ci.yml

# CI/CD Pipeline
# Runs tests, linting, type checking, and security scans.
#
# Features:
#   - Standard quality checks (tests, linting, type checking)
#   - Security scanning (Bandit, Safety)
#   - Optional SonarCloud/Codecov integration
name: CI

on:
  push:
    branches: [main, master, develop]
  pull_request:
    types: [opened, synchronize, reopened]
    branches: [main, master, develop]
  workflow_dispatch:

# Cancel in-progress runs for same PR/branch
concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true

permissions:
  contents: read
  pull-requests: write
  checks: write

# Uses org-level reusable workflow
jobs:
  ci:
    name: CI Pipeline
    uses: ByronWilliamsCPA/.github/.github/workflows/python-ci.yml@main
    with:
      no-build: false  # hatchling build backend: editable install must build
      python-version: '3.12'
      coverage-threshold: 80
      source-directory: 'src'
      test-directory: 'tests'
      run-integration-tests: true
      run-security-tests: true
      fail-on-llm-tags: false

  ci-gate:
    name: CI Gate
    runs-on: ubuntu-latest
    needs: [ci]
    if: always()
    steps:
      - name: Harden the runner
        uses: step-security/harden-runner@91182cccc01eb5e619899d80e4e971d6181294a7 # v2.10.1
        with:
          egress-policy: audit

      - name: Check CI results
        run: |
          if [ "${{ needs.ci.result }}" != "success" ]; then
            echo "CI Gate failed"
            exit 1
          fi
          echo "CI Gate passed"