ci.yml

name: CI

on:
  pull_request:
  push:
    branches:
      - main
      - master
      - dev

jobs:
  repository-hygiene:

    name: Repository Hygiene

    runs-on: ubuntu-latest

    steps:

      - name: Checkout

        uses: actions/checkout@v4

      - name: Verify tracked generated files

        run: |

          matches=$(git ls-files | grep -E '(^|/)dist/|(^|/)\.env$|(^|/)\.env\.(local|development|production|test)$' || true)

          if [ -n "$matches" ]; then

            echo "Tracked generated or environment files detected:"

            echo "$matches"

            exit 1

          fi

          echo "Repository hygiene checks passed."

  api-contract:
    name: API Contract Drift
    needs: repository-hygiene
    runs-on: ubuntu-latest

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: 22
          cache: npm
          cache-dependency-path: apps/frontend/package-lock.json

      - name: Setup Python
        uses: actions/setup-python@v5
        with:
          python-version: "3.13"
          cache: pip

      - name: Install frontend dependencies
        run: npm ci --prefix apps/frontend

      - name: Install backend dependencies
        run: |
          python -m pip install -r apps/backend/requirements-dev.txt
          python -m pip install -e apps/backend --no-deps

      - name: Check generated frontend API contract
        run: npm --prefix apps/frontend run generate:api-contract -- --check

  frontend:
    name: Frontend
    needs: repository-hygiene
    runs-on: ubuntu-latest

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: 22
          cache: npm
          cache-dependency-path: apps/frontend/package-lock.json

      - name: Install dependencies
        run: npm ci --prefix apps/frontend

      # Policy-aware, so a green build represents a reviewed dependency-risk
      # posture rather than the absence of `npm audit`. Runtime exposure is
      # gated harder than development-only exposure, and every exception needs
      # a written reason and a review date that expires.
      - name: Dependency audit policy tests
        run: node --test scripts/dependency-audit.test.mjs

      - name: Dependency audit
        run: node scripts/dependency-audit.mjs

      - name: Lint
        run: npm --prefix apps/frontend run lint

      - name: Test
        run: npm --prefix apps/frontend run test

      - name: Build
        run: npm --prefix apps/frontend run build

  backend:
    name: Backend
    needs: repository-hygiene
    runs-on: ubuntu-latest

    # Postgres validates the full migration round trip against the deployment
    # dialect and lets the gated refresh-token concurrency test exercise its
    # row-lock race. Redis lets the gated rate-limit tests exercise the real
    # atomic script and TTL behaviour. Local runs retain SQLite and in-memory
    # fallbacks where supported.
    services:
      postgres:
        image: postgres:16-alpine
        env:
          POSTGRES_USER: partha
          POSTGRES_PASSWORD: partha
          POSTGRES_DB: partha_test
        ports:
          - 5432:5432
        options: >-
          --health-cmd "pg_isready -U partha -d partha_test"
          --health-interval 5s
          --health-timeout 5s
          --health-retries 10
      redis:
        image: redis:7-alpine
        ports:
          - 6379:6379
        options: >-
          --health-cmd "redis-cli ping"
          --health-interval 5s
          --health-timeout 5s
          --health-retries 10

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup Python
        uses: actions/setup-python@v5
        with:
          python-version: "3.13"
          cache: pip

      - name: Upgrade pip
        run: python -m pip install --upgrade pip

      - name: Install dependencies
        run: |
          python -m pip install -r apps/backend/requirements-dev.txt
          python -m pip install -e apps/backend --no-deps

      - name: Static analysis
        working-directory: apps/backend
        run: |
          ruff check app
          ruff format --check app
          mypy app

      - name: Validate capability registry and README
        run: python scripts/check-capabilities.py

      - name: Test
        working-directory: apps/backend
        env:
          PARTHA_TEST_PG_URL: postgresql+psycopg://partha:partha@localhost:5432/partha_test
          PARTHA_TEST_REDIS_URL: redis://localhost:6379/0
        run: python -m pytest

      # The pytest step above validates every benchmark invariant (including the
      # failure paths). This step is the human-facing regression report and CI
      # artifact: it runs the real benchmark command, writes Markdown + JSON to a
      # temporary (never committed) directory, adds a summary to the job page, and
      # its exit status is captured so the reports upload even on failure. A later
      # step re-raises that status so a below-threshold benchmark fails the job.
      - name: Run Repository Intelligence golden benchmark
        id: ri_benchmark
        working-directory: apps/backend
        run: |
          mkdir -p "$RUNNER_TEMP/ri-benchmark"
          set +e
          python tests/benchmark/run.py --report-dir "$RUNNER_TEMP/ri-benchmark"
          echo "status=$?" >> "$GITHUB_OUTPUT"

      - name: Validate benchmark report contract
        if: always() && steps.ri_benchmark.outcome != 'skipped'
        run: |
          python - <<'PY'
          import json
          import os
          from pathlib import Path

          report_path = Path(os.environ["RUNNER_TEMP"]) / "ri-benchmark" / "benchmark.json"
          report = json.loads(report_path.read_text(encoding="utf-8"))
          scoring = report.get("scoring", {})
          if scoring.get("status") != "scored":
              raise SystemExit("benchmark did not publish real precision/recall measurements")
          if scoring.get("realExtractorProvenance") is None:
              raise SystemExit("benchmark did not publish real-extractor citation validity")
          rendered = json.dumps(report).lower()
          if "deferred" in rendered or "unavailable" in rendered:
              raise SystemExit("benchmark report contains a skipped live measurement")
          PY

      - name: Upload benchmark reports
        if: always() && steps.ri_benchmark.outcome != 'skipped'
        uses: actions/upload-artifact@v4
        with:
          name: ri-golden-benchmark
          path: ${{ runner.temp }}/ri-benchmark
          if-no-files-found: error

      - name: Enforce benchmark gate
        if: always() && steps.ri_benchmark.outcome != 'skipped'
        run: |
          if [ "${{ steps.ri_benchmark.outputs.status }}" != "0" ]; then
            echo "Repository Intelligence golden benchmark failed (exit ${{ steps.ri_benchmark.outputs.status }})."
            exit 1
          fi
          echo "Repository Intelligence golden benchmark passed."

  prototype-acceptance:
    name: Prototype Browser Acceptance
    needs:
      - frontend
      - backend
    runs-on: ubuntu-latest
    timeout-minutes: 15

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: 22
          cache: npm
          cache-dependency-path: apps/frontend/package-lock.json

      - name: Setup Python
        uses: actions/setup-python@v5
        with:
          python-version: "3.13"
          cache: pip

      - name: Install frontend
        run: npm ci --prefix apps/frontend

      - name: Install backend
        run: |
          python -m pip install -r apps/backend/requirements-dev.txt
          python -m pip install -e apps/backend --no-deps

      - name: Install Chromium
        run: npm --prefix apps/frontend exec -- playwright install --with-deps chromium

      - name: Run disposable-fixture browser journeys
        run: node scripts/run-prototype-acceptance.mjs

      - name: Upload browser report
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: prototype-browser-acceptance
          path: |
            apps/frontend/e2e-report
            apps/frontend/test-results
          if-no-files-found: warn
          retention-days: 14