name: Foxhunt HFT CI/CD Pipeline

on:
  push:
    branches: [ main, master, develop ]
  pull_request:
    branches: [ main, master ]
  schedule:
    - cron: '0 2 * * *'  # Daily at 2 AM UTC for dependency updates

env:
  CARGO_TERM_COLOR: always
  RUST_BACKTRACE: 1
  # Performance optimizations for CI
  CARGO_INCREMENTAL: 0
  RUSTFLAGS: "-Dwarnings -Cinstrument-coverage"
  LLVM_PROFILE_FILE: "coverage-%p-%m.profraw"

# Global job defaults
defaults:
  run:
    shell: bash

jobs:
  # ============================================================================
  # QUICK VALIDATION CHECKS (FAST FEEDBACK)
  # ============================================================================
  
  check:
    name: 🔍 Zero Error Tolerance Check
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
      
      - name: Setup Rust toolchain
        uses: dtolnay/rust-toolchain@stable
        with:
          components: clippy, rustfmt
      
      - name: Setup Rust cache
        uses: Swatinem/rust-cache@v2
        with:
          workspaces: |
            . -> target
            services/trading-engine -> target
            services/market-data -> target
      
      - name: Install system dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y cmake build-essential pkg-config libssl-dev
          echo "✅ System dependencies installed"
      
      - name: "🚨 CRITICAL: Zero Compilation Errors Enforcement"
        run: |
          echo "🔥 ENFORCING ZERO COMPILATION ERRORS FOR HFT SYSTEM 🔥"
          echo "Real money is at stake - any compilation failure will block deployment"
          
          # Check entire workspace with strict error handling
          if ! RUSTFLAGS="-D warnings" cargo check --workspace --all-targets --all-features; then
            echo "❌ COMPILATION FAILED - BLOCKING MERGE"
            echo "::error::Compilation errors detected in HFT system - this is a CRITICAL failure"
            exit 1
          fi
          
          echo "✅ All services compile successfully"
      
      - name: "🚫 Placeholder Code Detection"
        run: |
          echo "🚨 SCANNING FOR PLACEHOLDER CODE PATTERNS"
          echo "Placeholder code is FORBIDDEN in HFT production systems"
          
          # Define dangerous patterns that indicate unfinished implementations
          PATTERNS=(
            "TODO:"
            "FIXME:"
            "XXX:"
            "HACK:"
            "In real production"
            "unimplemented!"
            "panic!"
            "unreachable!"
            "todo!()"
          )
          
          FOUND_ISSUES=0
          
          for pattern in "${PATTERNS[@]}"; do
            echo "Searching for pattern: $pattern"
            
            if grep -r --include="*.rs" "$pattern" crates/ services/ 2>/dev/null; then
              echo "❌ FOUND PLACEHOLDER PATTERN: $pattern"
              FOUND_ISSUES=$((FOUND_ISSUES + 1))
            fi
          done
          
          # Check for TODO/FIXME in comments (case insensitive)
          if grep -r -i --include="*.rs" "//.*\(todo\|fixme\|hack\)" crates/ services/ 2>/dev/null; then
            echo "❌ FOUND TODO/FIXME COMMENTS IN CODE"
            FOUND_ISSUES=$((FOUND_ISSUES + 1))
          fi
          
          # Check for .unwrap() calls (dangerous in HFT systems)
          UNWRAP_COUNT=$(grep -r --include="*.rs" "\.unwrap()" crates/ services/ 2>/dev/null | wc -l)
          if [ $UNWRAP_COUNT -gt 0 ]; then
            echo "⚠️  WARNING: Found $UNWRAP_COUNT .unwrap() calls - consider safe alternatives"
            echo "::warning::$UNWRAP_COUNT .unwrap() calls found - use safe error handling patterns"
          fi
          
          if [ $FOUND_ISSUES -gt 0 ]; then
            echo "🔥 CRITICAL FAILURE: $FOUND_ISSUES placeholder patterns found"
            echo "::error::Placeholder code detected - complete all implementations before merge"
            echo "::error::HFT systems cannot contain unfinished code due to financial risk"
            exit 1
          fi
          
          echo "✅ No placeholder code patterns detected"
      
      - name: Check code formatting
        run: |
          echo "🎨 Checking code formatting consistency"
          
          if ! cargo fmt --all -- --check; then
            echo "❌ CODE FORMATTING ISSUES DETECTED"
            echo "::error::Run 'cargo fmt --all' to fix formatting issues"
            exit 1
          fi
          
          echo "✅ All code properly formatted"
      
      - name: "📏 Clippy Linting - Zero Warnings Tolerance"
        run: |
          echo "🔍 Running clippy with ZERO WARNINGS TOLERANCE"
          
          # Run clippy with all warnings as errors
          if ! RUSTFLAGS="-D warnings" cargo clippy --workspace --all-targets --all-features -- -D warnings; then
            echo "❌ CLIPPY WARNINGS DETECTED - BLOCKING MERGE"  
            echo "::error::Code quality issues found - fix all clippy warnings before merge"
            exit 1
          fi
          
          echo "✅ All clippy checks passed"

  # ============================================================================
  # COMPREHENSIVE TEST MATRIX
  # ============================================================================

  test:
    name: Test Suite (${{ matrix.rust }} on ${{ matrix.os }})
    runs-on: ${{ matrix.os }}
    needs: check
    strategy:
      fail-fast: false
      matrix:
        rust: [stable, beta, nightly]
        os: [ubuntu-latest, windows-latest, macos-latest]
        include:
          # Additional test configurations
          - rust: stable
            os: ubuntu-latest
            coverage: true
          - rust: nightly
            os: ubuntu-latest
            miri: true
    
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
      
      - name: Setup Rust toolchain
        uses: dtolnay/rust-toolchain@master
        with:
          toolchain: ${{ matrix.rust }}
          components: clippy, rustfmt, miri
      
      - name: Setup Rust cache
        uses: Swatinem/rust-cache@v2
        with:
          key: ${{ matrix.rust }}-${{ matrix.os }}
      
      - name: Install system dependencies (Linux)
        if: matrix.os == 'ubuntu-latest'
        run: |
          sudo apt-get update
          sudo apt-get install -y pkg-config libssl-dev
      
      - name: Install system dependencies (macOS)
        if: matrix.os == 'macos-latest'
        run: |
          brew install pkg-config openssl
      
      - name: Run unit tests
        run: cargo test-unit --verbose
      
      - name: Run integration tests
        run: cargo test-integration --verbose
      
      - name: Run documentation tests
        run: cargo test-doc --verbose
      
      - name: Run Miri tests (unsafe code validation)
        if: matrix.miri == true
        run: cargo miri test --lib
        env:
          MIRIFLAGS: -Zmiri-strict-provenance -Zmiri-symbolic-alignment-check

  # ============================================================================
  # CODE QUALITY AND SECURITY
  # ============================================================================

  quality:
    name: Code Quality & Security
    runs-on: ubuntu-latest
    needs: check
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
      
      - name: Setup Rust toolchain
        uses: dtolnay/rust-toolchain@stable
        with:
          components: clippy
      
      - name: Setup Rust cache
        uses: Swatinem/rust-cache@v2
      
      - name: Install cargo tools
        run: |
          cargo install --locked cargo-audit cargo-deny cargo-outdated
      
      - name: Enterprise-grade linting
        run: cargo ci-lint
      
      - name: Security audit
        run: cargo audit-deps
      
      - name: License and dependency check
        run: cargo deny-check
      
      - name: Check for outdated dependencies
        run: cargo outdated --exit-code 1 --format json > outdated.json || true
      
      - name: Upload quality artifacts
        uses: actions/upload-artifact@v4
        if: always()
        with:
          name: quality-reports
          path: |
            outdated.json
            target/clippy-results.json

  # ============================================================================
  # CODE COVERAGE
  # ============================================================================

  coverage:
    name: Code Coverage Analysis
    runs-on: ubuntu-latest
    needs: [check, test]
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
      
      - name: Setup Rust toolchain
        uses: dtolnay/rust-toolchain@nightly
        with:
          components: llvm-tools-preview
      
      - name: Setup Rust cache
        uses: Swatinem/rust-cache@v2
      
      - name: Install coverage tools
        run: |
          cargo install --locked cargo-tarpaulin cargo-llvm-cov
      
      - name: Generate coverage with Tarpaulin
        run: cargo ci-coverage
      
      - name: Generate LLVM coverage (backup)
        run: |
          cargo llvm-cov-lcov
          cargo llvm-cov --html --output-dir target/llvm-cov
      
      - name: Upload coverage to Codecov
        uses: codecov/codecov-action@v4
        with:
          files: target/coverage/cobertura.xml,target/coverage/lcov.info
          fail_ci_if_error: true
          verbose: true
          token: ${{ secrets.CODECOV_TOKEN }}
      
      - name: Upload coverage artifacts
        uses: actions/upload-artifact@v4
        with:
          name: coverage-reports
          path: |
            target/coverage/
            target/llvm-cov/
          retention-days: 30

  # ============================================================================
  # CONCURRENCY TESTING
  # ============================================================================

  concurrency:
    name: Concurrency Testing
    runs-on: ubuntu-latest
    needs: check
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
      
      - name: Setup Rust toolchain
        uses: dtolnay/rust-toolchain@stable
      
      - name: Setup Rust cache
        uses: Swatinem/rust-cache@v2
      
      - name: Run Loom concurrency tests
        run: cargo test-loom
        env:
          RUSTFLAGS: --cfg loom
          LOOM_MAX_PREEMPTIONS: 3
          LOOM_MAX_BRANCHES: 10000
      
      - name: Stress test with multiple threads
        run: |
          for threads in 2 4 8 16; do
            echo "Testing with $threads threads..."
            RUST_TEST_THREADS=$threads cargo test --workspace -- --test-threads $threads
          done

  # ============================================================================
  # PERFORMANCE BENCHMARKS
  # ============================================================================

  benchmarks:
    name: Performance Benchmarks
    runs-on: ubuntu-latest
    if: github.event_name == 'push' && (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/master')
    needs: [test, quality]
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
      
      - name: Setup Rust toolchain
        uses: dtolnay/rust-toolchain@stable
      
      - name: Setup Rust cache
        uses: Swatinem/rust-cache@v2
      
      - name: Run performance benchmarks
        run: |
          cargo hft-bench
          cargo bench-perf
          cargo bench-latency
      
      - name: Store benchmark results
        uses: actions/upload-artifact@v4
        with:
          name: benchmark-results
          path: |
            target/criterion/
            target/bench/
          retention-days: 90
      
      - name: Performance regression check
        run: |
          # Compare with previous benchmarks (if available)
          if [ -f "benchmark-baseline.json" ]; then
            echo "Checking for performance regressions..."
            # Custom script to compare benchmark results
            # This would check if latency increased or throughput decreased significantly
          fi

  # ============================================================================
  # INTEGRATION TESTS WITH REAL SERVICES
  # ============================================================================

  integration:
    name: Integration Tests
    runs-on: ubuntu-latest
    needs: check
    services:
      postgres:
        image: postgres:16
        env:
          POSTGRES_PASSWORD: postgres
          POSTGRES_DB: foxhunt_test
        options: >-
          --health-cmd pg_isready
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5
        ports:
          - 5432:5432
      
      redis:
        image: redis:7
        options: >-
          --health-cmd "redis-cli ping"
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5
        ports:
          - 6379:6379
    
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
      
      - name: Setup Rust toolchain
        uses: dtolnay/rust-toolchain@stable
      
      - name: Setup Rust cache
        uses: Swatinem/rust-cache@v2
      
      - name: Install system dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y postgresql-client
      
      - name: Setup test database
        run: |
          PGPASSWORD=postgres psql -h localhost -U postgres -d foxhunt_test -c "CREATE EXTENSION IF NOT EXISTS \"uuid-ossp\";"
      
      - name: Run integration tests with real services
        run: cargo test --workspace --tests -- --include-ignored
        env:
          DATABASE_URL: postgresql://postgres:postgres@localhost:5432/foxhunt_test
          REDIS_URL: redis://localhost:6379
          RUST_LOG: debug

  # ============================================================================
  # CROSS-PLATFORM BUILD VERIFICATION
  # ============================================================================

  cross-platform:
    name: Cross-Platform Build (${{ matrix.target }})
    runs-on: ${{ matrix.os }}
    needs: check
    strategy:
      fail-fast: false
      matrix:
        include:
          - target: x86_64-unknown-linux-gnu
            os: ubuntu-latest
          - target: aarch64-unknown-linux-gnu
            os: ubuntu-latest
            cross: true
          - target: x86_64-apple-darwin
            os: macos-latest
          - target: aarch64-apple-darwin
            os: macos-latest
          - target: x86_64-pc-windows-msvc
            os: windows-latest
    
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
      
      - name: Setup Rust toolchain
        uses: dtolnay/rust-toolchain@stable
        with:
          targets: ${{ matrix.target }}
      
      - name: Setup Rust cache
        uses: Swatinem/rust-cache@v2
        with:
          key: ${{ matrix.target }}
      
      - name: Install cross-compilation tools
        if: matrix.cross == true
        run: |
          cargo install --locked cross
      
      - name: Build for target
        run: |
          if [ "${{ matrix.cross }}" = "true" ]; then
            cross build --target ${{ matrix.target }} --workspace --release
          else
            cargo build --target ${{ matrix.target }} --workspace --release
          fi

  # ============================================================================
  # DOCUMENTATION AND RELEASE PREPARATION
  # ============================================================================

  documentation:
    name: Documentation Build
    runs-on: ubuntu-latest
    if: github.event_name == 'push' && (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/master')
    needs: [test, quality]
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
      
      - name: Setup Rust toolchain
        uses: dtolnay/rust-toolchain@stable
      
      - name: Setup Rust cache
        uses: Swatinem/rust-cache@v2
      
      - name: Generate documentation
        run: |
          cargo doc-private
          cargo doc --workspace --all-features --no-deps
      
      - name: Deploy documentation
        uses: peaceiris/actions-gh-pages@v3
        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
        with:
          github_token: ${{ secrets.GITHUB_TOKEN }}
          publish_dir: target/doc

  # ============================================================================
  # SUMMARY AND NOTIFICATIONS
  # ============================================================================

  ci-success:
    name: CI Pipeline Success
    runs-on: ubuntu-latest
    needs: [check, test, quality, coverage, concurrency, benchmarks, integration, cross-platform, documentation]
    if: always()
    steps:
      - name: Check all jobs status
        run: |
          if [[ "${{ needs.check.result }}" == "success" && 
                "${{ needs.test.result }}" == "success" && 
                "${{ needs.quality.result }}" == "success" && 
                "${{ needs.coverage.result }}" == "success" &&
                "${{ needs.concurrency.result }}" == "success" ]]; then
            echo "✅ All critical CI checks passed!"
            echo "Pipeline Status: SUCCESS"
          else
            echo "❌ Some critical CI checks failed!"
            echo "Check results: ${{ toJson(needs) }}"
            exit 1
          fi
      
      - name: Upload CI summary
        if: always()
        run: |
          echo "## 🚀 Foxhunt HFT CI/CD Pipeline Results" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "### 🧪 Test Results:" >> $GITHUB_STEP_SUMMARY
          echo "- **Quick Check**: ${{ needs.check.result == 'success' && '✅ PASSED' || '❌ FAILED' }}" >> $GITHUB_STEP_SUMMARY
          echo "- **Test Suite**: ${{ needs.test.result == 'success' && '✅ PASSED' || '❌ FAILED' }}" >> $GITHUB_STEP_SUMMARY
          echo "- **Code Quality**: ${{ needs.quality.result == 'success' && '✅ PASSED' || '❌ FAILED' }}" >> $GITHUB_STEP_SUMMARY
          echo "- **Coverage**: ${{ needs.coverage.result == 'success' && '✅ PASSED' || '❌ FAILED' }}" >> $GITHUB_STEP_SUMMARY
          echo "- **Concurrency**: ${{ needs.concurrency.result == 'success' && '✅ PASSED' || '❌ FAILED' }}" >> $GITHUB_STEP_SUMMARY
          echo "- **Benchmarks**: ${{ needs.benchmarks.result == 'success' && '✅ PASSED' || (needs.benchmarks.result == 'skipped' && '⏭️ SKIPPED' || '❌ FAILED') }}" >> $GITHUB_STEP_SUMMARY
          echo "- **Integration**: ${{ needs.integration.result == 'success' && '✅ PASSED' || '❌ FAILED' }}" >> $GITHUB_STEP_SUMMARY
          echo "- **Cross-Platform**: ${{ needs.cross-platform.result == 'success' && '✅ PASSED' || '❌ FAILED' }}" >> $GITHUB_STEP_SUMMARY