- name: Run Unit Tests
        run: PYTHONPATH=".:$PYTHONPATH" poetry run pytest \
              --forked -n auto -s ./tests/unit \
              --cov=openhands --cov-branch

      - name: Run Unit Tests
        run: PYTHONPATH=".:$PYTHONPATH" poetry run --project=enterprise \
              pytest --forked -n auto -s -p no:ddtrace \
              -p no:ddtrace.pytest_bdd -p no:ddtrace.pytest_benchmark \
              ./enterprise/tests/unit --cov=enterprise --cov-branch

  coverage-comment:
    name: Coverage Comment
    if: github.event_name == 'pull_request'
    needs: [test-on-linux, test-enterprise]
    steps:
      - uses: actions/download-artifact@v8
        with:
          pattern: coverage-*
          merge-multiple: true
      - name: Coverage comment
        uses: py-cov-action/python-coverage-comment-action@v3
        with:
          GITHUB_TOKEN: ${{ github.token }}
          MERGE_COVERAGE_FILES: true

repos:
  - repo: https://github.com/pre-commit/pre-commit-hooks
    rev: v5.0.0
    hooks:
      - id: trailing-whitespace
      - id: end-of-file-fixer
      - id: check-yaml
      - id: debug-statements

  - repo: local
    hooks:
      - id: warn-appmode-oss
        name: "Warn on AppMode.OSS in backend"
        entry: bash -lc 'if rg -n "\\bAppMode\\.OSS\\b" \
                  openhands tests/unit; then ...; fi'

  - repo: https://github.com/astral-sh/ruff-pre-commit
    rev: v0.12.5
    hooks:
      - id: ruff
        args: [--fix, --unsafe-fixes]
      - id: ruff-format

  - repo: https://github.com/pre-commit/mirrors-mypy
    rev: v1.15.0
    hooks:
      - id: mypy
        entry: mypy --config-file dev_config/python/mypy.ini openhands/

[tool.ruff]
exclude = [ "enterprise/" ]
format.quote-style = "single"
lint.select = [
  "ASYNC",   # 异步代码最佳实践
  "B",       # flake8-bugbear (常见 bug 检测)
  "E",       # pycodestyle errors
  "F",       # pyflakes
  "I",       # isort (import 排序)
  "Q",       # 引号风格
  "UP006",   # 类型注解现代化
  "UP007",   # Union[X, Y] → X | Y
  "UP008",   # True/False 类型注解
  "W",       # pycodestyle warnings
]
lint.ignore = [
  "ASYNC109", "ASYNC110", "ASYNC220", "ASYNC221",
  "ASYNC230", "ASYNC251", "B003",
]

@pytest.fixture(autouse=True)
def allow_short_context_windows():
    old = os.environ.get('ALLOW_SHORT_CONTEXT_WINDOWS')
    os.environ['ALLOW_SHORT_CONTEXT_WINDOWS'] = 'true'
    try:
        yield
    finally:
        if old is None:
            os.environ.pop('ALLOW_SHORT_CONTEXT_WINDOWS', None)
        else:
            os.environ['ALLOW_SHORT_CONTEXT_WINDOWS'] = old

@pytest.fixture(scope='function')
def db_path(tmp_path):
    """Create a unique temp file path for each test."""
    return str(tmp_path / 'test.db')

@pytest.fixture
def engine(db_path):
    engine = create_engine(
        f'sqlite:///{db_path}', connect_args={'check_same_thread': False}
    )
    Base.metadata.create_all(engine)
    return engine

@pytest.fixture
def async_engine(db_path):
    """Create an async engine using the SAME file-based database."""
    async_engine = create_async_engine(
        f'sqlite+aiosqlite:///{db_path}',
        connect_args={'check_same_thread': False},
    )
    # ... 自动建表
    return async_engine

@pytest.fixture
def app():
    """Create a test FastAPI application."""
    app = FastAPI()
    @app.get('/test')
    def test_endpoint():
        return {'message': 'Test endpoint'}
    return app

def test_localhost_cors_middleware_init_with_config():
    mock_config = MagicMock()
    mock_config.permitted_cors_origins = [
        'https://example.com', 'https://test.com',
    ]
    with patch(
        'openhands.app_server.middleware.get_global_config',
        return_value=mock_config
    ):
        app = FastAPI()
        middleware = LocalhostCORSMiddleware(app)
        assert 'https://example.com' in middleware.allow_origins
        assert len(middleware.allow_origins) == 2

class TestIsValidEnvVarName:
    @pytest.mark.parametrize(
        'name',
        [
            'MY_VAR', 'my_var', 'MyVar', '_PRIVATE',
            '_', '__', 'A', 'a', 'VAR123', '_123',
            'API_KEY', 'DATABASE_URL', 'GITHUB_TOKEN',
        ],
    )
    def test_valid_names(self, name: str):
        assert is_valid_env_var_name(name) is True

    @pytest.mark.parametrize(
        'name',
        [
            'MY-VAR', 'MY VAR', 'MY.VAR', '123VAR',
            '-VAR', 'MY@VAR', 'MY$VAR', 'MY#VAR',
            # ... 30+ invalid cases
        ],
    )
    def test_invalid_names_special_chars(self, name: str):
        assert is_valid_env_var_name(name) is False

@pytest.mark.asyncio
async def test_github_service_token_handling():
    token = SecretStr('test-token')
    service = GitHubService(user_id=None, token=token)
    assert service.token == token
    headers = await service._get_headers()
    assert headers['Authorization'] == 'Bearer test-token'
    assert headers['Accept'] == 'application/vnd.github.v3+json'

@pytest.mark.asyncio
async def test_github_service_fetch_data():
    mock_response = AsyncMock()
    mock_response.status_code = 200
    mock_response.json.return_value = {'login': 'test-user'}
    mock_client = AsyncMock()
    mock_client.get.return_value = mock_response
    mock_client.__aenter__.return_value = mock_client
    with patch('httpx.AsyncClient', return_value=mock_client):
        service = GitHubService(user_id=None,
                               token=SecretStr('test-token'))
        _ = await service._make_request(
            'https://api.github.com/user')
        mock_client.get.assert_called_once()

      - name: Run tests and collect coverage
        working-directory: ./frontend
        run: npm run test:coverage

      - name: Install Playwright browsers
        working-directory: ./frontend
        run: npx playwright install --with-deps chromium
      - name: Run Playwright tests
        working-directory: ./frontend
        run: npx playwright test --project=chromium
      - name: Upload Playwright report
        if: always()
        with:
          name: playwright-report
          path: frontend/playwright-report/

  build:
    strategy:
      matrix:
        arch: [amd64, arm64]
    steps:
      - name: Build and push
        uses: docker/build-push-action@v7
        with:
          platforms: linux/${{ matrix.arch }}
          cache-from: |
            type=registry,ref=${{ inputs.image }}:buildcache-*
          cache-to: type=registry,...,mode=max
          provenance: ${{ inputs.provenance }}
          sbom: ${{ inputs.sbom }}

  merge:
    needs: build
    steps:
      - name: Merge manifests
        with:
          base-tags: ${{ steps.meta_base.outputs.tags }}
          archs: "amd64 arm64"

jobs:
  openhands-app:
    uses: OpenHands/release-actions/.github/workflows/
          release-please.yml@main
  cloud:
    uses: OpenHands/release-actions/.github/workflows/
          release-please.yml@main
    with:
      config-file: release-please-config.cloud.json
      manifest-file: .release-please-manifest.cloud.json