name: Tests

on:
  push:
    branches: ["**"]
    paths:
      # The Python implementation and everything that pins its environment.
      # It is the reference implementation the TypeScript port is validated
      # against, so it still has to be tested — but a docs edit or a change
      # under js/ has no business firing 9 jobs.
      - "src/**"
      - "scripts/**"
      - "pyproject.toml"
      - "poetry.lock"
      - "requirements.lock"
      - "conftest.py"
      - ".github/workflows/tests.yml"
  pull_request:
    branches: ["**"]
    paths:
      # The Python implementation and everything that pins its environment.
      # It is the reference implementation the TypeScript port is validated
      # against, so it still has to be tested — but a docs edit or a change
      # under js/ has no business firing 9 jobs.
      - "src/**"
      - "scripts/**"
      - "pyproject.toml"
      - "poetry.lock"
      - "requirements.lock"
      - "conftest.py"
      - ".github/workflows/tests.yml"

jobs:
  test:
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, macos-latest, windows-latest]
        python-version: ["3.10", "3.11", "3.12"]
    runs-on: ${{ matrix.os }}
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: ${{ matrix.python-version }}
          cache: pip
      - name: Install Poetry
        run: pipx install poetry
      - name: Install dependencies
        run: poetry install --no-interaction --no-ansi
      - name: Check formatting
        run: poetry run black --check .
      - name: Run security audit
        run: |
          poetry run pip-audit || echo "::warning::pip-audit found vulnerabilities"
        shell: bash
      - name: TUI v2 check smoke
        run: poetry run seedpass tui2 --check
      - name: Run deterministic regression tests
        run: poetry run pytest -q src/tests/test_deterministic_artifact_regression.py
      - name: Run tests with coverage
        # `shell: bash` is load-bearing, not tidiness. Without it Windows runs
        # this block under pwsh, where only the LAST command decides whether
        # the step failed -- so `coverage xml` succeeding hid pytest failing,
        # and this job reported success on Windows while reading
        # "2 failed, 1114 passed". A check that cannot go red is worse than no
        # check, because it is trusted.
        shell: bash
        run: |
          poetry run coverage run -m pytest
          poetry run coverage xml
      - name: Upload coverage report
        uses: actions/upload-artifact@v4
        with:
          name: coverage-${{ matrix.os }}-py${{ matrix.python-version }}
          path: coverage.xml