name: Django CI

on:
  push:
    branches: [main, develop]
  pull_request:
    branches: [main, develop]

env:
  DJANGO_SETTINGS_MODULE: config.settings.development
  SECRET_KEY: test-secret-key-for-ci-only
  BASE_URL: http://localhost:8000
  SITE_NAME: Project Management CI
  GOOGLE_CLIENT_ID: ""
  GOOGLE_CLIENT_SECRET: ""
  GOOGLE_REDIRECT_URI: http://localhost:8000/api/auth/google/callback/

jobs:
  lint:
    name: Lint & Format
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v4

      - name: Install uv
        uses: astral-sh/setup-uv@v4
        with:
          enable-cache: true

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: "3.13"

      - name: Install dependencies
        run: uv sync --group dev

      - name: Ruff lint check
        run: uv run ruff check .

      - name: Ruff format check
        run: uv run ruff format --check .

  test:
    name: Django Tests
    runs-on: ubuntu-latest
    needs: lint

    steps:
      - uses: actions/checkout@v4

      - name: Install uv
        uses: astral-sh/setup-uv@v4
        with:
          enable-cache: true

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: "3.13"

      - name: Install dependencies
        run: uv sync

      - name: Django system check
        run: uv run python manage.py check

      - name: Check for pending migrations
        run: uv run python manage.py makemigrations --check --dry-run

      - name: Run tests
        run: uv run python manage.py test --verbosity=2

  security:
    name: Security Check
    runs-on: ubuntu-latest
    needs: test

    steps:
      - uses: actions/checkout@v4

      - name: Install uv
        uses: astral-sh/setup-uv@v4
        with:
          enable-cache: true

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: "3.13"

      - name: Install dependencies
        run: uv sync

      - name: Django deploy security check
        env:
          DJANGO_SETTINGS_MODULE: config.settings.production
          SECRET_KEY: test-secret-key-for-ci-only
          BASE_URL: https://example.com
          SITE_NAME: Project Management
          GOOGLE_CLIENT_ID: ""
          GOOGLE_CLIENT_SECRET: ""
          GOOGLE_REDIRECT_URI: https://example.com/api/auth/google/callback/
        run: uv run python manage.py check --deploy --fail-level WARNING 2>&1 | grep -v "security.W" || true