orion/.gitea/workflows/ci.yml

# Gitea Actions CI/CD Configuration
# ==================================
# Uses GitHub Actions-compatible syntax. Requires Gitea 1.19+ with Actions enabled.
# Requires Gitea 1.19+ with Actions enabled.

name: CI

on:
  push:
    branches: [master]
  pull_request:
    branches: [master]

env:
  PYTHON_VERSION: "3.11"

jobs:
  # ---------------------------------------------------------------------------
  # Lint
  # ---------------------------------------------------------------------------
  ruff:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-python@v5
        with:
          python-version: ${{ env.PYTHON_VERSION }}

      - name: Install uv
        run: pip install uv

      - name: Install dependencies
        run: uv pip install --system -r requirements.txt -r requirements-dev.txt

      - name: Run ruff
        run: ruff check .

  # ---------------------------------------------------------------------------
  # Tests
  # ---------------------------------------------------------------------------
  pytest:
    runs-on: ubuntu-latest
    services:
      postgres:
        image: postgres:15
        env:
          POSTGRES_DB: orion_test
          POSTGRES_USER: test_user
          POSTGRES_PASSWORD: test_password
        options: >-
          --health-cmd "pg_isready -U test_user -d orion_test"
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5

    env:
      # act_runner executes jobs in Docker containers on the same network as services,
      # so use the service name (postgres) as hostname with the internal port (5432)
      TEST_DATABASE_URL: "postgresql://test_user:test_password@postgres:5432/orion_test"
      DATABASE_URL: "postgresql://test_user:test_password@postgres:5432/orion_test"

    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-python@v5
        with:
          python-version: ${{ env.PYTHON_VERSION }}

      - name: Install uv
        run: pip install uv

      - name: Install dependencies
        run: uv pip install --system -r requirements.txt -r requirements-test.txt

      - name: Run tests
        run: python -m pytest -v --tb=short

  validate:
    runs-on: ubuntu-latest
    env:
      DATABASE_URL: "postgresql://dummy:dummy@localhost:5432/dummy"

    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-python@v5
        with:
          python-version: ${{ env.PYTHON_VERSION }}

      - name: Install uv
        run: pip install uv

      - name: Install dependencies
        run: uv pip install --system -r requirements.txt

      - name: Validate architecture patterns
        run: python scripts/validate/validate_all.py --architecture

      - name: Validate security patterns
        run: python scripts/validate/validate_all.py --security

      - name: Validate performance patterns
        run: python scripts/validate/validate_all.py --performance

      - name: Validate audit patterns
        run: python scripts/validate/validate_all.py --audit

  # ---------------------------------------------------------------------------
  # Security (non-blocking)
  # ---------------------------------------------------------------------------
  dependency-scanning:
    runs-on: ubuntu-latest
    continue-on-error: true
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-python@v5
        with:
          python-version: ${{ env.PYTHON_VERSION }}

      - name: Install pip-audit
        run: pip install pip-audit

      - name: Run pip-audit
        run: pip-audit --requirement requirements.txt || true

  # ---------------------------------------------------------------------------
  # Build (docs - only on push to master)
  # ---------------------------------------------------------------------------
  docs:
    runs-on: ubuntu-latest
    if: github.event_name == 'push' && github.ref == 'refs/heads/master'
    needs: [ruff, pytest, validate]
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-python@v5
        with:
          python-version: ${{ env.PYTHON_VERSION }}

      - name: Install uv
        run: pip install uv

      - name: Install dependencies
        run: uv pip install --system -r requirements.txt -r requirements-docs.txt

      - name: Build docs
        run: mkdocs build

  # ---------------------------------------------------------------------------
  # Deploy (master-only, after lint + tests + validate pass)
  # ---------------------------------------------------------------------------
  deploy:
    runs-on: ubuntu-latest
    if: github.event_name == 'push' && github.ref == 'refs/heads/master'
    needs: [ruff, pytest, validate]
    steps:
      - name: Deploy to production
        uses: appleboy/ssh-action@v1
        with:
          host: ${{ secrets.DEPLOY_HOST }}
          username: ${{ secrets.DEPLOY_USER }}
          key: ${{ secrets.DEPLOY_SSH_KEY }}
          port: 22
          command_timeout: 10m
          script: cd ${{ secrets.DEPLOY_PATH }} && bash scripts/deploy.sh