code-checks.yml

name: ✅ Code checks
on:
  push:
    branches:
      - main
    tags:
      - '*.*.*'
  pull_request:
    branches:
      - main

jobs:
  check-url-paths:
    runs-on: ubuntu-latest

    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: 🚨 Ensure DELETE FROM CurrentScan is not commented out
        run: |
          echo "🔍 Checking that DELETE FROM CurrentScan is not commented out..."

          MATCHES=$(grep -RInE '^[[:space:]]*#[[:space:]]*db\.sql\.execute\("DELETE FROM CurrentScan"\)' \
            --include="*.py" .) || true

          if [ -n "$MATCHES" ]; then
            echo "❌ Found commented-out DELETE FROM CurrentScan call:"
            echo "$MATCHES"
            echo
            echo "This line must NOT be commented out in committed code."
            exit 1
          else
            echo "✅ DELETE FROM CurrentScan is active."
          fi

      - name: Check for incorrect absolute '/php/' URLs in frontend code
        run: |
          echo "🔍 Checking for incorrect absolute '/php/' URLs (should be 'php/' or './php/')..."

          MATCHES=$(grep -rE "['\"]/php/" --include=\*.{js,php,html} ./front \
            | grep -E "\.get|\.post|\.ajax|fetch|url\s*:") || true

          if [ -n "$MATCHES" ]; then
            echo "$MATCHES"
            echo "❌ Found incorrectly absolute '/php/' URLs. Use 'php/' or './php/' for relative paths."
            exit 1
          else
            echo "✅ No bad '/php/' URLs found."
          fi



      - name: Check Python syntax
        run: |
          set -e
          echo "🔍 Checking Python syntax..."
          find . -name "*.py" -print0 | xargs -0 -n1 python3 -m py_compile

  lint:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: '3.11'

      - name: Install linting tools
        run: |
          # Python linting
          pip install flake8
          # Docker linting
          wget -O /tmp/hadolint https://github.com/hadolint/hadolint/releases/latest/download/hadolint-Linux-x86_64
          chmod +x /tmp/hadolint
          # PHP and shellcheck for syntax checking
          sudo apt-get update && sudo apt-get install -y php-cli shellcheck

      - name: Shell check
        continue-on-error: true
        run: |
          echo "🔍 Checking shell scripts..."
          find . -name "*.sh" -exec shellcheck {} \;

      - name: Python lint
        continue-on-error: true
        run: |
          echo "🔍 Linting Python code..."
          flake8 . --count --select=E9,F63,F7,F82 --show-source --statistics
          flake8 . --count --exit-zero --max-complexity=10 --max-line-length=127 --statistics

      - name: PHP check
        continue-on-error: true
        run: |
          echo "🔍 Checking PHP syntax..."
          find . -name "*.php" -exec php -l {} \;

      - name: Docker lint
        continue-on-error: true
        run: |
          echo "🔍 Linting Dockerfiles..."
          /tmp/hadolint --config .hadolint.yaml Dockerfile* || true

  docker-tests:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Run Docker-based tests
        run: |
          echo "🐳 Running Docker-based tests..."
          chmod +x ./scripts/run_tests_in_docker_environment.sh
          ./scripts/run_tests_in_docker_environment.sh

  check-skill-pairs:
    if: github.event_name == 'pull_request'
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: 🔍 Check for skill-pair drift
        continue-on-error: true
        run: python3 scripts/check_skill_pairs.py "origin/${{ github.base_ref }}"

  check-devcontainer-dockerfile:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: 🔍 Check .devcontainer/Dockerfile is up to date
        run: |
          echo "Regenerating .devcontainer/Dockerfile from the root Dockerfile + .devcontainer/resources/devcontainer-Dockerfile..."
          cp .devcontainer/Dockerfile /tmp/devcontainer-dockerfile-committed
          bash .devcontainer/scripts/generate-configs.sh

          if ! diff -q /tmp/devcontainer-dockerfile-committed .devcontainer/Dockerfile > /dev/null; then
            echo "❌ .devcontainer/Dockerfile is stale."
            echo "It's generated from the root Dockerfile and .devcontainer/resources/devcontainer-Dockerfile,"
            echo "not hand-edited. Run 'bash .devcontainer/scripts/generate-configs.sh' locally and commit the result."
            echo
            diff /tmp/devcontainer-dockerfile-committed .devcontainer/Dockerfile || true
            exit 1
          fi
          echo "✅ .devcontainer/Dockerfile is up to date."

  check-dependency-mirroring:
    if: github.event_name == 'pull_request'
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: 🔍 Check for dependency-mirroring gaps
        continue-on-error: true
        run: python3 scripts/check_dependency_mirroring.py "origin/${{ github.base_ref }}"