: "us-east-1"

  # YMemo-specific test configuration
  TRANSCRIPTION_PROVIDER: "aws"
  CAPTURE_PROVIDER: "pyaudio"
  LOG_LEVEL: "WARNING" # Reduce CI log noise

  # Disable real service connections
  SKIP_AWS_VALIDATION: "true"
  MOCK_SERVICES: "true"

permissions:
  contents: read
  pull-requests: write

jobs:
  # Linting and code style checks
  lint:
    name: "Lint & Style"
    runs-on: ubuntu-latest

    steps:
      - name: "📥 Checkout repository"
        uses: actions/checkout@v4

      - name: "🐍 Set up Python 3.11"
        uses: actions/setup-python@v5
        with:
          python-version: "3.11"

      - name: "📦 Cache pip dependencies"
        uses: actions/cache@v4
        with:
          path: ~/.cache/pip
          key: lint-pip-3.11-${{ hashFiles('**/requirements.txt') }}
          restore-keys: lint-pip-3.11-

      - name: "🔧 Install system dependencies (Ubuntu)"
        run: |
          sudo apt-get update -yq
          sudo apt-get install -yq portaudio19-dev python3-dev libasound2-dev
          sudo apt-get install -yq libportaudio2 libportaudiocpp0

      - name: "🧪 Set up test environment"
        run: |
          # Create fake AWS credentials directory for boto3 (Linux/macOS only)
          mkdir -p ~/.aws
          cat > ~/.aws/credentials << EOF
          [default]
          aws_access_key_id = test-access-key-id
          aws_secret_access_key = test-secret-access-key
          region = us-east-1
          EOF

          cat > ~/.aws/config << EOF
          [default]
          region = us-east-1
          output = json
          EOF

          echo "✅ Test environment configured with mock AWS credentials"

      - name: "📦 Install linting tools"
        run: |
          python -m pip install --upgrade pip
          python -m pip install black isort

      - name: "🎨 Check Black formatting"
        run: black --check --diff src/ tests/

      - name: "📦 Check import sorting (isort)"
        run: isort --check-only --diff src/ tests/

  # Documentation checks
  docs:
    name: "Documentation"
    runs-on: ubuntu-latest

    steps:
      - name: "📥 Checkout repository"
        uses: actions/checkout@v4

      - name: "🐍 Set up Python 3.11"
        uses: actions/setup-python@v5
        with:
          python-version: "3.11"

      - name: "📦 Install documentation tools"
        run: |
          python -m pip install --upgrade pip
          python -m pip install pydocstyle doc8 sphinx

      - name: "📚 Check docstring style"
        run: |
          # Check docstring conventions (relaxed for initial implementation)
          pydocstyle src/ --convention=numpy --add-ignore=D100,D101,D102,D103,D104,D105 || true

      - name: "📝 Check README and documentation"
        run: |
          # Basic checks for markdown files
          if command -v markdownlint-cli2 &> /dev/null; then
            markdownlint-cli2 "**/*.md"
          else
            echo "markdownlint not installed, skipping markdown linting"
          fi

  # Dependency analysis
  dependencies:
    name: "Dependency Analysis"
    runs-on: ubuntu-latest

    steps:
      - name: "📥 Checkout repository"
        uses: actions/checkout@v4

      - name: "🐍 Set up Python 3.11"
        uses: actions/setup-python@v5
        with:
          python-version: "3.11"

      - name: "🔧 Install system dependencies (Ubuntu)"
        run: |
          sudo apt-get update -yq
          sudo apt-get install -yq portaudio19-dev python3-dev libasound2-dev
          sudo apt-get install -yq libportaudio2 libportaudiocpp0

      - name: "🧪 Set up test environment"
        run: |
          # Create fake AWS credentials directory for boto3 (Linux/macOS only)
          mkdir -p ~/.aws
          cat > ~/.aws/credentials << EOF
          [default]
          aws_access_key_id = test-access-key-id
          aws_secret_access_key = test-secret-access-key
          region = us-east-1
          EOF

          cat > ~/.aws/config << EOF
          [default]
          region = us-east-1
          output = json
          EOF

          echo "✅ Test environment configured with mock AWS credentials"

      - name: "📦 Install dependency analysis tools"
        run: |
          python -m pip install --upgrade pip
          # Force secure setuptools version first
          python -m pip install "setuptools>=78.1.1"
          python -m pip install pip-audit pipdeptree

      - name: "🌳 Generate dependency tree"
        run: |
          # Install project dependencies first
          python -m pip install -r requirements.txt
          # Generate dependency tree for analysis
          pipdeptree --json > dependency-tree.json
          pipdeptree

      - name: "🔍 Audit dependencies for vulnerabilities"
        run: |
          # pip-audit for dependency vulnerability scanning
          pip-audit --desc --output=audit-report.json --format=json || true
          pip-audit --desc

      - name: "📤 Upload dependency reports"
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: dependency-reports
          path: |
            audit-report.json
            dependency-tree.json
          retention-days: 30

  # Quality gate for all code quality checks
  quality-summary:
    name: "Quality Summary ✅"
    needs: [lint, docs, dependencies]
    runs-on: ubuntu-latest
    if: always()

    steps:
      - name: "✅ Quality checks passed"
        if: |
          needs.lint.result == 'success' &&
          needs.docs.result == 'success' &&
          needs.dependencies.result == 'success'
        run: |
          echo "🎉 All code quality checks passed!"
          echo "📊 Quality Summary:"
          echo "- ✅ Linting and style checks"
          echo "- ✅ Documentation checks"
          echo "- ✅ Dependency analysis"
          echo ""
          echo "YMemo maintains high code quality standards! 🚀"

      - name: "❌ Quality checks failed"
        if: |
          needs.lint.result == 'failure' ||
          needs.docs.result == 'failure' ||
          needs.dependencies.result == 'failure'
        run: |
          echo "❌ Some quality checks failed:"
          echo "- Lint: ${{ needs.lint.result }}"
          echo "- Docs: ${{ needs.docs.result }}"
          echo "- Dependencies: ${{ needs.dependencies.result }}"
          echo ""
          echo "Please review the detailed reports above."
          exit 1

      - name: "⚠️ Quality checks incomplete"
        if: |
          contains(fromJSON('["cancelled", "skipped"]'), needs.lint.result) ||
          contains(fromJSON('["cancelled", "skipped"]'), needs.docs.result) ||
          contains(fromJSON('["cancelled", "skipped"]'), needs.dependencies.result)
        run: |
          echo "⚠️ Some quality checks were cancelled or skipped."
          echo "This may indicate workflow issues or concurrency limits."
          exit 1