ci.yml

name: ci

on:
  push:
    branches: [main]
  pull_request:

permissions:
  contents: read

concurrency:
  group: ci-${{ github.ref }}
  cancel-in-progress: true

jobs:
  # Fast, single-version gate: lint, types, security, accessibility, container.
  verify:
    runs-on: ubuntu-latest
    steps:
      # 0. egress monitoring (SEC-04). AUDIT mode: logs, does not block yet — this
      #    repo's actual outbound needs (pypi.org, files.pythonhosted.org, npm for
      #    pa11y, Docker Hub for the base image, github.com) haven't been collected
      #    from a real run yet. Flip to `egress-policy: block` with an explicit
      #    allowlist once one audit-mode run's log has been reviewed — see
      #    docs/GAP-LEDGER.md#gap-sec-1--security--supply-chain-harden-runner-block-mode-codeql-lockfileosv-scanner-trufflehog-sbomsigning-scorecard.
      - uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411  # v2.19.4
        with:
          egress-policy: audit
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
        with:
          persist-credentials: false
          # gitleaks-action scans commit ranges (HEAD^..HEAD on PRs), which a shallow
          # clone cannot resolve — full history is required for the blocking scan.
          fetch-depth: 0
      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065  # v5
        with:
          python-version: "3.12"
      - uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990  # v8.3.2
        with:
          version: "0.11.28"
          enable-cache: true
          cache-dependency-glob: uv.lock

      - name: Install
        run: uv sync --locked --group dev --python 3.12

      # 1. format + lint — via the Makefile so CI runs literally the same command
      #    as `make lint` (CICD-27: no more local/CI drift on this gate).
      - name: Lint & format
        run: make lint

      # 2. type-check (strict) — via `make type` (same parity rationale).
      - name: Type-check
        run: make type

      # 2b. i18n N/A-declaration gate — `make verify` runs this locally; CI was
      #     silently skipping it until now (CICD-27 / I18N-02 CI-wiring gap).
      - name: i18n declaration gate
        run: make i18n

      # 3b. EXP-06 tagged PDF/A export: the optional `pdf` extra needs a >=3.10 host
      #     (this job already runs 3.12) plus WeasyPrint's native text/image-rendering
      #     libraries (Pango, HarfBuzz, GDK-Pixbuf — not a PyPI package, see
      #     docs/adr/0003-weasyprint-for-tagged-pdf-a-export.md). Structural-only gate
      #     (tests/test_pdf_export.py); does not and cannot verify PDF/UA conformance
      #     — see that ADR and docs/GAP-LEDGER.md#gap-a11y-2 for the human gate that
      #     stays open regardless of this test passing.
      - name: Install WeasyPrint's native libraries
        run: |
          sudo apt-get update
          sudo apt-get install -y --no-install-recommends libpango-1.0-0 libpangoft2-1.0-0 libharfbuzz0b libgdk-pixbuf2.0-0
      - name: Install pdf extra
        run: uv sync --locked --group dev --extra pdf --python 3.12
      - name: Tagged PDF/A structural tests
        run: .venv/bin/pytest tests/test_pdf_export.py -q

      # 4. security: SAST + deps + secrets. Kept as discrete steps (rather than
      #    `make security`) because that target's gitleaks check expects a CLI
      #    binary on PATH, whereas gitleaks-action below runs it as a container
      #    action; see docs/RESPONSIBLE-TECH-AUDITS.md §F and the README
      #    Standards Conformance table for the exact local/CI parity statement.
      - name: SAST (bandit)
        run: .venv/bin/bandit -q -r monitor store report
      - name: Dependency audit
        run: .venv/bin/pip-audit
      - name: Secret scan (gitleaks)
        uses: gitleaks/gitleaks-action@ff98106e4c7b2bc287b24eaf42907196329070c7  # v2
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          GITLEAKS_ENABLE_UPLOAD_ARTIFACT: "false"

      # 5. accessibility: structural gate is in pytest; add axe + htmlcs via pa11y on
      #    the report. axe's color-contrast rule is excluded here because axe cannot
      #    resolve the background of SVG <text> and returns every chart label as
      #    "needs further review", which pa11y hard-fails (51 false positives on this
      #    report). SVG text contrast is NOT unchecked: tests/test_svg_contrast.py
      #    computes the exact WCAG ratios for every renderer color pair and is
      #    merge-blocking; htmlcs below keeps computed HTML color-contrast blocking.
      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020  # v4
        with:
          node-version: "20"
      - name: Render report & run pa11y (htmlcs + axe)
        run: |
          .venv/bin/python scripts/demo_report.py
          printf '%s\n' '{"chromeLaunchConfig":{"args":["--no-sandbox"]}}' > /tmp/pa11y-ci.json
          npx --yes pa11y --runner htmlcs --runner axe --ignore color-contrast \
            --config /tmp/pa11y-ci.json ./report.html

      # 5b. accessibility (PWA UI): axe pass against the browser edition's page.
      #     Unlike the report step above, plain axe (color-contrast included) is right
      #     here: this is real HTML, so axe can compute every background. Chrome needs
      #     --no-sandbox on hosted runners.
      - name: Run pa11y (axe) on the PWA UI
        run: |
          printf '%s\n' '{"chromeLaunchConfig":{"args":["--no-sandbox"]}}' > /tmp/pa11y-pwa.json
          npx --yes pa11y --runner axe --config /tmp/pa11y-pwa.json ./pwa/index.html

      # 6b. PWA variant: detector/report ports tested with Node's test runner
      - name: PWA tests
        run: make pwa-test

      # 8. portability: the container builds and its bring-up runs from scratch
      - name: Build container & smoke test
        run: |
          docker build -t olive .
          docker run --rm olive --help

      # 8b. container CVE scan (SEC-28, Tier-1 red until now; feeds REL-18).
      - name: Container CVE scan (Trivy)
        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25  # v0.36.0
        with:
          image-ref: "olive"
          severity: "CRITICAL,HIGH"
          exit-code: "1"
          ignore-unfixed: true

      # 7. responsible-tech checks are the no-audio / no-egress / report-content tests,
      #    run in the matrix test job below (merge-blocking).

  # Compatibility matrix: tests + coverage across supported Python versions.
  # macOS legs (10x minutes, CI-CD-STANDARD §11b) moved to the nightly schedule
  # in nightly.yml; the ruleset-required macos contexts are satisfied by the
  # always-green twin job below (§11h pattern) so PRs stay mergeable. The
  # 2026-07-08 trim broke mergeability precisely because it lacked that twin.
  test-matrix:
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest]
        python-version: ["3.9", "3.10", "3.11", "3.12", "3.13"]
    runs-on: ${{ matrix.os }}
    steps:
      # 0. egress monitoring (SEC-04), audit mode — see the `verify` job's identical
      #    step above for why this isn't block mode yet.
      - uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411  # v2.19.4
        with:
          egress-policy: audit
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
        with:
          persist-credentials: false
      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065  # v5
        with:
          python-version: ${{ matrix.python-version }}
      - uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990  # v8.3.2
        with:
          version: "0.11.28"
          enable-cache: true
          cache-dependency-glob: uv.lock
      - name: Install
        run: uv sync --locked --group dev --python "${{ matrix.python-version }}"
      - name: Tests & coverage
        run: .venv/bin/pytest --cov --cov-report=term-missing --cov-fail-under=85

  # §11h twin for the ruleset-required macOS contexts: the branch ruleset requires
  # all five "test-matrix (macos-latest, X)" checks, so removing the macOS legs
  # outright would leave every PR stuck "Expected — waiting". This job reports the
  # same context names green in seconds on an ubuntu runner; the REAL macOS test
  # sweep runs nightly in nightly.yml (§11b: macos-* is 10x minutes, forbidden on
  # per-push/PR CI). NOTE: nightly macOS failures do not block merges — if macOS
  # coverage should be merge-blocking again, drop these five contexts from the
  # ruleset's required checks and delete this job in the same motion.
  test-matrix-macos-nightly-notice:
    name: test-matrix (${{ matrix.os }}, ${{ matrix.python-version }})
    strategy:
      matrix:
        os: [macos-latest]
        python-version: ["3.9", "3.10", "3.11", "3.12", "3.13"]
    runs-on: ubuntu-latest
    steps:
      - run: echo "macOS legs run on the nightly schedule (nightly.yml) per CI-CD-STANDARD §11b"