name: CI

on:
  push:
    branches: [master, main]
  pull_request:
    branches: [master, main]

permissions:
  contents: read
  security-events: write

jobs:
  security:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6

      - name: Run Bandit (Security Scan)
        uses: PyCQA/bandit-action@v1
        with:
          targets: "rdagent/"
          severity: medium

  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6

      - uses: actions/setup-python@v6
        with:
          python-version: "3.10"
          cache: "pip"

      - name: Install dependencies
        run: |
          python -m pip install --upgrade pip
          pip install -e ".[test]" || pip install -r requirements.txt
          pip install pytest pytest-cov

      - name: Run unit tests (no Docker needed)
        run: |
          pytest test/backtesting/ -v --tb=short

      - name: Upload coverage to Codecov
        uses: codecov/codecov-action@v6
        with:
          token: ${{ secrets.CODECOV_TOKEN }}
          fail_ci_if_error: false