mostovik-backend/.gitea/workflows/ci-cd.yml

name: CI/CD Pipeline

on:
  push:
    branches:
      - main
      - dev
      - "feature/**"
  pull_request:
    branches:
      - main
      - dev

env:
  PYTHON_VERSION: "3.11"

jobs:
  lint:
    name: Code Quality Checks
    runs-on: ubuntu-latest
    timeout-minutes: 15
    if: ${{ !contains(github.event.head_commit.message, '#no_lint') }}
    env:
      TG_BOT_KEY: ${{ secrets.TG_BOT_KEY }}
      TG_CHANNEL: ${{ secrets.TG_CHANNEL }}

    steps:
      - name: Checkout code
        run: |
          REPO_URL=$(echo "${GITHUB_SERVER_URL}" | sed "s|://|://oauth2:${{ gitea.token }}@|")
          BRANCH="${GITHUB_HEAD_REF:-${GITHUB_REF_NAME}}"
          git clone --depth=1 --branch="${BRANCH}" "${REPO_URL}/${GITHUB_REPOSITORY}.git" .
          git checkout "${GITHUB_SHA}"

      - name: Install Python and uv
        run: |
          set -euo pipefail
          if command -v python3.11 >/dev/null 2>&1; then
            BOOTSTRAP_PYTHON=python3.11
          elif command -v python3 >/dev/null 2>&1; then
            BOOTSTRAP_PYTHON=python3
          else
            echo "python3 is not available on the runner" >&2
            exit 1
          fi

          timeout 180s "${BOOTSTRAP_PYTHON}" -m pip install --user --break-system-packages --upgrade pip uv
          export PATH="$HOME/.local/bin:$PATH"

          if "${BOOTSTRAP_PYTHON}" -c 'import sys; raise SystemExit(0 if sys.version_info >= (3, 11) else 1)'; then
            PYTHON_BIN="${BOOTSTRAP_PYTHON}"
          else
            timeout 300s uv python install "${PYTHON_VERSION}"
            PYTHON_BIN="${PYTHON_VERSION}"
          fi

          printf 'PYTHON_BIN=%s\n' "${PYTHON_BIN}" > .ci-python-env

      - name: Create virtual environment and install dependencies
        run: |
          set -euo pipefail
          export PATH="$HOME/.local/bin:$PATH"
          . ./.ci-python-env
          uv venv --python "${PYTHON_BIN}"
          . .venv/bin/activate
          uv sync --dev --frozen

      - name: Run Ruff linting
        run: |
          set -euo pipefail
          . .venv/bin/activate
          ruff check src

      - name: Run Ruff formatting check
        run: |
          set -euo pipefail
          . .venv/bin/activate
          ruff format src --check

      - name: Telegram notify (lint failed)
        if: failure()
        continue-on-error: true
        run: |
          set -euo pipefail
          if [ -z "${TG_BOT_KEY:-}" ] || [ -z "${TG_CHANNEL:-}" ]; then
            echo "TG_BOT_KEY or TG_CHANNEL is not set; skip telegram notification"
            exit 0
          fi

          COMMIT_MESSAGE=$(git log -1 --pretty=%s 2>/dev/null || echo "n/a")

          MSG="❌ [mostovik-backend] lint failed
          branch=${GITHUB_REF_NAME}
          sha=${GITHUB_SHA}
          actor=${GITHUB_ACTOR}
          commit=${COMMIT_MESSAGE}"

          curl -fsS \
            --connect-timeout 5 \
            --max-time 15 \
            --retry 2 \
            --retry-delay 2 \
            --retry-all-errors \
            -X POST "https://api.telegram.org/bot${TG_BOT_KEY}/sendMessage" \
            -d "chat_id=${TG_CHANNEL}" \
            --data-urlencode "text=${MSG}" \
            || echo "Telegram notification failed; continue pipeline"

  test:
    name: Run Tests
    runs-on: ubuntu-latest
    timeout-minutes: 20
    if: ${{ !contains(github.event.head_commit.message, '#no_test') }}
    env:
      TG_BOT_KEY: ${{ secrets.TG_BOT_KEY }}
      TG_CHANNEL: ${{ secrets.TG_CHANNEL }}

    steps:
      - name: Checkout code
        run: |
          REPO_URL=$(echo "${GITHUB_SERVER_URL}" | sed "s|://|://oauth2:${{ gitea.token }}@|")
          BRANCH="${GITHUB_HEAD_REF:-${GITHUB_REF_NAME}}"
          git clone --depth=1 --branch="${BRANCH}" "${REPO_URL}/${GITHUB_REPOSITORY}.git" .
          git checkout "${GITHUB_SHA}"

      - name: Install Python and uv
        run: |
          set -euo pipefail
          if command -v python3.11 >/dev/null 2>&1; then
            BOOTSTRAP_PYTHON=python3.11
          elif command -v python3 >/dev/null 2>&1; then
            BOOTSTRAP_PYTHON=python3
          else
            echo "python3 is not available on the runner" >&2
            exit 1
          fi

          timeout 180s "${BOOTSTRAP_PYTHON}" -m pip install --user --break-system-packages --upgrade pip uv
          export PATH="$HOME/.local/bin:$PATH"

          if "${BOOTSTRAP_PYTHON}" -c 'import sys; raise SystemExit(0 if sys.version_info >= (3, 11) else 1)'; then
            PYTHON_BIN="${BOOTSTRAP_PYTHON}"
          else
            timeout 300s uv python install "${PYTHON_VERSION}"
            PYTHON_BIN="${PYTHON_VERSION}"
          fi

          printf 'PYTHON_BIN=%s\n' "${PYTHON_BIN}" > .ci-python-env

      - name: Create virtual environment and install dependencies
        run: |
          set -euo pipefail
          export PATH="$HOME/.local/bin:$PATH"
          . ./.ci-python-env
          uv venv --python "${PYTHON_BIN}"
          . .venv/bin/activate
          uv sync --dev --frozen

      - name: Run regular pytest suite
        env:
          DJANGO_SETTINGS_MODULE: settings.test
          SECRET_KEY: test-secret-key-for-ci
        run: |
          set -euo pipefail
          export PYTHONPATH="${PWD}/src:${PYTHONPATH:-}"
          .venv/bin/python -m pytest tests --ignore=tests/test_api_inventory_e2e.py -q

      - name: Pack prepared test workspace
        if: success()
        run: |
          set -euo pipefail
          WORKSPACE_ARCHIVE="/tmp/ci-test-workspace.tar.gz"
          tar \
            --exclude='.git' \
            --exclude='.pytest_cache' \
            --exclude='htmlcov' \
            --exclude='__pycache__' \
            -czf "${WORKSPACE_ARCHIVE}" \
            .

      - name: Upload prepared test workspace
        if: success()
        uses: actions/upload-artifact@v4
        with:
          name: ci-test-workspace
          path: /tmp/ci-test-workspace.tar.gz
          if-no-files-found: error
          retention-days: 1

      - name: Telegram notify (test failed)
        if: failure()
        continue-on-error: true
        run: |
          set -euo pipefail
          if [ -z "${TG_BOT_KEY:-}" ] || [ -z "${TG_CHANNEL:-}" ]; then
            echo "TG_BOT_KEY or TG_CHANNEL is not set; skip telegram notification"
            exit 0
          fi

          COMMIT_MESSAGE=$(git log -1 --pretty=%s 2>/dev/null || echo "n/a")

          MSG="❌ [mostovik-backend] test failed
          branch=${GITHUB_REF_NAME}
          sha=${GITHUB_SHA}
          actor=${GITHUB_ACTOR}
          commit=${COMMIT_MESSAGE}"

          curl -fsS \
            --connect-timeout 5 \
            --max-time 15 \
            --retry 2 \
            --retry-delay 2 \
            --retry-all-errors \
            -X POST "https://api.telegram.org/bot${TG_BOT_KEY}/sendMessage" \
            -d "chat_id=${TG_CHANNEL}" \
            --data-urlencode "text=${MSG}" \
            || echo "Telegram notification failed; continue pipeline"

  test_api_inventory_e2e:
    name: Run API Inventory E2E Tests
    runs-on: ubuntu-latest
    timeout-minutes: 10
    needs: [test]
    if: ${{ needs.test.result == 'success' }}
    env:
      TG_BOT_KEY: ${{ secrets.TG_BOT_KEY }}
      TG_CHANNEL: ${{ secrets.TG_CHANNEL }}

    steps:
      - name: Download prepared test workspace
        uses: actions/download-artifact@v4
        with:
          name: ci-test-workspace

      - name: Extract prepared test workspace
        run: |
          set -euo pipefail
          tar -xzf ci-test-workspace.tar.gz

      - name: Run API inventory pytest suite
        env:
          DJANGO_SETTINGS_MODULE: settings.test
          SECRET_KEY: test-secret-key-for-ci
        run: |
          set -euo pipefail
          export PYTHONPATH="${PWD}/src:${PYTHONPATH:-}"
          .venv/bin/python -m pytest tests/test_api_inventory_e2e.py -q

      - name: Telegram notify (api inventory e2e failed)
        if: failure()
        continue-on-error: true
        run: |
          set -euo pipefail
          if [ -z "${TG_BOT_KEY:-}" ] || [ -z "${TG_CHANNEL:-}" ]; then
            echo "TG_BOT_KEY or TG_CHANNEL is not set; skip telegram notification"
            exit 0
          fi

          MSG="❌ [mostovik-backend] api inventory e2e failed
          branch=${GITHUB_REF_NAME}
          sha=${GITHUB_SHA}
          actor=${GITHUB_ACTOR}"

          curl -fsS \
            --connect-timeout 5 \
            --max-time 15 \
            --retry 2 \
            --retry-delay 2 \
            --retry-all-errors \
            -X POST "https://api.telegram.org/bot${TG_BOT_KEY}/sendMessage" \
            -d "chat_id=${TG_CHANNEL}" \
            --data-urlencode "text=${MSG}" \
            || echo "Telegram notification failed; continue pipeline"

  notify_success:
    name: Telegram Notify Success
    runs-on: ubuntu-latest
    timeout-minutes: 1
    needs: [lint, test, test_api_inventory_e2e]
    if: |
      always() &&
      needs.lint.result == 'success' &&
      needs.test.result == 'success' &&
      needs.test_api_inventory_e2e.result == 'success'
    env:
      TG_BOT_KEY: ${{ secrets.TG_BOT_KEY }}
      TG_CHANNEL: ${{ secrets.TG_CHANNEL }}
    steps:
      - name: Telegram notify (lint+tests+e2e success)
        continue-on-error: true
        env:
          COMMIT_MESSAGE: ${{ github.event.head_commit.message }}
        run: |
          set -euo pipefail
          if [ -z "${TG_BOT_KEY:-}" ] || [ -z "${TG_CHANNEL:-}" ]; then
            echo "TG_BOT_KEY or TG_CHANNEL is not set; skip telegram notification"
            exit 0
          fi

          MSG="✅ [mostovik-backend] lint + tests + api inventory e2e passed
          branch=${GITHUB_REF_NAME}
          sha=${GITHUB_SHA}
          actor=${GITHUB_ACTOR}
          commit=${COMMIT_MESSAGE:-n/a}"

          curl -fsS \
            --connect-timeout 5 \
            --max-time 15 \
            --retry 2 \
            --retry-delay 2 \
            --retry-all-errors \
            -X POST "https://api.telegram.org/bot${TG_BOT_KEY}/sendMessage" \
            -d "chat_id=${TG_CHANNEL}" \
            --data-urlencode "text=${MSG}" \
            || echo "Telegram notification failed; continue pipeline"