name: Quality gate

on:
  push:
    branches:
      - main
  pull_request:
    branches:
      - main
    types: [ opened, synchronize, reopened ]

jobs:
  sonar:
    name: SonarQube Analysis
    runs-on: ubuntu-latest
    permissions: write-all
    steps:
      - name: ⬇️ Checkout Code
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: 🔧 Setup Python
        uses: actions/setup-python@v4
        with:
          python-version: "3.11"

      - name: 🗄️ Cache Python dependencies
        uses: actions/cache@v3
        with:
          path: ~/.cache/pip
          key: ${{ runner.os }}-pip-${{ hashFiles('requirements.txt') }}
          restore-keys: |
            ${{ runner.os }}-pip-

      - name: Configure SSH
        uses: webfactory/ssh-agent@v0.9.0
        with:
          ssh-private-key: ${{ secrets.SSH_PRIVATE_KEY }}

      - name: Add github.com to known_hosts
        run: |
          mkdir -p ~/.ssh
          ssh-keyscan github.com >> ~/.ssh/known_hosts

      - name: 📦 Install Development Dependencies
        run: |
          python -m pip install --upgrade pip
          pip install -r requirements-dev.txt

      - name: 📦 Install Runtime Dependencies
        run: |
          pip install -r ${{ steps.prepare-requirements.outputs.PROCESSED_REQUIREMENTS_FILE }}

      - name: 📝 Code Formatting Check (Ruff)
        run: |
          echo "Checking code formatting..."
          ruff format --check ingestor/ tests/
        continue-on-error: false

      - name: 🔎 Code Linting (Ruff)
        run: |
          echo "Running linting checks..."
          ruff check ingestor/ tests/
        continue-on-error: false

      - name: 🏷️ Type Checking (mypy)
        run: |
          echo "Running type checks..."
          mypy ingestor/
        continue-on-error: true

      - name: 🔒 Security Analysis (Bandit)
        run: |
          echo "Running security analysis..."
          bandit -r ingestor/ -ll -q
        continue-on-error: true

      - name: 🧪 Run Tests with Pytest
        run: |
          pytest tests --junitxml=pytest.xml --cov=ingestor --cov-report=xml --cov-report=term

      - name: Run SonarQube Analysis
        uses: SonarSource/sonarqube-scan-action@v5
        env:
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
          SONAR_HOST_URL: ${{ secrets.SONAR_HOST_URL }}