nanobook 0.12.0

name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

# Default to least privilege (I1). Jobs that need more (e.g.,
# writing to the repo) must override at job scope. CI is read-only
# by construction: it tests, lints, and reports results.
permissions:
  contents: read

env:
  CARGO_TERM_COLOR: always

jobs:
  test:
    name: Test (${{ matrix.os }})
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, macos-latest, windows-latest]
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-python@v5
        with:
          python-version: "3.14"

      - name: Install Rust
        uses: dtolnay/rust-toolchain@stable

      - uses: Swatinem/rust-cache@v2

      - name: Run tests (all features)
        run: cargo test --all-features

      - name: Run tests (no default features)
        run: cargo test --no-default-features

  python-test:
    name: Python (${{ matrix.os }}, ${{ matrix.python }})
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        # All Python versions on Linux; latest only on Mac/Windows
        include:
          - { os: ubuntu-latest,  python: "3.11" }
          - { os: ubuntu-latest,  python: "3.12" }
          - { os: ubuntu-latest,  python: "3.13" }
          - { os: ubuntu-latest,  python: "3.14" }
          - { os: macos-latest,   python: "3.14" }
          - { os: windows-latest, python: "3.14" }
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-python@v5
        with:
          python-version: ${{ matrix.python }}

      - uses: astral-sh/setup-uv@v5

      - uses: dtolnay/rust-toolchain@stable

      - uses: Swatinem/rust-cache@v2
        with:
          key: python-${{ matrix.python }}

      - name: Build and install Python extension
        working-directory: python
        run: uv sync --python ${{ matrix.python }} --group dev

      - name: Run Python tests (property + unit)
        working-directory: python
        run: uv run --python ${{ matrix.python }} --group dev python -m pytest tests/ -v --ignore=tests/reference

  lint:
    name: Lint
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-python@v5
        with:
          python-version: "3.14"

      - name: Install Rust
        uses: dtolnay/rust-toolchain@stable
        with:
          components: clippy, rustfmt

      - uses: Swatinem/rust-cache@v2

      - name: Check formatting
        run: cargo fmt --all -- --check

      - name: Clippy
        run: cargo clippy --all-targets --all-features -- -D warnings

  security:
    name: Security audit
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Install Rust
        uses: dtolnay/rust-toolchain@stable

      - uses: Swatinem/rust-cache@v2

      # Pin tool versions (I1). --locked also freezes the tool's
      # own transitive deps, so the install is fully
      # deterministic. Bump versions deliberately rather than
      # letting CI silently pick up whatever is latest.
      - name: Install cargo-deny
        run: cargo install cargo-deny --version 0.19.4 --locked

      - name: Run cargo-deny
        run: cargo deny check

      - name: Install cargo-audit
        run: cargo install cargo-audit --version 0.22.1 --locked

      - name: Run cargo-audit
        run: cargo audit

  coverage:
    name: Code coverage
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Install Rust
        uses: dtolnay/rust-toolchain@stable

      - uses: Swatinem/rust-cache@v2
        with:
          key: coverage

      - name: Install cargo-llvm-cov
        run: cargo install cargo-llvm-cov --version 0.8.5 --locked

      - name: Generate coverage
        run: cargo llvm-cov --all-features --lcov --output-path lcov.info

      - name: Upload to Codecov
        uses: codecov/codecov-action@v5
        with:
          files: lcov.info
          fail_ci_if_error: false

  bench:
    name: Benchmark
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Install Rust
        uses: dtolnay/rust-toolchain@stable

      - uses: Swatinem/rust-cache@v2

      - name: Run benchmarks
        run: cargo bench --all-features

  itch-replay-smoke:
    name: ITCH Replay Smoke (1-min slice)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-python@v5
        with:
          python-version: "3.14"

      - uses: astral-sh/setup-uv@v5

      - name: Install Rust
        uses: dtolnay/rust-toolchain@stable

      - uses: Swatinem/rust-cache@v2
        with:
          key: itch-replay-smoke

      - name: Cache ITCH data
        uses: actions/cache@v4
        with:
          path: examples/itch-replay/data
          key: itch-data-${{ hashFiles('examples/itch-replay/expected/sample.md5') }}

      - name: Download full ITCH file
        working-directory: examples/itch-replay
        run: ./download.sh

      - name: Slice to 1-minute window
        working-directory: examples/itch-replay
        run: |
          SLICE_FILE=data/07302019-0930-0931.itch
          if [ ! -f "$SLICE_FILE" ]; then
            cargo run --bin itch-slice -- \
              --input data/07302019.NASDAQ_ITCH50.gz \
              --output "$SLICE_FILE" \
              --start-ns 34200000000000 \
              --duration-ns 60000000000
          fi

      - name: Run replay on slice
        working-directory: examples/itch-replay
        run: |
          cargo run --example itch-replay -- \
            --input data/07302019-0930-0931.itch \
            --output-dir data/replay-smoke

      - name: Install Python dependencies
        working-directory: examples/itch-replay
        run: uv pip install -r requirements.txt

      - name: Generate report
        working-directory: examples/itch-replay
        run: uv run report.py --input data/replay-smoke/event-log.jsonl --output data/replay-smoke/report.html

      - name: Verify summary matches expected
        working-directory: examples/itch-replay
        run: diff -u expected/summary.txt data/replay-smoke/summary.txt

      - name: Verify invariants log is empty
        working-directory: examples/itch-replay
        run: |
          if [ -s data/replay-smoke/invariants.log ]; then
            echo "invariants.log should be empty but contains:"
            cat data/replay-smoke/invariants.log
            exit 1
          fi

  momentum-backtest-smoke:
    name: Momentum Backtest Smoke (cached prices)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-python@v5
        with:
          python-version: "3.14"

      - uses: astral-sh/setup-uv@v5

      - name: Install Rust
        uses: dtolnay/rust-toolchain@stable

      - uses: Swatinem/rust-cache@v2
        with:
          key: momentum-backtest-smoke

      - name: Cache price data
        uses: actions/cache@v4
        with:
          path: examples/momentum-backtest/data
          key: price-data-${{ hashFiles('examples/momentum-backtest/data/prices.md5') }}

      - name: Install Python dependencies
        working-directory: examples/momentum-backtest
        run: uv pip install -r requirements.txt

      - name: Run backtest with cached data (zero cost)
        working-directory: examples/momentum-backtest
        run: |
          uv run python strategy.py \
            --data-file data/sp100_ohlcv.csv \
            --start-date 2020-01-01 \
            --end-date 2020-12-31 \
            --initial-cash 1000000 \
            --commission-bps 0 \
            --slippage-bps 0 \
            --output results.json

      - name: Generate report
        working-directory: examples/momentum-backtest
        run: uv run python report.py --results results.json --output report.html

      - name: Verify results exist
        working-directory: examples/momentum-backtest
        run: |
          if [ ! -f results.json ]; then
            echo "results.json not found"
            exit 1
          fi
          if [ ! -f report.html ]; then
            echo "report.html not found"
            exit 1
          fi