SeedPass/.github/workflows/python-ci.yml

name: CI

on:
  push:
    branches: [ "**" ]
  pull_request:
    branches: [ "**" ]
  schedule:
    - cron: '0 3 * * *'

jobs:
  secret-scan:
    name: Secret Scan
    runs-on: ubuntu-latest
    if: github.event_name == 'pull_request' || github.event_name == 'schedule'
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: Run gitleaks
        uses: gitleaks/gitleaks-action@v2
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          GITLEAKS_CONFIG: .gitleaks.toml

  build:
    strategy:
      matrix:
        os: [ubuntu-latest, windows-latest, macos-latest]
        python-version: ["3.11"]
        exclude:
          - os: windows-latest
            python-version: "3.11"
        include:
          - os: windows-latest
            python-version: "3.10"
    runs-on: ${{ matrix.os }}
    env:
      HYPOTHESIS_SEED: 123456
    steps:
      - uses: actions/checkout@v3
      - uses: actions/setup-python@v4
        with:
          python-version: ${{ matrix.python-version }}
      - name: Install build tools (Linux/macOS)
        if: runner.os != 'Windows'
        shell: bash
        run: |
          if [ "$RUNNER_OS" = "Linux" ]; then
            sudo apt-get update
            sudo apt-get install -y pkg-config build-essential
          else
            brew install pkg-config || brew upgrade pkg-config || true
          fi
      - name: Install MSYS2 toolchain
        if: runner.os == 'Windows'
        id: msys
        uses: msys2/setup-msys2@v2
        with:
          update: true
          install: >-
            mingw-w64-x86_64-toolchain
            base-devel
      - name: Set PKG_CONFIG_PATH
        if: runner.os == 'Windows'
        shell: bash
        run: echo "PKG_CONFIG_PATH=${{ steps.msys.outputs.msys2-location }}/mingw64/lib/pkgconfig" >> $GITHUB_ENV
      - name: Add MSYS2 tools to PATH
        if: runner.os == 'Windows'
        shell: bash
        run: echo "${{ steps.msys.outputs.msys2-location }}/mingw64/bin" >> $GITHUB_PATH
      - name: Cache pip
        uses: actions/cache@v3
        with:
          path: ~/.cache/pip
          key: ${{ runner.os }}-pip-${{ hashFiles('requirements.lock') }}
          restore-keys: |
            ${{ runner.os }}-pip-
      # Regenerating the lockfile and diffing it proves the committed file
      # really came from src/requirements.txt. It can only be done on ONE
      # interpreter: pip-compile resolves version-conditional dependencies
      # per Python version, so 3.10 and 3.11 produce genuinely different
      # files (argon2-cffi-bindings among others), and a single committed
      # lockfile cannot equal both. Run as written across this matrix the
      # check was unsatisfiable -- whichever version the lockfile was built
      # on, the other job failed. Linux/3.11 is the canonical generator, so
      # the verification lives there.
      - name: Verify the lockfile matches src/requirements.txt
        if: runner.os == 'Linux'
        run: |
          python -m pip install --upgrade pip
          pip install pip-tools
          pip-compile --generate-hashes --output-file=requirements.lock src/requirements.txt
          git diff --exit-code requirements.lock
      - name: Install dependencies
        run: |
          python -m pip install --upgrade pip
          pip install --require-hashes -r requirements.lock
      - name: Run dependency scan
        run: scripts/dependency_scan.sh --ignore-vuln GHSA-wj6h-64fc-37mp --ignore-vuln CVE-2025-62727
      - name: Determine stress args
        shell: bash
        run: |
          if [ "${{ github.event_name }}" = "schedule" ]; then
            echo "STRESS_ARGS=--stress" >> $GITHUB_ENV
          fi
      - name: Enable Nostr network tests on main branch or nightly
        if: github.ref == 'refs/heads/main' || github.event_name == 'schedule'
        run: echo "NOSTR_E2E=1" >> $GITHUB_ENV
      - name: Run deterministic regression tests
        shell: bash
        run: pytest -q src/tests/test_deterministic_artifact_regression.py
      - name: Run tests with coverage
        timeout-minutes: 16
        shell: bash
        run: scripts/run_ci_tests.sh
      - name: Run desktop tests
        timeout-minutes: 10
        shell: bash
        env:
          TOGA_BACKEND: toga_dummy
        run: scripts/run_gui_tests.sh
      - name: Upload pytest log
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: pytest-log-${{ matrix.os }}
          path: pytest.log
      - name: Upload GUI pytest log
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: gui-pytest-log-${{ matrix.os }}
          path: pytest_gui.log
      - name: Upload coverage report
        uses: actions/upload-artifact@v4
        with:
          name: coverage-xml-${{ matrix.os }}
          path: coverage.xml