name: Quality

# Mirrors the checks the QGIS Plugin Hub runs on an uploaded version, so a
# release-blocking finding shows up on a push instead of after the upload —
# a blocked Hub version can never be un-blocked, the number is simply burned.
#
# QGIS runtime tests are NOT run here: they need a real QGIS install
# (C:\OSGeo4W\bin\python-qgis-ltr.bat / python-qgis.bat) and stay local.
# Run them with:  py -3 packaging/pf.py verify <plugin>

on:
  push:
  pull_request:

permissions:
  contents: read

jobs:
  static-checks:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-python@v5
        with:
          python-version: "3.12"

      - name: Install quality tools
        run: python -m pip install --disable-pip-version-check flake8 bandit

      - name: Compile every shipped module
        run: >
          python -m compileall -q .
          -x '(^|[\\/])(tests?|e2e|scratch|\.git|__pycache__|node_modules)([\\/]|$)'

      - name: Flake8 (Hub-blocking codes)
        run: >
          python -m flake8 .
          --select=E901,E902,E999,F821,F823,F831,E741,E742,E743
          --max-line-length=1000
          --exclude=.git,__pycache__,tests,e2e,scratch,node_modules

      # The Hub blocks on ANY Bandit finding, not just high severity — its
      # "warnings do not block" documentation is wrong in practice. Do not add
      # a .bandit skip file: whether the Hub honours it is unproven, and a local
      # skip makes this gate pass while the Hub still blocks.
      - name: Bandit (any finding blocks the Hub)
        run: python -m bandit -q -r . -x ./tests,./e2e,./scratch,./node_modules
