name: Test Suite

on:
  push:
    branches: [master]
  pull_request:
    branches: [master]

jobs:
  test:
    name: Python ${{ matrix.python-version }}
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        python-version: ['3.10', '3.11', '3.12', '3.13']

    steps:
      - name: Checkout Code
        uses: actions/checkout@v4

      - name: Set up Python ${{ matrix.python-version }}
        uses: actions/setup-python@v5
        with:
          python-version: ${{ matrix.python-version }}
          cache: 'pip'
          cache-dependency-path: |
            conf/requirements.txt
            dev/requirements.txt

      # Build headers for the sdist-only bindings (libvirt-python, python-ldap)
      - name: Install System Dependencies
        run: |
          sudo apt-get update -qq
          sudo apt-get install -y --no-install-recommends \
            libvirt-dev \
            libldap2-dev \
            libsasl2-dev \
            pkg-config \
            gcc

      - name: Install Python Dependencies
        run: |
          python -m pip install --upgrade pip setuptools
          pip install -r dev/requirements.txt

      - name: Configure WebVirtCloud Settings
        run: |
          cp webvirtcloud/settings.py.template webvirtcloud/settings.py
          SECRET_KEY=$(python -c 'import secrets; print(secrets.token_urlsafe(50))')
          sed -i "s|^SECRET_KEY = .*|SECRET_KEY = \"${SECRET_KEY}\"|" webvirtcloud/settings.py

      - name: Check For Missing Migrations
        run: python manage.py makemigrations --check --dry-run

      - name: Run Django Migrations
        run: python manage.py migrate --noinput

      # Includes the vrtManager tests; fails below the coverage floor in pyproject.toml
      - name: Run Test Suite
        run: |
          coverage run manage.py test
          coverage report --skip-covered

      - name: Validate OpenAPI Schema
        run: python manage.py spectacular --validate --fail-on-warn --file /dev/null

      # Security warnings (HSTS, secure cookies) depend on the deployment;
      # gate on errors only.
      - name: Deployment Checks
        run: python manage.py check --deploy --fail-level ERROR

      - name: Audit Installed Packages
        run: pip-audit

  docker:
    name: Docker Image
    runs-on: ubuntu-latest
    steps:
      - name: Checkout Code
        uses: actions/checkout@v4

      - name: Build Image
        run: docker build -t webvirtcloud:ci .