test.yml

name: Tests

on:
  push:
    branches:
      - dev
      - development
      - master
    paths-ignore:
      - 'docs/**'
      - '*.md'
      - '.readthedocs*.yaml'
  pull_request:
    branches:
      - dev
      - development
      - master
  schedule:
    # Nightly full-suite run (02:30 UTC) — PRs only run the fast gate.
    - cron: '30 2 * * *'
  workflow_dispatch:  # Allow manual trigger

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: read

jobs:
  lint:
    name: Lint
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Fail on tracked build artifacts
        shell: bash
        run: |
          tracked_artifacts="$(git ls-files | grep -E '(^|/)(build|dist)(/|$)|(^|/)[^/]+\.egg-info(/|$)' || true)"
          if [ -n "$tracked_artifacts" ]; then
            echo "Tracked build artifacts are not allowed:"
            echo "$tracked_artifacts"
            exit 1
          fi

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: '3.11'
          cache: 'pip'

      - name: Install linting tools
        run: |
          python -m pip install --upgrade pip
          pip install ruff 'black==26.1.0' 'isort==9.0.1' 'mypy==1.16.1' bandit pip-audit

      - name: Run ruff
        run: ruff check backtrader/

      - name: Check formatting with black
        run: black --check --line-length 100 backtrader/

      - name: Check imports with isort
        run: isort --check-only backtrader/

      - name: Guard against star imports outside __init__.py (F403)
        shell: bash
        run: |
          violations="$(grep -rEn '^from .* import \*' backtrader --include='*.py' | grep -v '__init__.py' || true)"
          if [ -n "$violations" ]; then
            echo "Star imports are only allowed in __init__.py:"
            echo "$violations"
            exit 1
          fi

      - name: Type check with mypy
        shell: bash
        run: |
          # mypy==1.16.1 keeps the Python 3.8 target available; the current
          # gate is fully clean and should fail on any new type error.
          MYPY_THRESHOLD=0
          set -o pipefail
          mypy backtrader --config-file=pyproject.toml | tee mypy-report.txt
          count="$(grep -cE 'error:' mypy-report.txt || true)"
          echo "mypy error count: ${count} (gate threshold ${MYPY_THRESHOLD})"
          if [ "${count}" -gt "${MYPY_THRESHOLD}" ]; then
            echo "::error::mypy errors (${count}) exceed threshold (${MYPY_THRESHOLD}). New type errors were introduced."
            exit 1
          fi

      - name: Security scan with bandit (Medium/High blocking)
        shell: bash
        run: |
          # R2-S3: Medium/High 阻塞，Low 仅报告。沿用 pyproject.toml [tool.bandit]
          # 的 skips/exclude_dirs。已知的 2 处 Medium（influxfeed B608 / py3 B310）
          # 已 triage 并加 # nosec 注释，当前 Medium/High = 0。
          bandit -r backtrader -ll -q
          echo "bandit Medium/High scan passed (Low findings are reported separately)"

      - name: Bandit Low findings watchdog (iter12 S-1/S-4, non-blocking)
        continue-on-error: true
        shell: bash
        run: |
          # 迭代12 把所有 Low（B110/B112 静默异常 + B311 弱随机）逐条 triage：
          # 安全敏感路径补日志，热路径加 `# nosec <code>` 带理由，弱随机加 # nosec。
          # 收敛后基线 = 0。任何新增未 triage 的 Low 都会让计数升过基线并告警，
          # 防止静默异常/弱随机回流。
          count="$(bandit -r backtrader -c pyproject.toml -f custom \
            --msg-template '{test_id}' 2>/dev/null | grep -cE '^B[0-9]+' || true)"
          echo "bandit Low (untriaged) finding count: ${count} (iter12 baseline 0)"
          if [ "${count}" -gt 0 ]; then
            echo "::warning::Untriaged bandit Low findings (${count}) increased above baseline (0). Add a reasoned # nosec or fix."
          fi

      - name: Dependency vulnerability scan (pip-audit, non-blocking)
        continue-on-error: true
        shell: bash
        run: |
          # 迭代12 T-1: 持续监控依赖已知漏洞（CVE）。当前实测
          # "No known vulnerabilities found"。先以非阻塞看板起步，稳定后可转阻塞。
          pip-audit -r requirements.txt || true

      - name: Complexity monitor (radon F-grade, non-blocking)
        continue-on-error: true
        shell: bash
        run: |
          # R2-S6: 非阻塞看板，监控 CC>40（F 级）函数数量，防止新增。
          # 基线 13（R2-S6 把 _evaluate_signals 从 F/CC57 降到 C/CC17，抵消 R2-S4
          # fast/slow-path 拆分使 _once_op 升到 F 的影响）。最高风险的撮合状态机/
          # 事件主循环/line 基座函数刻意暂缓（见 Round 1 S5）。
          pip install radon
          count="$(radon cc backtrader -n F -s 2>/dev/null | grep -cE ' - F ' || true)"
          echo "radon F-grade (CC>40) function count: ${count} (R2-S6 baseline 13)"
          if [ "${count}" -gt 13 ]; then
            echo "::warning::F-grade complex functions (${count}) increased above baseline (13)."
          fi

  test:
    name: Test Python ${{ matrix.python-version }} on ${{ matrix.os }}
    runs-on: ${{ matrix.os }}
    needs: lint
    strategy:
      fail-fast: false
      matrix:
        include:
          # Ubuntu - test all Python versions (3.8 to 3.13)
          - os: ubuntu-latest
            python-version: '3.8'
          - os: ubuntu-latest
            python-version: '3.9'
          - os: ubuntu-latest
            python-version: '3.10'
          - os: ubuntu-latest
            python-version: '3.11'
          - os: ubuntu-latest
            python-version: '3.12'
          - os: ubuntu-latest
            python-version: '3.13'

          # macOS - test all Python versions (3.8 to 3.13)
          - os: macos-latest
            python-version: '3.8'
          - os: macos-latest
            python-version: '3.9'
          - os: macos-latest
            python-version: '3.10'
          - os: macos-latest
            python-version: '3.11'
          - os: macos-latest
            python-version: '3.12'
          - os: macos-latest
            python-version: '3.13'

          # Windows - test all Python versions (3.8 to 3.13)
          - os: windows-latest
            python-version: '3.8'
          - os: windows-latest
            python-version: '3.9'
          - os: windows-latest
            python-version: '3.10'
          - os: windows-latest
            python-version: '3.11'
          - os: windows-latest
            python-version: '3.12'
          - os: windows-latest
            python-version: '3.13'

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Set up Python ${{ matrix.python-version }}
        uses: actions/setup-python@v5
        with:
          python-version: ${{ matrix.python-version }}
          cache: 'pip'

      - name: Install dependencies
        shell: bash
        run: |
          python -m pip install --upgrade pip setuptools wheel

          # Install from setup.py with dev extras
          pip install -e ".[dev]"

      - name: Debug environment
        shell: bash
        run: |
          echo "Python version:"
          python --version
          echo "Installed packages:"
          pip list | grep -E "pytest|numpy|pandas"
          echo "Test files count:"
          find tests -name "test_*.py" | wc -l
          
      - name: Run tests
        shell: bash
        env:
          PYTEST_ADDOPTS: ""
          # PR 门禁跑快速分层（-m "not slow"，~3.5min），push/nightly/手动跑全量。
          EVENT_NAME: ${{ github.event_name }}
        run: |
          # Verify backtrader import
          python -c "import backtrader; print(f'Backtrader imported: {backtrader.__version__}')"
          # Show pytest and plugin versions
          echo "=== Pytest info ==="
          pip show pytest pytest-xdist pytest-timeout | grep -E "Name|Version"
          # Choose tier by event: pull_request => fast gate; everything else => full suite.
          if [ "${EVENT_NAME}" = "pull_request" ]; then
            echo "=== PR fast gate: pytest -m 'not slow' ==="
            pytest tests/ -m "not slow and not performance" -n auto --tb=short --timeout=300 -q
          else
            echo "=== Full suite: pytest tests/ ==="
            pytest tests/ -m "not performance" -n auto --tb=short --timeout=300 -q
          fi

  sdk:
    name: Optional SDK Contracts
    runs-on: ubuntu-latest
    needs: lint
    timeout-minutes: 40
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: '3.11'
          cache: 'pip'
      - name: Install core and pinned SDK acceptance dependencies
        run: python -m pip install -e ".[dev]" -r requirements-ci-sdk.txt
      - name: Require SDK adapters and run complete functional suite
        env:
          PYTEST_ADDOPTS: ''
        run: |
          python -c "import bt_api_py, bt_api_base, bt_api_binance, bt_api_okx, bt_api_ctp, spdlog; print('All required SDK adapters present')"
          # ``-n auto`` varies with runner CPU exposure.  Eight workers are
          # the release-validated SDK-contract profile and keep this job bounded.
          python -m pytest tests -m 'not performance' -n 8 --tb=short --timeout=300 -q

  performance:
    name: Serial Performance
    runs-on: ubuntu-latest
    needs: lint
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: '3.11'
          cache: 'pip'
      - name: Install dependencies
        run: python -m pip install -e ".[dev]" -r requirements-ci-sdk.txt
      - name: Run serial performance and isolated RSS contracts
        env:
          PYTEST_ADDOPTS: ''
        run: make test-performance BT_CONDA_PYTHON=python

  wheel-consumer:
    name: Wheel Consumer
    runs-on: ubuntu-latest
    needs: lint
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: '3.11'
          cache: 'pip'
      - name: Build and install isolated release artifacts
        shell: bash
        run: |
          python -m pip install --upgrade pip setuptools wheel build twine
          python -m pip install .
          python -m build --outdir "$RUNNER_TEMP/dist"
          python -m twine check "$RUNNER_TEMP"/dist/*
          wheel_path=$(find "$RUNNER_TEMP/dist" -name '*.whl' -print -quit)
          test -n "$wheel_path"
          python -m pip install --no-deps --target "$RUNNER_TEMP/installed" "$wheel_path"
      - name: Verify source identity and run consumer trades outside checkout
        shell: bash
        run: |
          version=$(python -c "import runpy; print(runpy.run_path('backtrader/version.py')['__version__'])")
          wheel_path=$(find "$RUNNER_TEMP/dist" -name '*.whl' -print -quit)
          cd "$RUNNER_TEMP"
          PYTHONPATH="$RUNNER_TEMP/installed" python "$GITHUB_WORKSPACE/scripts/ci/verify_release_wheel.py" \
            --wheel "$wheel_path" --source-root "$GITHUB_WORKSPACE" \
            --install-root "$RUNNER_TEMP/installed" --version "$version" \
            --output "$RUNNER_TEMP/wheel-consumer.json"
      - uses: actions/upload-artifact@v4
        with:
          name: wheel-consumer-evidence
          path: ${{ runner.temp }}/wheel-consumer.json

  coverage:
    name: Coverage (non-strategy subset, non-blocking floor)
    runs-on: ubuntu-latest
    needs: lint
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: '3.11'
          cache: 'pip'

      - name: Install dependencies
        shell: bash
        run: |
          python -m pip install --upgrade pip setuptools wheel
          pip install -e ".[dev]"

      - name: Measure coverage with floor (R2-S5)
        continue-on-error: true
        shell: bash
        run: |
          # R2-S5: baseline 60% on the non-strategy subset (see docs/COVERAGE_BASELINE.md).
          # Floor set to 55% (5% margin for parallel/sampling jitter). Non-blocking for
          # now (continue-on-error); promote to blocking once stable.
          pytest tests --ignore=tests/functional/strategies \
            --cov=backtrader --cov-report=term-missing:skip-covered \
            --cov-fail-under=55 -n auto --timeout=300 -q

  test-summary:
    name: Test Summary
    runs-on: ubuntu-latest
    needs: [test, sdk, performance, wheel-consumer]
    if: always()
    steps:
      - name: Check test results
        run: |
          if [ "${{ needs.test.result }}" == "success" ] && [ "${{ needs.sdk.result }}" == "success" ] && [ "${{ needs.performance.result }}" == "success" ] && [ "${{ needs.wheel-consumer.result }}" == "success" ]; then
            echo "All matrix tests, serial performance contracts and wheel consumers passed."
          else
            echo "At least one matrix test job failed"
            exit 1
          fi

  pr-risk:
    name: PR Risk Classification
    if: github.event_name == 'pull_request'
    runs-on: ubuntu-latest
    outputs:
      risk: ${{ steps.classify.outputs.risk }}
      area: ${{ steps.classify.outputs.area }}
    steps:
      - name: Checkout evaluated revision
        uses: actions/checkout@v4
        with:
          ref: ${{ github.event.pull_request.head.sha }}
          fetch-depth: 0
          persist-credentials: false

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: '3.11'

      - name: Classify changed paths
        id: classify
        env:
          BASE_SHA: ${{ github.event.pull_request.base.sha }}
          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
        shell: bash
        run: |
          set -euo pipefail
          paths_file="$RUNNER_TEMP/changed-paths.txt"
          git diff --name-only "$BASE_SHA" "$HEAD_SHA" > "$paths_file"
          python scripts/ci/classify_pr_risk.py \
            --paths-file "$paths_file" \
            --github-output "$GITHUB_OUTPUT"

  branch-specific-validation:
    name: Branch-Specific Validation
    needs: pr-risk
    if: >-
      github.event_name == 'pull_request' && needs.pr-risk.result == 'success' &&
      (github.base_ref == 'master' ||
      (github.base_ref == 'development' &&
      (needs.pr-risk.outputs.risk == 'R2' || needs.pr-risk.outputs.risk == 'R3')))
    runs-on: ubuntu-latest
    steps:
      - name: Checkout evaluated revision
        uses: actions/checkout@v4
        with:
          ref: ${{ github.event.pull_request.head.sha }}
          persist-credentials: false

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: '3.11'
          cache: 'pip'

      - name: Install dependencies
        shell: bash
        run: |
          python -m pip install --upgrade pip setuptools wheel
          pip install -e ".[dev]"

      - name: Run development R2/R3 strategy regression gate
        if: github.base_ref == 'development'
        shell: bash
        run: make test-strategies BT_CONDA_PYTHON=python

      - name: Run original-baseline hotfix gate
        if: github.base_ref == 'master'
        shell: bash
        env:
          PYTEST_ADDOPTS: ''
        run: |
          pytest tests/ -n auto --tb=short --timeout=300 -q

  tiered-validation-summary:
    name: Tiered Validation
    needs: [pr-risk, branch-specific-validation]
    if: always()
    runs-on: ubuntu-latest
    steps:
      - name: Publish stable branch-specific result
        env:
          EVENT_NAME: ${{ github.event_name }}
          BASE_REF: ${{ github.base_ref }}
          RISK_RESULT: ${{ needs.pr-risk.result }}
          TARGET_RESULT: ${{ needs.branch-specific-validation.result }}
        shell: bash
        run: |
          set -euo pipefail
          if [ "$EVENT_NAME" != 'pull_request' ]; then
            echo "No pull-request tier is applicable."
            exit 0
          fi
          if [ "$RISK_RESULT" != 'success' ]; then
            echo "PR risk classification failed or was skipped: $RISK_RESULT"
            exit 1
          fi
          if [ "$TARGET_RESULT" = 'success' ]; then
            echo "Branch-specific validation passed for $BASE_REF."
            exit 0
          fi
          if [ "$TARGET_RESULT" = 'skipped' ]; then
            echo "No extra branch-specific validation is required for this PR tier."
            exit 0
          fi
          echo "Branch-specific validation did not pass: $TARGET_RESULT"
          exit 1