name: CI
on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

permissions:
  contents: read

jobs:
  lint:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5
      - uses: actions/setup-python@v5
        with:
          python-version: "3.13"
      - run: pip install ruff
      - run: ruff check src/ tests/
      - run: ruff format --check src/ tests/
      - name: Verify version stamps agree across files
        # Catches the v0.5.2 release-prep mistake (debian/changelog stayed at
        # 0.5.1 while pyproject.toml / __init__.py moved to 0.5.2) before the
        # tag push. See scripts/ci/verify_versions.py for details.
        run: python scripts/ci/verify_versions.py

  test:
    runs-on: ${{ matrix.runner }}
    strategy:
      matrix:
        python-version: ["3.9", "3.10", "3.11", "3.12", "3.13", "3.14"]
        runner: ["ubuntu-latest"]
        include:
          # aarch64 regression catch — winpodx ships arch-aware code paths
          # (image picker in core/config.py, compose ARGUMENTS in
          # core/pod/compose.py, install.sh arch detection) for ARM64
          # Linux hosts per #141. The x86_64 matrix covers all 5 Python
          # versions; we keep aarch64 minimal at the latest Python only
          # so the regression check is fast + cheap. GitHub Actions
          # provides free aarch64 runners for public repos since 2024.
          - python-version: "3.14"
            runner: "ubuntu-24.04-arm"
    steps:
      - uses: actions/checkout@v5
      - uses: actions/setup-python@v5
        with:
          python-version: ${{ matrix.python-version }}
      - run: pip install -e ".[dev]"
      - run: pytest tests/ -v

  discover-apps-ps:
    # Smoke test for scripts/windows/discover_apps.ps1 — runs the script
    # under -DryRun (no Registry/AppX access) and asserts stdout parses as
    # a non-empty JSON array with the shape core.discovery expects. Catches
    # PowerShell syntax regressions before they hit the Windows guest.
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5
        with:
          # Defense in depth: the DryRun path is read-only, but we still
          # do not want the job's GITHUB_TOKEN left persisted in
          # .git/config where any subsequent step (including the pwsh
          # smoke test) could observe it.
          persist-credentials: false
      - name: Ensure PowerShell Core is available
        run: |
          if command -v pwsh >/dev/null 2>&1; then
            echo "pwsh already installed: $(pwsh --version)"
          else
            sudo apt-get update
            sudo apt-get install -y --no-install-recommends wget apt-transport-https ca-certificates
            # Official Microsoft repository for PowerShell on Ubuntu.
            source /etc/os-release
            wget -q "https://packages.microsoft.com/config/ubuntu/${VERSION_ID}/packages-microsoft-prod.deb" -O /tmp/packages-microsoft-prod.deb
            sudo dpkg -i /tmp/packages-microsoft-prod.deb
            sudo apt-get update
            sudo apt-get install -y powershell
            pwsh --version
          fi
      - name: Run discover_apps.ps1 -DryRun and validate JSON shape
        run: |
          pwsh -NoProfile -File scripts/windows/discover_apps.ps1 -DryRun > /tmp/discover.json
          python3 scripts/ci/validate_discover_dryrun.py /tmp/discover.json

  audit:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5
      - uses: actions/setup-python@v5
        with:
          python-version: "3.13"
      - run: pip install pip-audit
      # `[all]` is libvirt-free as of 0.6.0 (the libvirt backend + its
      # libvirt-python extra were dropped — #286), so it no longer needs the
      # libvirt-dev native headers and is safe to install on ubuntu-latest.
      - run: pip install -e ".[all]" || pip install -e ".[dev]"
      - run: pip-audit --desc --skip-editable
        continue-on-error: true