ci.yml

name: CI — Smoke Test, Lint, Security

on:
  push:
    branches: [main]
    paths:
      - '**.py'
      - 'requirements.txt'
  pull_request:
    branches: [main]
    paths:
      - '**.py'
      - 'requirements.txt'

permissions:
  contents: read

jobs:
  imports:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4

      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
        with:
          python-version: '3.11'
          cache: pip

      - name: Install dependencies
        run: pip install --prefer-binary -r requirements.txt

      - name: Core engine imports
        run: |
          python -c "
          import sys
          failures = []

          checks = [
              ('data_providers',         'DataManager'),
              ('sml_engine',             'SMLEngine'),
              ('execution_engine',       'ExecutionEngine'),
              ('options_intelligence',   'OptionsIntelligence'),
              ('iwm_odte_engine',        'IwmOdteEngine'),
              ('gamma_flow_engine',      'GammaFlowEngine'),
              ('whale_stalker_engine',   'WhaleStalkerEngine'),
              ('discord_alerts',         'DiscordAlerts'),
              ('proof402_integration',   'require_payment'),
              ('x402_flask',             'x402_guard'),
          ]

          for module, symbol in checks:
              try:
                  mod = __import__(module)
                  getattr(mod, symbol)
                  print(f'  OK  {module}.{symbol}')
              except Exception as e:
                  failures.append(f'FAIL {module}.{symbol}: {e}')
                  print(f'FAIL {module}.{symbol}: {e}', file=sys.stderr)

          if failures:
              sys.exit(1)
          "

      - name: Core app imports
        run: |
          python -c "
          import sys, os
          os.environ.setdefault('PROOF402_TOKEN_SECRET', 'ci-placeholder')

          failures = []
          checks = [
              ('core.state',                  'GlobalState'),
              ('core.legacy',                 'get_service'),
              ('core.oracle_engine',          'OracleEngine'),
              ('core.rdt_engine',             'RecurrentDepthTransformer'),
              ('core.market_graph',           'get_graph'),
              ('core.signal_history',         'record'),
              ('core.proprietary_ema_engine', '_Engine4'),
              ('core.proprietary_ema_engine', 'run_proprietary_suite'),
          ]

          for module, symbol in checks:
              try:
                  import importlib
                  mod = importlib.import_module(module)
                  getattr(mod, symbol)
                  print(f'  OK  {module}.{symbol}')
              except Exception as e:
                  failures.append(f'FAIL {module}.{symbol}: {e}')
                  print(f'FAIL {module}.{symbol}: {e}', file=sys.stderr)

          if failures:
              sys.exit(1)
          "

      - name: Install security tools
        run: pip install flake8 bandit safety

      - name: Lint (warnings only)
        run: flake8 core/ --max-line-length=120 --ignore=E501,W503 || true

      - name: Security scan — bandit
        run: bandit -r core/ -ll -q || true

      - name: Dependency vulnerability check
        run: safety check -r requirements.txt || true