ci.yml

name: CI

on:
  pull_request:
  push:
    branches: [main]

concurrency:
  group: "${{ github.workflow }}-${{ github.ref }}"
  cancel-in-progress: true

permissions:
  contents: read

jobs:
  python-matrix:
    name: Python ${{ matrix.python-version }}
    runs-on: ubuntu-latest
    timeout-minutes: 15
    strategy:
      fail-fast: false
      matrix:
        python-version: ["3.12", "3.14"]
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
        with:
          python-version: ${{ matrix.python-version }}
          cache: pipenv
      - run: python -m pip install --disable-pip-version-check pipenv==2024.4.0
      - run: pipenv verify
      - run: pipenv sync --dev --python "${{ matrix.python-version }}"
      - name: Lint maintained modules
        run: make lint
      - name: Check formatting
        run: make format-check
      - name: Type-check new domain boundaries
        run: make typecheck
      - name: Test full suite with focused coverage ratchet
        run: make test

  configuration:
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
      - name: Validate Compose configuration
        env:
          ALGOD_TOKEN: ci-placeholder
        run: |
          cp .env.example .env
          docker compose config --quiet
      - name: Build production image
        run: docker compose build app
      - name: Smoke-test production runtime
        run: |
          docker compose run --rm --no-deps --entrypoint sh app -c '
            set -eu
            ! command -v node
            ! command -v npm
            ! command -v git
            ! command -v curl
            ! command -v pipenv
            test "$(id -u)" -eq 10001
            test -x /app/scripts/run.sh
            test ! -e /app/js
            ! find /app -type f \( -name ".env" -o -name ".env.*" -o -name ".npmrc" -o -name ".DS_Store" -o -name "arweave_key.json" \) -print -quit | grep -q .
            python -c "import algosdk, fastapi, httpx, nacl, pymongo, uvicorn"
            python -c "import asyncio, os; from algosdk import account, mnemonic; private_key, _ = account.generate_account(); os.environ[\"ALGO_MNEMONIC\"] = mnemonic.from_private_key(private_key); import app; assert asyncio.run(app.status())[\"version\"] == app.VERSION"
            python -m pip check
          '
      - name: Scan production image
        run: |
          docker run --rm \
            -v /var/run/docker.sock:/var/run/docker.sock \
            aquasec/trivy@sha256:cffe3f5161a47a6823fbd23d985795b3ed72a4c806da4c4df16266c02accdd6f \
            image \
            --no-progress \
            --scanners vuln,secret \
            --severity HIGH,CRITICAL \
            --exit-code 1 \
            "cometa-backend:${COMETA_IMAGE_TAG:-local}"

  secret-scan:
    name: Secret history
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          fetch-depth: 0
      - name: Fetch every published ref
        run: git fetch --force --prune origin '+refs/heads/*:refs/remotes/origin/*' '+refs/tags/*:refs/tags/*'
      - name: Scan reachable Git history
        run: |
          docker run --rm \
            -v "$PWD:/repo" \
            ghcr.io/trufflesecurity/trufflehog@sha256:59b244249d1a1aef4baa24fe73d3c931616264482580d806d77f6c74d26b3e42 \
            git file:///repo \
            --results=verified,unknown \
            --fail \
            --fail-on-scan-errors \
            --no-update \
            --github-actions

  mongo-integration:
    name: MongoDB financial invariants
    runs-on: ubuntu-latest
    timeout-minutes: 10
    services:
      mongodb:
        image: mongo:7.0.28@sha256:4510cf3d7050003e958745adb25d2deb3fb907430716162d9cc1a92eda2a6047
        ports:
          - 27017:27017
        options: >-
          --health-cmd "mongosh --quiet --eval 'quit(db.adminCommand(\"ping\").ok ? 0 : 2)'"
          --health-interval 5s
          --health-timeout 5s
          --health-retries 20
    env:
      MONGODB_TEST_URI: mongodb://127.0.0.1:27017
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
        with:
          python-version: "3.12"
          cache: pipenv
      - run: python -m pip install --disable-pip-version-check pipenv==2024.4.0
      - run: pipenv sync --dev --python "3.12"
      - name: Test financial repositories against MongoDB
        run: pipenv run pytest tests/integration -m integration -v

  python:
    name: python
    if: ${{ always() }}
    needs:
      - python-matrix
      - configuration
      - mongo-integration
      - secret-scan
    runs-on: ubuntu-latest
    timeout-minutes: 2
    steps:
      - name: Require Python and MongoDB checks
        env:
          MATRIX_RESULT: ${{ needs.python-matrix.result }}
          CONFIGURATION_RESULT: ${{ needs.configuration.result }}
          MONGO_RESULT: ${{ needs.mongo-integration.result }}
          SECRET_SCAN_RESULT: ${{ needs.secret-scan.result }}
        run: |
          test "$MATRIX_RESULT" = "success"
          test "$CONFIGURATION_RESULT" = "success"
          test "$MONGO_RESULT" = "success"
          test "$SECRET_SCAN_RESULT" = "success"