ci.yml

name: CI

on:
  push:
    branches: [main]
  pull_request:
  schedule:
    # Weekly (Mon 06:00 UTC) so pip-audit catches newly disclosed CVEs even
    # without a code change.
    - cron: "0 6 * * 1"

jobs:
  lint:
    name: Ruff (lint + format)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7

      - uses: actions/setup-python@v7
        with:
          python-version: "3.12"

      - name: Install ruff
        run: |
          python -m pip install --upgrade pip
          pip install -e ".[dev]"

      - name: Ruff lint
        run: ruff check .

      - name: Ruff format (check only)
        run: ruff format --check .

  typecheck:
    name: Pyright
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7

      - uses: actions/setup-python@v7
        with:
          python-version: "3.12"

      - name: Install package + pyright
        run: |
          python -m pip install --upgrade pip
          pip install -e ".[dev]"

      # Pyright is a blocking gate: the tree reports zero errors under
      # `typeCheckingMode = "basic"`.
      - name: Pyright
        run: pyright

  test:
    name: Tests (py${{ matrix.python-version }})
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        python-version: ["3.11", "3.12", "3.13"]
    steps:
      - uses: actions/checkout@v7

      - uses: actions/setup-python@v7
        with:
          python-version: ${{ matrix.python-version }}

      - name: Install dependencies
        run: |
          python -m pip install --upgrade pip
          # The mcp extra installs the official MCP SDK so the optional
          # MCP integration tests run (and are covered) in CI; without
          # it they are skipped.
          pip install -e ".[mcp]" "coverage[toml]>=7.0"

      - name: Run tests with coverage
        run: coverage run -m unittest discover -s tests -v

      # `coverage report` enforces `fail_under` from pyproject.toml (90%),
      # so an insufficiently-tested change fails this job.
      - name: Coverage report (enforces fail_under)
        run: coverage report

      - name: Coverage XML
        if: always()
        run: coverage xml

      - name: Upload coverage report
        if: always()
        uses: actions/upload-artifact@v7
        with:
          name: coverage-${{ matrix.python-version }}
          path: coverage.xml
          if-no-files-found: ignore

  package:
    name: Build wheel, install & CLI smoke test
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7

      - uses: actions/setup-python@v7
        with:
          python-version: "3.12"

      - name: Build sdist + wheel
        run: |
          python -m pip install --upgrade pip build
          python -m build

      - name: Install the built wheel into a clean venv
        run: |
          python -m venv /tmp/wheeltest
          # Install ONLY from the built wheel (no source tree / editable install)
          /tmp/wheeltest/bin/pip install --upgrade pip
          /tmp/wheeltest/bin/pip install dist/*.whl

      - name: CLI smoke test
        # Run from a neutral directory: if we ran inside the checkout, the
        # source `python_agent_harness/` tree would shadow the installed wheel
        # on sys.path and we'd be testing the source, not the built artifact.
        working-directory: /tmp
        run: |
          set -euxo pipefail
          BIN=/tmp/wheeltest/bin/python-agent-harness
          # Console script is installed and importable
          "$BIN" --help
          # Config subcommand runs without any API key / network
          "$BIN" config
          # Module entry point works too
          /tmp/wheeltest/bin/python -m python_agent_harness --help
          # Import resolves to the INSTALLED wheel + bundled prompts shipped
          /tmp/wheeltest/bin/python - <<'PY'
          import importlib.resources as r
          import python_agent_harness
          loc = python_agent_harness.__file__
          assert "site-packages" in loc, f"imported source, not wheel: {loc}"
          agent = r.files("python_agent_harness").joinpath("prompts/agent.md")
          assert agent.is_file(), "bundled prompt missing from wheel"
          print("wheel import OK:", loc)
          print("bundled prompt OK:", agent)
          PY

      - name: Upload distributions
        uses: actions/upload-artifact@v7
        with:
          name: dist
          path: dist/*

  audit:
    name: pip-audit (dependency CVEs)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7

      - uses: actions/setup-python@v7
        with:
          python-version: "3.12"

      - name: Install pip-audit
        run: |
          python -m pip install --upgrade pip
          pip install "pip-audit>=2.7"

      # Audit the PROJECT's dependency closure resolved from pyproject.toml
      # (rich, httpx, prompt_toolkit + transitives) — NOT the whole runner
      # environment, which would flag unrelated tooling like pip/setuptools.
      # Record accepted/unfixable advisories in .pip-audit-known-vulnerabilities.
      - name: pip-audit
        run: |
          IGNORE_VULNS=""
          if [ -f .pip-audit-known-vulnerabilities ]; then
            while IFS= read -r vuln_id || [ -n "$vuln_id" ]; do
              # Skip blank lines and comments
              case "$vuln_id" in ''|\#*) continue ;; esac
              IGNORE_VULNS="$IGNORE_VULNS --ignore-vuln $vuln_id"
            done < .pip-audit-known-vulnerabilities
          fi
          pip-audit . --strict --progress-spinner=off $IGNORE_VULNS