ci.yml

# =============================================================================
# TelemetryFlow Python SDK - CI Workflow
# =============================================================================
#
# TelemetryFlow Python SDK - Community Enterprise Observability Platform (CEOP)
# Copyright (c) 2024-2026 DevOpsCorner Indonesia. All rights reserved.
#
# This workflow runs tests and linting for the TelemetryFlow Python SDK:
# - Unit tests (via Makefile)
# - Integration tests (via Makefile)
# - Linting with ruff and mypy (via Makefile)
# - Code coverage (via Makefile)
#
# Compatible with TFO-Collector v1.1.2 (OCB-native)
#
# =============================================================================

name: CI - TFO Python SDK

on:
  push:
    branches:
      - main
      - master
      - develop
      - 'feature/**'
      - 'release/**'
    paths:
      - 'src/**'
      - 'tests/**'
      - 'pyproject.toml'
      - 'requirements*.txt'
      - 'Makefile'
      - '.github/workflows/ci.yml'
  pull_request:
    branches:
      - main
      - master
      - develop
    paths:
      - 'src/**'
      - 'tests/**'
      - 'pyproject.toml'
      - 'requirements*.txt'
      - 'Makefile'
  workflow_dispatch:
    inputs:
      run_e2e:
        description: 'Run E2E tests'
        required: false
        type: boolean
        default: false
      skip_lint:
        description: 'Skip linting'
        required: false
        type: boolean
        default: false

env:
  PYTHON_VERSION: '3.12'
  PRODUCT_NAME: TelemetryFlow Python SDK
  VERSION: '1.1.2'
  TFO_COLLECTOR_VERSION: '1.1.2'

permissions:
  contents: read
  security-events: write
  pull-requests: write

jobs:
  # ===========================================================================
  # Code Quality - Lint, Format, Type Check (via Makefile)
  # ===========================================================================
  lint:
    name: Lint & Code Quality
    runs-on: ubuntu-latest
    if: ${{ !inputs.skip_lint }}
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: ${{ env.PYTHON_VERSION }}
          cache: 'pip'
          cache-dependency-path: 'pyproject.toml'

      - name: Install CI dependencies
        run: make ci-deps

      - name: Show version info
        run: make version

      - name: Run CI lint suite
        run: make ci-lint

  # ===========================================================================
  # Unit Tests (via Makefile)
  # ===========================================================================
  test-unit:
    name: Unit Tests (Python ${{ matrix.python-version }})
    runs-on: ubuntu-latest
    needs: lint
    if: always() && (needs.lint.result == 'success' || needs.lint.result == 'skipped')
    strategy:
      fail-fast: false
      matrix:
        python-version: ['3.12', '3.13']
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Set up Python ${{ matrix.python-version }}
        uses: actions/setup-python@v5
        with:
          python-version: ${{ matrix.python-version }}
          cache: 'pip'
          cache-dependency-path: 'pyproject.toml'

      - name: Install CI dependencies
        run: make ci-deps

      - name: Run unit tests (CI mode)
        run: make ci-test-unit

      - name: Upload coverage report
        if: matrix.python-version == '3.12'
        uses: actions/upload-artifact@v4
        with:
          name: coverage-unit
          path: |
            coverage-unit.xml
            junit-unit.xml
          retention-days: 7

  # ===========================================================================
  # Integration Tests (via Makefile)
  # ===========================================================================
  test-integration:
    name: Integration Tests
    runs-on: ubuntu-latest
    needs: lint
    if: always() && (needs.lint.result == 'success' || needs.lint.result == 'skipped')
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: ${{ env.PYTHON_VERSION }}
          cache: 'pip'
          cache-dependency-path: 'pyproject.toml'

      - name: Install CI dependencies
        run: make ci-deps

      - name: Run integration tests (CI mode)
        run: make ci-test-integration

      - name: Upload coverage report
        uses: actions/upload-artifact@v4
        with:
          name: coverage-integration
          path: |
            coverage-integration.xml
            junit-integration.xml
          retention-days: 7
        continue-on-error: true

  # ===========================================================================
  # E2E Tests (Optional)
  # ===========================================================================
  test-e2e:
    name: E2E Tests
    runs-on: ubuntu-latest
    needs: [test-unit, test-integration]
    if: ${{ inputs.run_e2e == true || github.event_name == 'push' && github.ref == 'refs/heads/main' }}
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: ${{ env.PYTHON_VERSION }}
          cache: 'pip'
          cache-dependency-path: 'pyproject.toml'

      - name: Install CI dependencies
        run: make ci-deps

      - name: Run E2E tests
        run: |
          pytest tests/e2e/ -v || true

  # ===========================================================================
  # Build Verification - CLI Generators (via Makefile)
  # ===========================================================================
  build:
    name: Build & Verify (${{ matrix.os }})
    runs-on: ${{ matrix.os }}
    needs: lint
    if: always() && (needs.lint.result == 'success' || needs.lint.result == 'skipped')
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, macos-latest, windows-latest]
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: ${{ env.PYTHON_VERSION }}
          cache: 'pip'
          cache-dependency-path: 'pyproject.toml'

      - name: Install package (Unix)
        if: matrix.os != 'windows-latest'
        run: make deps

      - name: Install package (Windows)
        if: matrix.os == 'windows-latest'
        run: |
          python -m pip install --upgrade pip
          pip install -e "."

      - name: Show version info (Unix)
        if: matrix.os != 'windows-latest'
        run: make version

      - name: Verify CLI generators (Unix)
        if: matrix.os != 'windows-latest'
        run: |
          telemetryflow-gen --version
          telemetryflow-gen --help
          telemetryflow-restapi --version
          telemetryflow-restapi --help

      - name: Verify CLI generators (Windows)
        if: matrix.os == 'windows-latest'
        run: |
          telemetryflow-gen --version
          telemetryflow-gen --help
          telemetryflow-restapi --version
          telemetryflow-restapi --help

      - name: Test generator output (Unix)
        if: matrix.os != 'windows-latest'
        run: |
          # Test telemetryflow-gen
          telemetryflow-gen --no-banner example basic -o /tmp/test-gen
          ls -la /tmp/test-gen/

          # Test telemetryflow-restapi
          telemetryflow-restapi --no-banner new -n test-api -o /tmp/test-restapi
          ls -la /tmp/test-restapi/test-api/

      - name: Test generator output (Windows)
        if: matrix.os == 'windows-latest'
        run: |
          telemetryflow-gen --no-banner example basic -o $env:TEMP\test-gen
          dir $env:TEMP\test-gen

          telemetryflow-restapi --no-banner new -n test-api -o $env:TEMP\test-restapi
          dir $env:TEMP\test-restapi\test-api

  # ===========================================================================
  # Security Scan (via Makefile)
  # ===========================================================================
  security:
    name: Security Scan
    runs-on: ubuntu-latest
    needs: lint
    if: always() && (needs.lint.result == 'success' || needs.lint.result == 'skipped')
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: ${{ env.PYTHON_VERSION }}
          cache: 'pip'
          cache-dependency-path: 'pyproject.toml'

      - name: Install CI dependencies
        run: make ci-deps

      - name: Run security scan (CI mode)
        run: make ci-security

      - name: Upload Bandit SARIF
        uses: github/codeql-action/upload-sarif@v4
        if: always()
        with:
          sarif_file: bandit-results.sarif
        continue-on-error: true

  # ===========================================================================
  # Coverage Report (via Makefile)
  # ===========================================================================
  coverage:
    name: Coverage Report
    runs-on: ubuntu-latest
    needs: [test-unit, test-integration]
    if: always() && needs.test-unit.result == 'success'
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: ${{ env.PYTHON_VERSION }}
          cache: 'pip'
          cache-dependency-path: 'pyproject.toml'

      - name: Install CI dependencies
        run: make ci-deps

      - name: Generate coverage report (CI mode)
        run: make ci-coverage

      - name: Upload HTML coverage report
        uses: actions/upload-artifact@v4
        with:
          name: coverage-html
          path: htmlcov/
          retention-days: 7
        continue-on-error: true

      - name: Coverage summary
        run: |
          echo "## Coverage Summary" >> $GITHUB_STEP_SUMMARY
          if [ -f coverage.xml ]; then
            echo "Coverage report generated successfully" >> $GITHUB_STEP_SUMMARY
            echo "" >> $GITHUB_STEP_SUMMARY
            echo "### TFO v2 API Features Tested:" >> $GITHUB_STEP_SUMMARY
            echo "- v2 endpoints: /v2/traces, /v2/metrics, /v2/logs" >> $GITHUB_STEP_SUMMARY
            echo "- Collector identity (tfoidentityextension)" >> $GITHUB_STEP_SUMMARY
            echo "- Auth headers (tfoauthextension)" >> $GITHUB_STEP_SUMMARY
          else
            echo "No coverage report available" >> $GITHUB_STEP_SUMMARY
          fi

  # ===========================================================================
  # CI Summary
  # ===========================================================================
  summary:
    name: CI Summary
    runs-on: ubuntu-latest
    needs: [lint, test-unit, test-integration, build, security, coverage]
    if: always()
    steps:
      - name: Generate summary
        run: |
          echo "## ${{ env.PRODUCT_NAME }} v${{ env.VERSION }} - CI Results" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "**TFO-Collector Version:** ${{ env.TFO_COLLECTOR_VERSION }}" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "| Job | Status |" >> $GITHUB_STEP_SUMMARY
          echo "|-----|--------|" >> $GITHUB_STEP_SUMMARY
          echo "| Lint | ${{ needs.lint.result }} |" >> $GITHUB_STEP_SUMMARY
          echo "| Unit Tests | ${{ needs.test-unit.result }} |" >> $GITHUB_STEP_SUMMARY
          echo "| Integration Tests | ${{ needs.test-integration.result }} |" >> $GITHUB_STEP_SUMMARY
          echo "| Build | ${{ needs.build.result }} |" >> $GITHUB_STEP_SUMMARY
          echo "| Security | ${{ needs.security.result }} |" >> $GITHUB_STEP_SUMMARY
          echo "| Coverage | ${{ needs.coverage.result }} |" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "### TFO v2 API Features" >> $GITHUB_STEP_SUMMARY
          echo "- v2 endpoints: /v2/traces, /v2/metrics, /v2/logs" >> $GITHUB_STEP_SUMMARY
          echo "- Collector identity (aligned with tfoidentityextension)" >> $GITHUB_STEP_SUMMARY
          echo "- Auth headers (aligned with tfoauthextension)" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "**Commit:** ${{ github.sha }}" >> $GITHUB_STEP_SUMMARY
          echo "**Branch:** ${{ github.ref_name }}" >> $GITHUB_STEP_SUMMARY
          echo "**Triggered by:** ${{ github.event_name }}" >> $GITHUB_STEP_SUMMARY

      - name: Check overall status
        run: |
          if [[ "${{ needs.lint.result }}" == "failure" ]] || \
             [[ "${{ needs.test-unit.result }}" == "failure" ]] || \
             [[ "${{ needs.build.result }}" == "failure" ]]; then
            echo "CI failed - one or more required jobs failed"
            exit 1
          fi
          echo "CI passed successfully"