name: linters
on: pull_request
jobs:
  bandit:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7

      - name: Run checks
        run: |
          pipx install $(grep "^bandit" ./dev/requirements.txt)

          echo "Bandit version: "$(bandit --version | head -1)
          bandit -a file --ini .bandit --recursive .

  black:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7

      - name: Run checks
        run: |
          pipx install $(grep "^black" ./dev/requirements.txt)

          echo "Black version: $(black --version)"

          black --check --diff .

  hadolint:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7

      - name: Run checks
        env:
          HADOLINT: '${{ github.workspace }}/hadolint'
          HADOLINT_VER: 2.12.0
          VERIFICATION_LEVEL: error
        run: |
          curl -sLo "$HADOLINT" "https://github.com/hadolint/hadolint/releases/download/v$HADOLINT_VER/hadolint-Linux-x86_64"
          chmod +x "$HADOLINT"
          echo "hadolint version: $("$HADOLINT" --version)"
          git ls-files -z 'Dockerfile*' '*/Dockerfile*' | xargs -0 "$HADOLINT" -t "$VERIFICATION_LEVEL"

  isort:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7

      - name: Run checks
        run: |
          pipx install $(grep "^isort" ./dev/requirements.txt)

          echo "isort version: $(isort --version-number)"

          isort --check --diff --resolve-all-configs .

  pylint:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7

      - id: setup-pipx
        shell: bash
        run: |
          # custom cached dir
          cache_home_dir="$HOME/.local/pipx"
          cache_bin_dir="$HOME/.local/pipx_bin"

          # add cached dir to PATH
          echo "$cache_bin_dir" >> $GITHUB_PATH

          echo "cache_home_dir=$cache_home_dir" >> $GITHUB_OUTPUT
          echo "cache_bin_dir=$cache_bin_dir" >> $GITHUB_OUTPUT
          echo "version=$(pipx --version)" >> $GITHUB_OUTPUT
          echo "python_version=$(python3 --version)" >> $GITHUB_OUTPUT

      - id: cache-pipx
        uses: actions/cache@v6
        with:
          path: |
            ${{ steps.setup-pipx.outputs.cache_home_dir }}
            ${{ steps.setup-pipx.outputs.cache_bin_dir }}
          # cache based on pipx version, python version, and both requirements files
          # nb! we need to keep python version in the key because packages might be not compatible between python versions
          key: pipx-pylint-${{ steps.setup-pipx.outputs.version}}-${{ steps.setup-pipx.outputs.python_version}}-${{ hashFiles('./dev/requirements.txt', './cvat/requirements/base.txt') }}

      - name: Install pylint
        if: steps.cache-pipx.outputs.cache-hit != 'true'
        shell: bash
        env:
          # nb! install in our custom cached dir, using /opt will not work because of permission issues
          PIPX_HOME: ${{ steps.setup-pipx.outputs.cache_home_dir }}
          PIPX_BIN_DIR: ${{ steps.setup-pipx.outputs.cache_bin_dir }}
        run: |
          pipx install $(grep "^pylint==" ./dev/requirements.txt)

          pipx inject pylint \
            $(grep "^pylint-.\+==" ./dev/requirements.txt) \
            $(grep "^django==" ./cvat/requirements/base.txt)

      - name: Run checks
        run: |
          echo "Pylint version: "$(pylint --version | head -1)
          pylint -j0 .

  regal:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7

      - name: Setup Regal
        uses: open-policy-agent/setup-regal@761188c3b435761fa254beca508a44875619648f # v2.0.0
        with:
          version: v0.21.3

      - run: regal lint --format=github cvat/apps/*/rules

  spellcheck:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7

      - name: Run checks
        run: |
          pipx install $(grep "^typos==" ./dev/requirements.txt)

          echo "Typos version: $(typos --version )"
          typos

  eslint:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7

      - uses: ./.github/actions/setup-yarn
        with:
          node-version: 22.x
          node-modules-path: |
            node_modules
            tests/node_modules
          install-command: |
            yarn install --immutable
            (cd tests && yarn install --immutable)

      - name: Run checks
        run: |
          echo "ESLint version: "$(yarn run eslint --version)
          yarn run eslint .

  typescript:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7

      - uses: ./.github/actions/setup-yarn
        with:
          node-version: 22.x

      - name: Run TypeScript checks for cvat frontend code
        run: yarn run type-check

  remark:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7

      - uses: ./.github/actions/setup-yarn
        with:
          node-version: 22.x

      - name: Run checks
        run: |
          echo "Remark version: "`npx remark --version`
          npx remark --quiet --frail -i .remarkignore .

  stylelint:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7

      - uses: ./.github/actions/setup-yarn
        with:
          node-version: 22.x

      - name: Run checks
        run: |
          echo "StyleLint version: "$(yarn run stylelint --version)
          yarn run stylelint '**/*.css' '**/*.scss'