code-quality.yml

# GitHub Actions workflow for code quality enforcement
# Runs on every push and pull request
# Uses self-hosted runner to avoid GitHub Actions quota limits

name: Code Quality

on:
  push:
    branches: [ main, Dev_new_gui, develop ]
  pull_request:
    branches: [ main, Dev_new_gui, develop ]

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true


permissions:
  contents: read

jobs:
  code-quality:
    runs-on: self-hosted

    steps:
    - name: Checkout code
      uses: actions/checkout@v6

    - name: Install Python 3.12 via deadsnakes PPA
      run: |
        if ! command -v python3.12 &> /dev/null; then
          sudo add-apt-repository -y ppa:deadsnakes/ppa
          sudo apt-get update -y
          sudo apt-get install -y python3.12 python3.12-venv python3.12-dev
        fi

    - name: Set up Python virtual environment
      run: |
        rm -rf .venv 2>/dev/null || true
        python3.12 -m venv .venv
        source .venv/bin/activate
        echo "VIRTUAL_ENV=$VIRTUAL_ENV" >> $GITHUB_ENV
        echo "$VIRTUAL_ENV/bin" >> $GITHUB_PATH

    - name: Install dependencies
      run: |
        source .venv/bin/activate
        python -m pip install --upgrade pip
        # Pin versions to match .pre-commit-config.yaml (Issue #2128)
        python -m pip install black==26.3.1 isort==8.0.1 flake8==7.3.0 autoflake==2.3.3 'bandit[toml]==1.9.4'

    - name: Check code formatting with Black
      run: |
        source .venv/bin/activate
        python3 -m black --check --line-length=88 autobot-backend/ autobot-slm-backend/ autobot_shared/ || {
          echo "⚠️ Black formatting check failed"
          echo "Run 'python3 -m black --line-length=88 autobot-backend/ autobot-slm-backend/ autobot_shared/' to fix"
          exit 1
        }

    - name: Check import sorting with isort
      run: |
        source .venv/bin/activate
        # Use --settings-path to read pyproject.toml (profile, src_paths, known_first_party) (#2679)
        python3 -m isort --check --settings-path=. autobot-backend/ autobot-slm-backend/ autobot_shared/ || {
          echo "⚠️ isort check failed"
          echo "Run 'python3 -m isort autobot-backend/ autobot-slm-backend/ autobot_shared/' to fix"
          exit 1
        }

    - name: Lint with flake8
      run: |
        source .venv/bin/activate
        # Uses .flake8 config for consistency with pre-commit (Issue #2128)
        python3 -m flake8 --config=.flake8 autobot-backend/ autobot-slm-backend/ autobot_shared/ || {
          echo "⚠️ flake8 linting issues found"
          exit 1
        }

    - name: Check for unused imports with autoflake
      run: |
        source .venv/bin/activate
        python3 -m autoflake --check --recursive \
          --remove-all-unused-imports \
          --remove-unused-variables \
          --expand-star-imports \
          --ignore-init-module-imports \
          autobot-backend/ autobot-slm-backend/ autobot_shared/ || {
          echo "⚠️ Unused imports/variables detected"
          exit 1
        }

    - name: Security check with bandit
      run: |
        source .venv/bin/activate
        python3 -m bandit -c .bandit -r autobot-backend/ autobot-slm-backend/ autobot_shared/ || {
          echo "⚠️ Security issues detected - review bandit output"
          exit 1
        }

    - name: Check Ansible agent code drift (#1629)
      run: |
        bash pipeline-scripts/detect-agent-code-drift.sh || {
          echo "Ansible slm_agent role has drifted from canonical source"
          echo "See Issue #1629 for details"
          exit 1
        }

    - name: Code quality summary
      if: always()
      run: |
        echo "Code Quality Check Complete"
        echo ""
        echo "All checks enforce strict mode — failures will block the pipeline."

    - name: Cleanup virtual environment
      if: always()
      run: |
        rm -rf .venv || true