# This workflow will install Python dependencies, run tests and lint with a single version of Python
# For more information see: https://help.github.com/actions/language-and-framework-guides/using-python-with-github-actions

name: Python application

on:
  push:
    branches: [ '*' ]
  pull_request:
    branches: [ '*' ]

permissions:
  contents: read

jobs:
  build:

    runs-on: ubuntu-latest

    steps:
    - uses: actions/checkout@v3
    - name: Set up Python 3.10
      uses: actions/setup-python@v3
      with:
        python-version: "3.10"
    - name: Install uv
      uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
      with:
        # Install a specific version of uv.
        version: "0.11.25"
    - name: Install the project
      run: uv sync --dev
    - name: Perform static checks
      run: uv run ruff check
    - name: Run tests
      run: uv run pytest tests

  build-no-pqc:
    # Regression coverage for issue #2659: INVALID_DEVID is only declared
    # in the CFFI cdef when ML_KEM or ML_DSA is enabled, so a wolfSSL build
    # without those features must still import wolfcrypt.random successfully.

    runs-on: ubuntu-latest

    steps:
    - uses: actions/checkout@v3
      with:
        submodules: recursive
    - name: Set up Python 3.10
      uses: actions/setup-python@v3
      with:
        python-version: "3.10"
    - name: Install uv
      uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
      with:
        # Install a specific version of uv.
        version: "0.11.25"
    - name: Install build deps
      run: |
        sudo apt-get update
        sudo apt-get install -y autoconf automake libtool
    - name: Build wolfSSL without ML-KEM/ML-DSA
      run: |
        cd lib/wolfssl
        ./autogen.sh
        ./configure --enable-cryptonly --disable-shared \
                    --disable-kyber --disable-dilithium \
                    --enable-aes --enable-aesgcm --enable-aessiv \
                    --enable-aesctr --enable-aesgcm-stream \
                    --enable-des3 --enable-chacha --enable-poly1305 \
                    --enable-sha --enable-sha384 --enable-sha512 --enable-sha3 \
                    --enable-hkdf --enable-rsa --enable-rsapss --enable-ecc \
                    --enable-ed25519 --enable-ed448 --enable-curve25519 \
                    --enable-keygen --enable-pwdbased --enable-pkcs7 \
                    --disable-md5 --disable-sha224 --disable-dh \
                    --disable-oldtls --disable-oldnames --disable-extended-master \
                    CFLAGS=-fPIC \
                    --prefix=$GITHUB_WORKSPACE/wolfssl-install
        make
        make install
    - name: Install wolfcrypt-py against the local wolfSSL
      env:
        USE_LOCAL_WOLFSSL: ${{ github.workspace }}/wolfssl-install
      run: |
        uv venv
        uv pip install -r requirements/test.txt
        uv pip install -e .
    - name: Import smoke (regression for INVALID_DEVID)
      run: uv run python -c "from wolfcrypt.random import Random; Random()"
    - name: Run tests
      env:
        USE_LOCAL_WOLFSSL: ${{ github.workspace }}/wolfssl-install
      run: uv run pytest tests