optimized-tests.yml

name: Extended Validation Suite

on:
  workflow_dispatch:
    inputs:
      run_performance:
        description: "Run performance benchmarks"
        required: false
        default: false
        type: boolean
      run_security:
        description: "Run extended security checks"
        required: false
        default: true
        type: boolean
      run_build_test:
        description: "Run build/package validation"
        required: false
        default: true
        type: boolean
  schedule:
    - cron: "0 2 * * *"

env:
  SMOKE_TEST_PATHS: >-
    tests/test_bt_api_quality.py
    tests/test_forwarding_schema.py
    tests/test_forwarding_bus_router_client.py
    tests/test_monitoring_contracts.py

jobs:
  compatibility-matrix:
    name: Extended Compatibility
    if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'
    uses: ./.github/workflows/reusable-compat-matrix.yml

  performance:
    if: github.event_name == 'workflow_dispatch' && inputs.run_performance == true
    runs-on: ubuntu-latest
    timeout-minutes: 20
    permissions:
      contents: read

    steps:
      - name: Checkout code
        uses: actions/checkout@v6

      - name: Set up Python
        uses: actions/setup-python@v6
        with:
          python-version: "3.11"
          cache: pip
          cache-dependency-path: pyproject.toml

      - name: Install dependencies
        run: |
          python -m pip install --upgrade pip
          pip install -e ".[dev]"

      - name: Run performance tests
        shell: bash
        run: |
          set -euo pipefail
          test -f tests/performance/test_event_normalization_performance.py
          python -m pytest tests/performance/test_event_normalization_performance.py::test_normalize_event_orderbook_dict_hot_path --tb=short -v -n 8 --benchmark-json=benchmark.json

      - name: Validate performance baseline
        shell: bash
        run: |
          set -euo pipefail
          python scripts/ci/check_performance_baseline.py \
            --baseline docs/acceptance/2026-09-21-performance-baseline.json \
            --report benchmark.json

      - name: Upload benchmark result artifact
        uses: actions/upload-artifact@v7
        with:
          name: benchmark-result
          path: benchmark.json
          retention-days: 30
          if-no-files-found: error

  security:
    if: github.event_name == 'schedule' || inputs.run_security == true
    runs-on: ubuntu-latest
    timeout-minutes: 15
    permissions:
      contents: read

    steps:
      - name: Checkout code
        uses: actions/checkout@v6

      - name: Set up Python
        uses: actions/setup-python@v6
        with:
          python-version: "3.11"
          cache: pip
          cache-dependency-path: pyproject.toml

      - name: Install dependencies
        run: |
          python -m pip install --upgrade pip
          pip install -e ".[dev]"
          pip install bandit pip-audit

      - name: Run security scan
        run: |
          set +e
          bandit -r bt_api_py -c pyproject.toml -f json -o bandit-report.json
          bandit_status=$?
          pip-audit -f json -o pip-audit-report.json
          pip_audit_status=$?
          set -e
          bandit_report_status=0
          pip_audit_report_status=0
          test -s bandit-report.json || bandit_report_status=1
          test -s pip-audit-report.json || pip_audit_report_status=1
          if [ "$bandit_status" -ne 0 ] || [ "$pip_audit_status" -ne 0 ] || [ "$bandit_report_status" -ne 0 ] || [ "$pip_audit_report_status" -ne 0 ]; then
            echo "Security scan/report check failed (bandit=${bandit_status}, pip-audit=${pip_audit_status}, bandit-report=${bandit_report_status}, pip-audit-report=${pip_audit_report_status})."
            exit 1
          fi

      - name: Upload security reports
        if: always()
        uses: actions/upload-artifact@v7
        with:
          name: security-reports
          path: |
            bandit-report.json
            pip-audit-report.json
          if-no-files-found: error

  build-test:
    if: github.event_name == 'schedule' || inputs.run_build_test == true
    runs-on: ubuntu-latest
    timeout-minutes: 20
    permissions:
      contents: read

    steps:
      - name: Checkout code
        uses: actions/checkout@v6

      - name: Set up Python
        uses: actions/setup-python@v6
        with:
          python-version: "3.11"
          cache: pip
          cache-dependency-path: pyproject.toml

      - name: Install build dependencies
        run: |
          python -m pip install --upgrade pip
          pip install build twine

      - name: Build package
        run: python -m build

      - name: Check package metadata
        run: twine check dist/*

      - name: Test wheel installation
        shell: bash
        run: |
          set -euo pipefail
          shopt -s nullglob
          wheels=( "$GITHUB_WORKSPACE"/dist/*.whl )
          if [ "${#wheels[@]}" -ne 1 ] || [ ! -f "${wheels[0]}" ]; then
            echo "Expected exactly one wheel in $GITHUB_WORKSPACE/dist; found ${#wheels[@]}."
            exit 1
          fi

          wheel_path="$(realpath "${wheels[0]}")"
          test -f "$wheel_path"
          venv_dir="$(mktemp -d "$RUNNER_TEMP/bt-api-py-wheel-venv.XXXXXX")"
          smoke_dir="$(mktemp -d "$RUNNER_TEMP/bt-api-py-wheel-cwd.XXXXXX")"
          python -m venv "$venv_dir"
          venv_python="$venv_dir/bin/python"

          unset PYTHONPATH
          "$venv_python" -m pip install "$wheel_path"
          cd "$smoke_dir"
          "$venv_python" - <<'PY'
          import os
          from pathlib import Path

          import bt_api_py

          module_path = Path(bt_api_py.__file__).resolve()
          workspace = Path(os.environ["GITHUB_WORKSPACE"]).resolve()
          try:
              module_path.relative_to(workspace)
          except ValueError:
              pass
          else:
              raise AssertionError(f"bt_api_py imported from the checkout: {module_path}")

          print(f"Imported bt_api_py from: {module_path}")
          PY
          "$venv_python" -m pip check

  notify:
    if: failure()
    needs: [compatibility-matrix, performance, security, build-test]
    runs-on: ubuntu-latest
    permissions:
      contents: write

    steps:
      - name: Notify on failure
        uses: actions/github-script@v8
        with:
          script: |
            const { owner, repo } = context.repo;
            const sha = context.sha;
            const runUrl = `${context.serverUrl}/${owner}/${repo}/actions/runs/${context.runId}`;
            github.rest.repos.createCommitComment({
              owner,
              repo,
              commit_sha: sha,
              body: `Extended validation suite failed: ${runUrl}`,
            });