quality.yml

name: Code Quality & Analysis

on:
  push:
    branches: [ main, develop ]
  pull_request:
    branches: [ main, develop ]

jobs:
  quality:
    runs-on: ubuntu-latest
    
    steps:
    - uses: actions/checkout@v3
      with:
        fetch-depth: 0  # Full history for better analysis
    
    - name: Set up Python 3.11
      uses: actions/setup-python@v4
      with:
        python-version: '3.11'
        cache: 'pip'
    
    - name: Install dependencies
      run: |
        python -m pip install --upgrade pip
        pip install -r requirements.txt
        pip install pylint mypy radon
    
    - name: Analyze code complexity with Radon
      run: |
        radon cc src/ -a --show-closures || true
        radon mi src/ --min B || true
    
    - name: Type check with mypy
      run: mypy src/ --ignore-missing-imports || true
    
    - name: Lint with pylint
      run: pylint src/ --exit-zero --disable=all --enable=E,F || true
    
    - name: Check docstring coverage
      run: |
        pip install interrogate
        interrogate -vv src/ --fail-under=50 --ignore-init-method || true

  dependency-check:
    runs-on: ubuntu-latest
    
    steps:
    - uses: actions/checkout@v3
    
    - name: Check for outdated dependencies
      run: |
        python -m pip install --upgrade pip
        pip install pip-audit
        pip install -r requirements.txt
        pip-audit || true
    
    - name: Dependency check with OWASP
      uses: dependency-check/Dependency-Check_Action@main
      with:
        project: 'distributed-task-queue-python'
        path: '.'
        format: 'JSON'
      continue-on-error: true

  sonarcloud:
    runs-on: ubuntu-latest
    
    steps:
    - uses: actions/checkout@v3
      with:
        fetch-depth: 0
    
    - name: SonarCloud Scan
      uses: SonarSource/sonarcloud-github-action@master
      env:
        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
      continue-on-error: true