name: CI/CD Pipeline

on:
  push:
    branches: [ main, develop ]
  pull_request:
    branches: [ main ]

jobs:
  code-quality:
    runs-on: ubuntu-latest
    strategy:
      matrix:
        python-version: ["3.10", "3.11"]

    steps:
    - uses: actions/checkout@v4

    - name: Set up Python ${{ matrix.python-version }}
      uses: actions/setup-python@v4
      with:
        python-version: ${{ matrix.python-version }}

    - name: Install Poetry
      uses: snok/install-poetry@v1
      with:
        version: 1.6.1
        virtualenvs-create: true
        virtualenvs-in-project: true

    - name: Load cached venv
      id: cached-poetry-dependencies
      uses: actions/cache@v3
      with:
        path: .venv
        key: venv-${{ runner.os }}-${{ matrix.python-version }}-${{ hashFiles('**/poetry.lock') }}

    - name: Install dependencies
      if: steps.cached-poetry-dependencies.outputs.cache-hit != 'true'
      run: poetry install --no-interaction --no-root --with dev

    - name: Install project
      run: poetry install --no-interaction

    - name: Run Black (Code Formatting Check)
      run: poetry run black --check --diff .

    - name: Run Ruff (Linting)
      run: poetry run ruff check .

    - name: Run MyPy (Type Checking)
      run: poetry run mypy source_code --ignore-missing-imports

  test:
    runs-on: ubuntu-latest
    needs: code-quality

    steps:
    - uses: actions/checkout@v4

    - name: Set up Python
      uses: actions/setup-python@v4
      with:
        python-version: "3.10"

    - name: Install Poetry
      uses: snok/install-poetry@v1
      with:
        version: 1.6.1
        virtualenvs-create: true
        virtualenvs-in-project: true

    - name: Load cached venv
      id: cached-poetry-dependencies
      uses: actions/cache@v3
      with:
        path: .venv
        key: venv-${{ runner.os }}-3.10-${{ hashFiles('**/poetry.lock') }}

    - name: Install dependencies
      if: steps.cached-poetry-dependencies.outputs.cache-hit != 'true'
      run: poetry install --no-interaction --no-root --with dev

    - name: Install project
      run: poetry install --no-interaction

    - name: Run Tests
      run: poetry run pytest --cov-report=xml

    - name: Upload coverage to Codecov
      uses: codecov/codecov-action@v3
      with:
        file: ./coverage.xml
        flags: unittests
        name: codecov-umbrella

  link-check:
    runs-on: ubuntu-latest
    
    steps:
    - uses: actions/checkout@v4

    - name: Check Markdown Links
      uses: gaurav-nelson/github-action-markdown-link-check@v1
      with:
        use-quiet-mode: 'yes'
        use-verbose-mode: 'yes'
        config-file: '.github/workflows/mlc_config.json'

  notebook-check:
    runs-on: ubuntu-latest
    
    steps:
    - uses: actions/checkout@v4

    - name: Set up Python
      uses: actions/setup-python@v4
      with:
        python-version: "3.10"

    - name: Install nbval
      run: pip install nbval jupyter

    - name: Test Jupyter Notebooks
      run: |
        find . -name "*.ipynb" -not -path "./.venv/*" -not -path "./.*" | xargs -I {} pytest --nbval-lax {}

  security-scan:
    runs-on: ubuntu-latest
    
    steps:
    - uses: actions/checkout@v4

    - name: Run Bandit Security Scan
      uses: securecodewarrior/github-action-bandit@v1.0.1
      with:
        config_file: '.bandit'

    - name: Run Safety Check
      run: |
        pip install safety
        safety check --json --output safety-report.json || true

    - name: Upload Security Reports
      uses: actions/upload-artifact@v3
      with:
        name: security-reports
        path: |
          bandit-report.json
          safety-report.json 