ci.yml

# Verification gate. Runs the same `make verify` a contributor runs locally,
# plus the scanners. Every action is pinned to a full commit SHA with the tag
# it corresponded to in a trailing comment.
name: ci

on:
  push:
    branches: [main]
  pull_request:
  schedule:
    # Weekly, so the scanners keep running against a repository that is not
    # being actively changed.
    - cron: "17 6 * * 1"

permissions:
  contents: read

concurrency:
  group: ci-${{ github.ref }}
  cancel-in-progress: true

env:
  UV_VERSION: "0.12.1"

jobs:
  verify:
    name: Lint, type check and test
    runs-on: ubuntu-latest
    permissions:
      contents: read
    strategy:
      fail-fast: false
      matrix:
        python-version: ["3.12", "3.13"]
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
        with:
          version: ${{ env.UV_VERSION }}
          python-version: ${{ matrix.python-version }}
          enable-cache: true

      - name: Install the locked dependency set
        run: uv sync --locked

      - name: Lint
        run: |
          uv run ruff check .
          uv run ruff format --check .

      - name: Type check
        run: uv run mypy

      - name: Test
        # The real published PDFs are not committed, so the realdoc tests skip
        # here. The synthetic fixtures exercise the full parser offline.
        run: uv run pytest

      - name: Confirm the parser refuses to emit an uncited value
        run: |
          uv run ca-tariff-parse parse \
            tests/fixtures/SYNTHETIC-example-schedule-complete.txt \
            --min-coverage 1.0 > /dev/null

      - name: Confirm a document profile is required rather than assumed
        # The same fixture read with and without a profile. With one it parses
        # in part; with none the outline, the bracket notation and the
        # supersession header are all refused and coverage falls.
        run: |
          set -euo pipefail
          fixture=tests/fixtures/SYNTHETIC-example-keyword-schedule.txt
          uv run ca-tariff-parse parse "$fixture" \
            --profile pge-tariff-book --min-coverage 0.4 > /dev/null
          if uv run ca-tariff-parse parse "$fixture" \
               --min-coverage 0.4 > /dev/null; then
            echo "a document with no profile should not have reached that coverage"
            exit 1
          fi

  scan:
    name: Secret, static and dependency scanning
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
          persist-credentials: false

      - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
        with:
          version: ${{ env.UV_VERSION }}
          python-version: "3.12"
          enable-cache: false

      - name: Secret scan
        uses: gitleaks/gitleaks-action@e0c47f4f8be36e29cdc102c57e68cb5cbf0e8d1e # v3.0.0
        env:
          GITHUB_TOKEN: ${{ github.token }}

      - name: Static analysis
        run: uv run --with 'bandit[toml]==1.8.6' bandit -r src -c pyproject.toml

      - name: Dependency audit
        run: |
          set -euo pipefail
          # Write with -o rather than a shell redirect: uv colourises stdout,
          # and the escape codes make the file unparseable to pip-audit.
          uv export --locked --format requirements-txt --no-emit-project \
            -o requirements.audit.txt
          uv run --with 'pip-audit==2.9.0' pip-audit --strict -r requirements.audit.txt