# Python lint runs on every push/PR (linux-build runner) and blocks the PR.
#
# PSScriptAnalyzer (pssa) runs on the Windows runner (windows-build) on-demand
# only — triggered via workflow_dispatch — because the .ps1/.psm1 targets are
# Windows-native (PS 5.1). It is intentionally NOT queued on push/PR so it does
# not block the pipeline when no Windows runner is registered (dual-boot Passo 9
# may be down). This keeps the Linux host/runner free of pwsh (Phase C goal).
# Requires PSScriptAnalyzer installed on the Windows runner host:
#   Install-Module PSScriptAnalyzer -Scope AllUsers -Force
# Fix warnings with:
#   Invoke-ScriptAnalyzer -Path scripts\ -Recurse -Fix


name: Lint

on:
  workflow_dispatch:
  push:
    paths:
      - '**.ps1'
      - '**.psm1'
      - '**.py'
      - 'pyproject.toml'
      - '.gitea/workflows/lint.yml'
  pull_request:
    paths:
      - '**.ps1'
      - '**.psm1'
      - '**.py'
      - 'pyproject.toml'
      - '.gitea/workflows/lint.yml'

jobs:
  pssa:
    # On-demand only: runs on the Windows runner (PS 5.1), never on push/PR,
    # so it cannot block the pipeline when no Windows runner is registered.
    if: ${{ github.event_name == 'workflow_dispatch' }}
    runs-on: windows-build
    timeout-minutes: 10

    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 1

      - name: Run PSScriptAnalyzer
        shell: powershell
        run: |
          $ErrorActionPreference = 'Stop'

          if (-not (Get-Module -ListAvailable PSScriptAnalyzer)) {
            Write-Host "Installing PSScriptAnalyzer..."
            Install-Module PSScriptAnalyzer -Scope CurrentUser -Force -AllowClobber
          }

          $settings = Join-Path $PWD 'PSScriptAnalyzerSettings.psd1'
          $paths = @('scripts', 'template', 'Setup-Host.ps1')
          $results = $paths | ForEach-Object {
            if (Test-Path $_) {
              Invoke-ScriptAnalyzer -Path $_ -Recurse -Settings $settings -Severity Error,Warning
            }
          }

          if ($results) {
            $results | Format-Table -AutoSize
            Write-Error "PSScriptAnalyzer found $($results.Count) issue(s). Fix before merging."
            exit 1
          }
          else {
            Write-Host "PSScriptAnalyzer: no issues found."
          }

  python:
    runs-on: linux-build
    timeout-minutes: 20

    env:
      PYTHONIOENCODING: utf-8
      VENV_DIR: ${{ github.workspace }}/.venv-lint

    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 1

      - name: Setup venv + install package
        shell: bash
        run: |
          set -euo pipefail
          rm -rf "$VENV_DIR"
          python3 -m venv "$VENV_DIR"
          "$VENV_DIR/bin/python" -m pip install --upgrade pip
          "$VENV_DIR/bin/python" -m pip install -e ".[dev]"

      - name: ruff
        shell: bash
        run: |
          "$VENV_DIR/bin/python" -m ruff check src tests/python

      - name: mypy --strict
        shell: bash
        run: |
          "$VENV_DIR/bin/python" -m mypy --strict src

      - name: pytest (coverage >= 90%)
        shell: bash
        run: |
          "$VENV_DIR/bin/python" -m pytest tests/python --cov=ci_orchestrator --cov-fail-under=90