ci.yml

name: CI

on:
  push:
    branches: [main]
  pull_request:

permissions:
  contents: read

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  lint:
    name: Lint (ruff + mypy)
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: detector
    steps:
      - uses: actions/checkout@v6

      - uses: astral-sh/setup-uv@v7
        with:
          python-version: "3.12"
          enable-cache: true
          cache-dependency-glob: "detector/pyproject.toml"

      - run: uv sync --all-extras

      - name: ruff check
        run: uv run ruff check .

      - name: ruff format --check
        run: uv run ruff format --check .

      - name: mypy --strict
        run: uv run mypy --strict src

  test:
    name: Test (pytest)
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: detector
    steps:
      - uses: actions/checkout@v6

      - uses: astral-sh/setup-uv@v7
        with:
          python-version: "3.12"
          enable-cache: true
          cache-dependency-glob: "detector/pyproject.toml"

      - run: uv sync --all-extras
      - run: uv run pytest --cov=promanomaly --cov-report=xml

      - uses: actions/upload-artifact@v7
        if: always()
        with:
          name: coverage
          path: detector/coverage.xml
          if-no-files-found: ignore

  validate-action:
    name: Config-validation Action (dogfood)
    # Exercises the composite action.yml on an example config so the
    # published GitOps validation Action can't regress. No datasource is
    # available in CI, so this runs the static checks only (schema +
    # --estimate-cost --strict); --probe / --lint-metadata are covered by
    # the unit tests, which stub the datasource.
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6

      - name: Validate an example config via the action
        uses: ./
        with:
          config: examples/configs/node-exporter.yaml
          estimate-cost: "true"
          strict: "true"

  community-prophet:
    name: Community ProphetResidual (lint + test with Prophet stubbed)
    # Prophet's real install pulls cmdstan / pystan and is multi-minute on
    # cold CI runners. The detector itself only exercises Prophet through
    # ``Prophet(...).fit(...).predict(...)``, so we lint + test the
    # community package against a tiny Prophet stub (tests/conftest.py)
    # without installing the real thing — the third-party plug-in path
    # documented in the roadmap.
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: community/promanomaly-prophet
    steps:
      - uses: actions/checkout@v6

      - uses: actions/setup-python@v6
        with:
          python-version: "3.12"

      - name: Install host detector + community package (editable)
        run: |
          python -m pip install --upgrade pip
          # Install promanomaly first so the community detector can
          # import ParamSpec; then install the community package without
          # its prophet dependency (the tests stub it out).
          pip install -e ../../detector
          pip install --no-deps -e .
          pip install pytest ruff mypy pandas pandas-stubs numpy

      - name: ruff check
        run: ruff check .

      - name: mypy --strict
        run: mypy --strict src

      - name: pytest
        run: pytest -q

  community-iforest:
    name: Community IsolationForest (lint + test with sklearn stubbed)
    # scikit-learn is a large dependency. The detector itself only
    # exercises ``IsolationForest(...).fit(...).score_samples(...)``,
    # so we lint + test against a tiny sklearn stub (tests/conftest.py)
    # without installing the real thing.
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: community/promanomaly-iforest
    steps:
      - uses: actions/checkout@v6

      - uses: actions/setup-python@v6
        with:
          python-version: "3.12"

      - name: Install host detector + community package (editable)
        run: |
          python -m pip install --upgrade pip
          # Install promanomaly first so the community detector can
          # import ParamSpec; then install the community package without
          # its sklearn dependency (the tests stub it out).
          pip install -e ../../detector
          pip install --no-deps -e .
          pip install pytest ruff mypy pandas pandas-stubs numpy

      - name: ruff check
        run: ruff check .

      - name: mypy --strict
        run: mypy --strict src

      - name: pytest
        run: pytest -q

  chart-lint:
    name: Lint Helm charts
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
        with:
          # chart-testing diffs against the base branch to find changed
          # charts; without history its --target-branch comparison sees
          # nothing and the lint job becomes a no-op.
          fetch-depth: 0

      - uses: azure/setup-helm@v5
        with:
          version: latest

      - uses: actions/setup-python@v6
        with:
          python-version: "3.12"

      - name: Install chart-testing
        uses: helm/chart-testing-action@v2.8.0

      - name: Register Helm repositories
        run: |
          helm repo add victoria-metrics https://victoriametrics.github.io/helm-charts/
          helm repo update

      - name: helm dependency update
        run: |
          helm dependency update charts/promanomaly       || true
          helm dependency update charts/promanomaly-stack || true

      - name: ct lint
        run: |
          ct lint \
            --charts charts/promanomaly,charts/promanomaly-stack,charts/promanomaly-metrics-adapter \
            --validate-maintainers=false \
            --check-version-increment=false \
            --target-branch ${{ github.event.repository.default_branch }}

      - name: helm lint --strict
        run: |
          helm lint --strict charts/promanomaly
          helm lint --strict charts/promanomaly-stack
          helm lint --strict charts/promanomaly-metrics-adapter

      - name: Install kubeconform
        run: |
          curl -sSLo kubeconform.tar.gz \
            https://github.com/yannh/kubeconform/releases/latest/download/kubeconform-linux-amd64.tar.gz
          tar xf kubeconform.tar.gz
          sudo install kubeconform /usr/local/bin/

      - name: kubeconform
        run: |
          helm template charts/promanomaly                  | kubeconform -strict -summary -ignore-missing-schemas
          helm template charts/promanomaly-stack            | kubeconform -strict -summary -ignore-missing-schemas
          helm template charts/promanomaly-metrics-adapter  | kubeconform -strict -summary -ignore-missing-schemas

      - name: chart-testing values matrix (lint + render + kubeconform)
        # ct lint already exercises the ci/ values files, but we
        # additionally render each one through kubeconform so any
        # conditional template that produces an invalid manifest under
        # a non-default values combination fails the build. Lint-only
        # equivalent of `ct install` for clusters where spinning up
        # kind in CI is too expensive.
        run: |
          set -euo pipefail
          shopt -s nullglob
          fail=0
          for chart in charts/promanomaly charts/promanomaly-stack charts/promanomaly-metrics-adapter; do
            for vf in "$chart"/ci/*-values.yaml; do
              echo "::group::render $chart with $(basename "$vf")"
              if ! helm template "$chart" --values "$vf" \
                  | kubeconform -strict -summary -ignore-missing-schemas; then
                echo "::error file=$vf::kubeconform failed for $chart with $(basename "$vf")"
                fail=1
              fi
              echo "::endgroup::"
            done
          done
          exit $fail

  labels-contract:
    name: LABELS_CONTRACT.md parity with promforecast
    # Output labels on metrics describing the same underlying signal must
    # match between promforecast and promanomaly so the two can be joined
    # in PromQL without label-rewriting recording rules. CI checks both
    # repos commit the same contract file.
    #
    # Soft-fail behaviour: until promforecast lands its copy on main, the
    # upstream URL 404s. We don't want the absent sibling to block every
    # PR here, so a 404 is reported as a warning and exits clean. As soon
    # as promforecast publishes the file, this job starts enforcing the
    # diff automatically — no workflow change required.
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6

      - name: Fetch promforecast LABELS_CONTRACT.md
        id: fetch
        run: |
          set -eu
          url="https://raw.githubusercontent.com/esops-dev/promforecast/main/LABELS_CONTRACT.md"
          http=$(curl -sSLo /tmp/promforecast-LABELS_CONTRACT.md -w '%{http_code}' "$url" || true)
          if [ "$http" = "200" ]; then
            echo "available=true" >> "$GITHUB_OUTPUT"
          else
            echo "::warning::promforecast LABELS_CONTRACT.md not yet available (HTTP $http); skipping diff. Once the sibling repo lands its copy on main this check enforces automatically."
            echo "available=false" >> "$GITHUB_OUTPUT"
          fi

      - name: Diff against local copy
        if: steps.fetch.outputs.available == 'true'
        run: |
          diff -u /tmp/promforecast-LABELS_CONTRACT.md LABELS_CONTRACT.md \
            && echo "LABELS_CONTRACT.md matches promforecast"

  container:
    name: Build container image
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6

      - uses: docker/setup-buildx-action@v4

      - uses: docker/build-push-action@v7
        with:
          context: detector
          push: false
          load: true
          tags: promanomaly:ci
          cache-from: type=gha
          cache-to: type=gha,mode=max

      - name: Install Trivy
        run: |
          mkdir -p "$HOME/.local/bin"
          curl -sSfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh \
            | sh -s -- -b "$HOME/.local/bin"
          echo "$HOME/.local/bin" >> "$GITHUB_PATH"

      - name: Trivy scan
        run: |
          trivy image \
            --format table \
            --severity HIGH,CRITICAL \
            --ignore-unfixed \
            --exit-code 0 \
            promanomaly:ci