# This workflow will install Python dependencies,
# For more information see: https://docs.github.com/en/actions/automating-builds-and-tests/building-and-testing-python

name: Static checks

on:
  push:
    branches:
      - '**'

permissions:
  contents: write
  checks: write
  pull-requests: write

jobs:
  frontend-checks:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          ref: ${{ github.head_ref || github.ref }}
          submodules: recursive  # Fetch the submodules
          token: ${{ secrets.TESTS_REPOS_ACCESS_PAT }}
          fetch-depth: 0
      - name: Use Node.js
        uses: actions/setup-node@v4
        with:
          node-version: "22.13.1"
          registry-url: 'https://npm.pkg.github.com'
          always-auth: true
          scope: '@dataiku'
        env:
          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      - name: Create .npmrc
        run: |
          echo "//npm.pkg.github.com/:_authToken=${{ secrets.GITHUB_TOKEN }}" > ./resource/frontend/.npmrc

      # - name: Install dependencies
      #   run: cd resource/frontend && rm yarn.lock && yarn install --no-cache
      - name: Run audit
        run: |
          cd resource/frontend
          yarn audit --json | jq -r 'select(.type == "auditAdvisory" and .data.advisory.severity == "high" or .data.advisory.severity == "critical")' | tee audit-result.json
          if [ -s audit-result.json ]; then
            echo "High or critical vulnerabilities found!"
            exit 1
          else
            echo "No high or critical vulnerabilities found."
          fi
  backend-lint:
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v4
      with:
        ref: ${{ github.head_ref || github.ref }}
        submodules: recursive  # Fetch the submodules
        token: ${{ secrets.TESTS_REPOS_ACCESS_PAT }}
        fetch-depth: 0
    - run: df -h
    - name: "node-cleanup"
      run: |
        sudo rm -rf /usr/share/dotnet /usr/local/lib/android /opt/ghc /opt/hostedtoolcache/CodeQL
        sudo docker image prune --all --force
        sudo docker builder prune -a
    - run: df -h
    - name: Set up Python 3.9
      uses: actions/setup-python@v5
      with:
        python-version: "3.9"
        cache: "pip"
    - name: Install dependencies
      run: |
        python -m pip install --upgrade pip
        pip install -r code-env/python/spec/requirements.github.txt
    - name: Run step on all python files
      run: |
        echo "Ruff check on all files"
        ruff check python-lib --output-format=github

  backend-mypy:
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v4
      with:
        ref: ${{ github.head_ref || github.ref }}
        submodules: recursive  # Fetch the submodules
        token: ${{ secrets.TESTS_REPOS_ACCESS_PAT }}
        fetch-depth: 0
    - run: df -h
    - name: "node-cleanup"
      run: |
        sudo rm -rf /usr/share/dotnet /usr/local/lib/android /opt/ghc /opt/hostedtoolcache/CodeQL
        sudo docker image prune --all --force
        sudo docker builder prune -a
    - run: df -h
    - name: Set up Python 3.9
      uses: actions/setup-python@v5
      with:
        python-version: "3.9"
        cache: "pip"
    - name: Install dependencies
      run: |
        python -m pip install --upgrade pip
        pip install -r code-env/python/spec/requirements.github.txt
    - name: Run mypy
      run: |
        cd python-lib
        mypy -p portal.backend -p portal.solutions --config-file="../pyproject.toml"
