pull-request-tests.yml

name: Pull Request Tests
permissions:
  contents: read

on:
  pull_request:
    branches:
      - main

concurrency:
  group: pr-tests-${{ github.event.pull_request.number }}
  cancel-in-progress: true

jobs:
  detect-changes:
    name: Detect Changes
    runs-on: ubuntu-latest
    outputs:
      code: ${{ steps.changes.outputs.code }}
    steps:
      - uses: actions/checkout@v4

      - uses: dorny/paths-filter@v3
        id: changes
        with:
          filters: |
            code:
              - 'middleware/**'
              - 'pyproject.toml'
              - 'uv.lock'
              - 'docker/**'
              - '.github/**'
              - 'scripts/**'
              - '.pre-commit-config.yaml'
              - '.bandit'
              - 'dev_environment/**'

  python-quality:
    name: Python Code Quality
    needs: detect-changes
    uses: ./.github/workflows/python-quality.yml
    with:
      run_checks: ${{ needs.detect-changes.outputs.code == 'true' }}

  docker-build-test:
    name: Docker Build and Test
    needs: detect-changes
    uses: ./.github/workflows/docker-build.yml
    with:
      run_checks: ${{ needs.detect-changes.outputs.code == 'true' }}
      push_to_registry: false
      version_bump: 'patch'

  pr-summary:
    name: Pull Request Summary
    runs-on: ubuntu-latest
    needs: [detect-changes, python-quality, docker-build-test]
    if: always()

    steps:
      - name: Generate PR Summary
        run: |
          echo "## 🔍 Pull Request Test Results" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY

          if [[ "${{ needs.detect-changes.outputs.code }}" != "true" ]]; then
            echo "⏭️ **No code changes detected** — Python and Docker checks were skipped." >> $GITHUB_STEP_SUMMARY
            echo "" >> $GITHUB_STEP_SUMMARY
          fi

          echo "### 🐍 Python Code Quality" >> $GITHUB_STEP_SUMMARY
          if [[ "${{ needs.detect-changes.outputs.code }}" != "true" ]]; then
            echo "- **Status**: ⏭️ Skipped (docs/metadata only)" >> $GITHUB_STEP_SUMMARY
          else
            echo "- **Status**: ${{ needs.python-quality.result == 'success' && '✅ Success' || '❌ Failed' }}" >> $GITHUB_STEP_SUMMARY
          fi
          echo "- **Includes**: Linting, formatting, type checking, security scan" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY

          echo "### 📦 Docker Build & Test" >> $GITHUB_STEP_SUMMARY
          if [[ "${{ needs.detect-changes.outputs.code }}" != "true" ]]; then
            echo "- **Status**: ⏭️ Skipped (docs/metadata only)" >> $GITHUB_STEP_SUMMARY
          else
            echo "- **Version**: ${{ needs.docker-build-test.outputs.version }}" >> $GITHUB_STEP_SUMMARY
            echo "- **Build Status**: ${{ needs.docker-build-test.result == 'success' && '✅ Success' || '❌ Failed' }}" >> $GITHUB_STEP_SUMMARY
            echo "- **Container Tests**: ✅ Executed" >> $GITHUB_STEP_SUMMARY
          fi
          echo "" >> $GITHUB_STEP_SUMMARY

          echo "### 🛡️ Security & Compliance" >> $GITHUB_STEP_SUMMARY
          echo "- **SBOM Generation**: ⏭️ Only on releases" >> $GITHUB_STEP_SUMMARY
          echo "- **Vulnerability Scans**: ⏭️ Only on releases" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY

          if [[ "${{ needs.detect-changes.outputs.code }}" != "true" ]]; then
            echo "✅ **Checks skipped** — no code changes in this PR." >> $GITHUB_STEP_SUMMARY
          elif [[ "${{ needs.python-quality.result }}" == "success" && "${{ needs.docker-build-test.result }}" == "success" ]]; then
            echo "🎉 **All PR tests passed!** Ready for review." >> $GITHUB_STEP_SUMMARY
          else
            echo "⚠️ **Some tests failed.** Please check the logs above." >> $GITHUB_STEP_SUMMARY
          fi