name: CI

on:
  pull_request:
  push:
    branches: [main]
  schedule:
    - cron: "0 3 * * 1"
  workflow_dispatch:

permissions:
  contents: read

jobs:
  security:
    runs-on: bongbetic-ci
    timeout-minutes: 15
    container:
      image: docker.io/semgrep/semgrep:1.178.0
    steps:
      - name: Checkout
        env:
          GITEA_TOKEN: ${{ gitea.token }}
        run: |
          git init -q . && git remote add origin "${{ gitea.server_url }}/${{ gitea.repository }}.git" && git -c http.extraheader="Authorization: token ${GITEA_TOKEN}" fetch -q --depth=1 origin "${{ gitea.sha }}" && git checkout -q FETCH_HEAD
      - name: Semgrep
        run: semgrep scan --config p/default --config p/owasp-top-ten --metrics off --error

  lint:
    if: gitea.event_name != 'schedule'
    runs-on: bongbetic-ci
    timeout-minutes: 25
    steps:
      - name: Checkout
        env:
          GITEA_TOKEN: ${{ gitea.token }}
        run: |
          git init -q . && git remote add origin "${{ gitea.server_url }}/${{ gitea.repository }}.git" && git -c http.extraheader="Authorization: token ${GITEA_TOKEN}" fetch -q --depth=1 origin "${{ gitea.sha }}" && git checkout -q FETCH_HEAD

      # @@LINT_STEPS@@
      # Add your language linter steps above this line (see CI.md), or run
      # ci-tools/bin/new-repo-ci.sh with -l python|node|rust to insert them.

      - name: jscpd (duplication, threshold in .jscpd.json)
        run: npx --yes jscpd@4.3.0 --config .jscpd.json .

  ai-review:
    if: gitea.event_name == 'pull_request'
    runs-on: bongbetic-ci
    timeout-minutes: 10
    continue-on-error: true
    container:
      image: docker.io/pragent/pr-agent:0.47.0
    steps:
      - name: PR-Agent review (advisory)
        shell: sh
        env:
          CONFIG__GIT_PROVIDER: gitea
          GITEA__URL: https://git.bongbetic.com
          GITEA__PERSONAL_ACCESS_TOKEN: ${{ secrets.PR_AGENT_GITEA_TOKEN }}
          OPENROUTER__KEY: ${{ secrets.OPENROUTER_API_KEY }}
          CONFIG__MODEL: ${{ vars.PR_AGENT_MODEL || 'openrouter/anthropic/claude-sonnet-5' }}
          CONFIG__CUSTOM_MODEL_MAX_TOKENS: ${{ vars.PR_AGENT_MAX_TOKENS || '200000' }}
        run: |
          if [ -z "$OPENROUTER__KEY" ] || [ -z "$GITEA__PERSONAL_ACCESS_TOKEN" ]; then
            echo "::notice::PR-Agent skipped: OPENROUTER_API_KEY / PR_AGENT_GITEA_TOKEN not available (unset, or PR from a fork)."
            exit 0
          fi
          pr-agent --pr_url="${{ gitea.event.pull_request.html_url }}" review