SeedPass/.github/workflows/python-ci.yml

name: CI

on:
  push:
    branches: [ "**" ]
  pull_request:
    branches: [ "**" ]
  schedule:
    - cron: '0 3 * * *'

jobs:
  # Regenerating the lockfile and diffing it proves the committed file really
  # came from src/requirements.txt. It has to happen on ONE interpreter, and
  # specifically on LOCK_PYTHON below, so it cannot ride the build matrix.
  #
  # pip-compile resolves version-conditional dependencies for the interpreter
  # it runs on, and the result carries no markers. Python 3.10 needs
  # async-timeout (aiohttp requires it below 3.11) and 3.11 does not, so the
  # two resolutions are genuinely different files -- 135 lines apart,
  # argon2-cffi-bindings among them. One committed lockfile cannot equal both.
  #
  # Compiling on the LOWEST supported version is what makes a single lockfile
  # work everywhere: 3.10's resolution is a superset, and it installs cleanly
  # under --require-hashes on 3.11. The reverse does not -- a 3.11 lockfile
  # is missing async-timeout, so on 3.10 pip tries to fetch it unpinned and
  # --require-hashes refuses. Both halves of that were failing here: the diff
  # could never match on one platform, and the install could never succeed on
  # the other.
  lockfile:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          # Must equal the minimum in pyproject's `python = ">=3.10,<3.13"`.
          # Raising that floor means regenerating requirements.lock here.
          python-version: "3.10"
      - name: Verify the lockfile matches src/requirements.txt
        run: |
          python -m pip install --upgrade pip
          pip install pip-tools
          pip-compile --generate-hashes --output-file=requirements.lock src/requirements.txt
          git diff --exit-code requirements.lock

  secret-scan:
    name: Secret Scan
    runs-on: ubuntu-latest
    if: github.event_name == 'pull_request' || github.event_name == 'schedule'
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: Run gitleaks
        uses: gitleaks/gitleaks-action@v2
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          GITLEAKS_CONFIG: .gitleaks.toml

  build:
    strategy:
      matrix:
        os: [ubuntu-latest, windows-latest, macos-latest]
        python-version: ["3.11"]
        exclude:
          - os: windows-latest
            python-version: "3.11"
        include:
          - os: windows-latest
            python-version: "3.10"
    runs-on: ${{ matrix.os }}
    env:
      HYPOTHESIS_SEED: 123456
    steps:
      - uses: actions/checkout@v3
      - uses: actions/setup-python@v4
        with:
          python-version: ${{ matrix.python-version }}
      - name: Install build tools (Linux/macOS)
        if: runner.os != 'Windows'
        shell: bash
        run: |
          if [ "$RUNNER_OS" = "Linux" ]; then
            sudo apt-get update
            sudo apt-get install -y pkg-config build-essential
          else
            brew install pkg-config || brew upgrade pkg-config || true
          fi
      - name: Install MSYS2 toolchain
        if: runner.os == 'Windows'
        id: msys
        uses: msys2/setup-msys2@v2
        with:
          update: true
          install: >-
            mingw-w64-x86_64-toolchain
            base-devel
      - name: Set PKG_CONFIG_PATH
        if: runner.os == 'Windows'
        shell: bash
        run: echo "PKG_CONFIG_PATH=${{ steps.msys.outputs.msys2-location }}/mingw64/lib/pkgconfig" >> $GITHUB_ENV
      - name: Add MSYS2 tools to PATH
        if: runner.os == 'Windows'
        shell: bash
        run: echo "${{ steps.msys.outputs.msys2-location }}/mingw64/bin" >> $GITHUB_PATH
      - name: Cache pip
        uses: actions/cache@v3
        with:
          path: ~/.cache/pip
          key: ${{ runner.os }}-pip-${{ hashFiles('requirements.lock') }}
          restore-keys: |
            ${{ runner.os }}-pip-
      - name: Install dependencies
        run: |
          python -m pip install --upgrade pip
          pip install --require-hashes -r requirements.lock
      - name: Run dependency scan
        run: scripts/dependency_scan.sh --ignore-vuln GHSA-wj6h-64fc-37mp --ignore-vuln CVE-2025-62727
      - name: Determine stress args
        shell: bash
        run: |
          if [ "${{ github.event_name }}" = "schedule" ]; then
            echo "STRESS_ARGS=--stress" >> $GITHUB_ENV
          fi
      - name: Enable Nostr network tests on main branch or nightly
        if: github.ref == 'refs/heads/main' || github.event_name == 'schedule'
        run: echo "NOSTR_E2E=1" >> $GITHUB_ENV
      - name: Run deterministic regression tests
        shell: bash
        run: pytest -q src/tests/test_deterministic_artifact_regression.py
      - name: Run tests with coverage
        timeout-minutes: 16
        shell: bash
        run: scripts/run_ci_tests.sh
      - name: Run desktop tests
        timeout-minutes: 10
        shell: bash
        env:
          TOGA_BACKEND: toga_dummy
        run: scripts/run_gui_tests.sh
      - name: Upload pytest log
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: pytest-log-${{ matrix.os }}
          path: pytest.log
      - name: Upload GUI pytest log
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: gui-pytest-log-${{ matrix.os }}
          path: pytest_gui.log
      - name: Upload coverage report
        uses: actions/upload-artifact@v4
        with:
          name: coverage-xml-${{ matrix.os }}
          path: coverage.xml