python-ci.yml

name: Python CI

on:
  push:
    branches:
      - "**"
  pull_request:
    branches:
      - "**"
  workflow_dispatch:

# Least privilege by default.
permissions:
  contents: read

concurrency:
  group: python-ci-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  test:
    name: Python ${{ matrix.python-version }}
    runs-on: ubuntu-latest

    strategy:
      fail-fast: false
      matrix:
        python-version:
          - "3.12"
          - "3.13"

    steps:
      - name: Checkout repository
        uses: actions/checkout@v5

      - name: Set up Python
        uses: actions/setup-python@v6
        with:
          python-version: ${{ matrix.python-version }}
          cache: pip
          cache-dependency-path: |
            requirements.txt

      - name: Configure Python path
        shell: bash
        run: |
          echo "PYTHONPATH=$PWD:$PWD/src:$PWD/services:$PWD/services/guardian" >> "$GITHUB_ENV"

      - name: Upgrade pip
        run: python -m pip install --upgrade pip

      - name: Install project dependencies
        shell: bash
        run: |
          if [ -f requirements.txt ]; then
            python -m pip install -r requirements.txt
          fi

          python -m pip install pytest pytest-cov

      - name: Compile check
        run: |
          python -m compileall -q services src

      - name: Run tests
        run: |
          python -m pytest -v \
            --cov=services.guardian \
            --cov-config=.coveragerc \
            --cov-report=term-missing \
            --cov-report=xml \
            --cov-fail-under=0

      # Initial visibility baseline.
      # Advisory only until the repository's measured baseline is confirmed.
      - name: Coverage advisory floor
        if: matrix.python-version == '3.12'
        continue-on-error: true
        run: |
          coverage report --fail-under=60