name: CI

on:
  pull_request:
  push:
    branches: [main]
  schedule:
    - cron: '0 3 * * 1'
  workflow_dispatch:

permissions:
  contents: read

jobs:
  security:
    runs-on: bongbetic-ci
    timeout-minutes: 15
    container:
      image: docker.io/semgrep/semgrep:1.178.0
    steps:
      - name: Checkout
        env:
          GIT_TOKEN: ${{ gitea.token }}
        run: |
          set -euo pipefail
          git init -q .
          git remote add origin "${{ gitea.server_url }}/${{ gitea.repository }}.git"
          git -c http.extraheader="Authorization: token ${GIT_TOKEN}" fetch -q --depth=1 origin "${{ gitea.sha }}"
          git checkout -q FETCH_HEAD

      - name: Semgrep
        run: semgrep scan --config p/default --config p/owasp-top-ten --metrics off --error

  lint:
    if: gitea.event_name != 'schedule'
    runs-on: bongbetic-ci
    timeout-minutes: 20
    steps:
      - name: Checkout
        env:
          GIT_TOKEN: ${{ gitea.token }}
        run: |
          set -euo pipefail
          git init -q .
          git remote add origin "${{ gitea.server_url }}/${{ gitea.repository }}.git"
          git -c http.extraheader="Authorization: token ${GIT_TOKEN}" fetch -q --depth=1 origin "${{ gitea.sha }}"
          git checkout -q FETCH_HEAD

      # node:24-bookworm ships python3 without ensurepip, so python3-venv comes from apt.
      - name: Install ruff
        run: |
          set -euo pipefail
          apt-get update -qq
          apt-get install -y -qq --no-install-recommends python3-venv
          python3 -m venv /tmp/lint-venv
          /tmp/lint-venv/bin/pip install -q ruff==0.16.10

      - name: Ruff
        run: /tmp/lint-venv/bin/ruff check src/ tests/

      - name: Duplicate code (jscpd)
        run: npx --yes jscpd@4.3.0 --config .jscpd.json .

  ai-review:
    if: gitea.event_name == 'pull_request'
    runs-on: bongbetic-ci
    timeout-minutes: 10
    continue-on-error: true
    container:
      image: docker.io/pragent/pr-agent:0.47.0
    env:
      config__git_provider: gitea
      gitea__url: https://git.bongbetic.com
      gitea__personal_access_token: ${{ secrets.PR_AGENT_GITEA_TOKEN }}
      openrouter__key: ${{ secrets.OPENROUTER_API_KEY }}
      config__model: ${{ vars.PR_AGENT_MODEL || 'openrouter/anthropic/claude-sonnet-5' }}
      config__fallback_models: "[\"${{ vars.PR_AGENT_MODEL || 'openrouter/anthropic/claude-sonnet-5' }}\"]"
      config__custom_model_max_tokens: '200000'
    steps:
      # Advisory only: posts a review comment, never pushes code. Skips when secrets are absent
      # (for example PRs from forks, where Gitea withholds secrets).
      - name: PR-Agent review
        env:
          PR_URL: ${{ gitea.event.pull_request.html_url }}
        run: |
          set -euo pipefail
          if [ -z "${gitea__personal_access_token}" ] || [ -z "${openrouter__key}" ]; then
            echo "::notice::PR_AGENT_GITEA_TOKEN or OPENROUTER_API_KEY not set; skipping AI review"
            exit 0
          fi
          cd /app
          pr-agent --pr_url="${PR_URL}" review