ci.yml

name: CI

on:
  pull_request:
  # main ya ejecuta esta CI desde bot.yml (workflow_call); evita correrla dos veces.
  push:
    branches-ignore: [main]
  schedule:
    - cron: '21 5 * * 1'
  workflow_call:
    inputs:
      skip_audit:
        description: No bloquear la publicacion del bot por un CVE nuevo en dependencias
        type: boolean
        default: false

permissions: {}

env:
  PYTHON_DOTENV_DISABLED: '1'
  PYTHONDONTWRITEBYTECODE: '1'

jobs:
  tests:
    runs-on: ubuntu-latest
    timeout-minutes: 15
    permissions:
      contents: read
    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
      - name: Setup Python
        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
        with:
          python-version: '3.11'
      - name: Setup Node
        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
        with:
          node-version: '22'
          package-manager-cache: false
      - name: Install runtime dependencies
        run: 'python -m pip install --require-hashes --only-binary=:all: -r requirements.txt'
      - name: Install test and audit tools
        run: python -m pip install -r requirements-dev.txt
      - name: Isolated Python tests
        run: python -B tools/run_tests.py
      - name: Worker tests
        run: node --test api/webhook.test.mjs
      - name: Python coverage by module
        run: python -m coverage run tools/run_tests.py
      - name: Coverage report
        run: python -m coverage report

  dependencies:
    # Sigue corriendo en PRs, ramas y el cron semanal; el bot no queda bloqueado.
    if: ${{ inputs.skip_audit != true }}
    runs-on: ubuntu-latest
    timeout-minutes: 15
    permissions:
      contents: read
    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
      - name: Setup Python
        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
        with:
          python-version: '3.11'
      - name: Install audit tools
        run: python -m pip install -r requirements-dev.txt
      - name: Audit runtime including transitive dependencies
        run: python -m pip_audit --strict --require-hashes -r requirements.txt --progress-spinner off
      - name: Audit development dependencies
        run: python -m pip_audit --strict -r requirements-dev.txt --progress-spinner off