ci.yml

# agentic-tool-decider — CI
#
# Three jobs, all of which must pass before a pull request can merge:
#
#   lint         ruff check .                      (style, imports, pyupgrade)
#   tests        pytest + demo execution           (on 3.11, 3.12, and Windows)
#   boundaries   CONTRIBUTING.md rules, automated  (offline, tests required)
#
# Every step is a command a contributor can run on their own machine, so a red
# check is always reproducible locally:
#     ruff check .
#     pytest -q
#     python examples/decision_demo.py
#     python .github/scripts/check_rules.py origin/main
name: CI

on:
  push:
    branches: ["main", "dev"]
  pull_request:
    branches: ["main", "dev"]
  workflow_dispatch:

permissions:
  contents: read

# A new push to the same pull request cancels the run that is now out of date.
concurrency:
  group: ci-${{ github.ref }}
  cancel-in-progress: true

env:
  DECIDER_MODE: mock
  PYTHONUTF8: "1"   # the examples print box-drawing characters; Windows needs this

jobs:
  lint:
    name: Lint (ruff)
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: "3.12"
      - name: Install ruff
        run: python -m pip install "ruff>=0.4.0"
      - name: Run ruff
        run: ruff check . --output-format=github

  tests:
    name: Tests (${{ matrix.os }}, Python ${{ matrix.python }})
    runs-on: ${{ matrix.os }}
    timeout-minutes: 10
    strategy:
      # Let every combination finish, so a contributor sees "fails only on
      # Windows" instead of one red job and the rest cancelled.
      fail-fast: false
      matrix:
        include:
          - { os: ubuntu-latest,  python: "3.11" }   # minimum in requires-python
          - { os: ubuntu-latest,  python: "3.12" }   # the workshop's version
          - { os: windows-latest, python: "3.12" }   # many attendees use Windows
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-python@v5
        with:
          python-version: ${{ matrix.python }}
          cache: pip
          cache-dependency-path: |
            requirements.txt
            pyproject.toml

      - name: Install dependencies
        run: |
          python -m pip install --upgrade pip
          python -m pip install -r requirements.txt
          python -m pip install -e .

      - name: Run pytest
        run: pytest -q

      # Verify the core demo scripts run without error
      - name: Demo round trip — decision execution
        timeout-minutes: 2
        run: python examples/decision_demo.py

      - name: Demo round trip — ranking
        timeout-minutes: 2
        run: python examples/ranking_demo.py

      - name: Demo round trip — routing
        timeout-minutes: 2
        run: python examples/routing_demo.py

      - name: How to reproduce a failure
        if: failure()
        shell: bash
        run: |
          echo "::error::A test or demo round trip failed. Reproduce it locally with:"
          echo "    pip install -r requirements.txt && pip install -e ."
          echo "    pytest -q"
          echo "    python examples/decision_demo.py"
          echo "The first FAILED line or Traceback above names what broke."

  boundaries:
    name: Contributor boundaries
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0   # needed to diff against the base branch

      - uses: actions/setup-python@v5
        with:
          python-version: "3.12"

      # Values come in through env, never pasted into the script, so a pull
      # request title or body cannot inject shell commands.
      - name: Check CONTRIBUTING.md rules
        env:
          BASE_SHA: ${{ github.event.pull_request.base.sha }}
          HEAD_REF: ${{ github.head_ref }}
          PR_BODY: ${{ github.event.pull_request.body }}
          AUTHOR_ASSOCIATION: ${{ github.event.pull_request.author_association }}
        run: |
          if [ -n "$BASE_SHA" ]; then
            python .github/scripts/check_rules.py "$BASE_SHA"
          else
            python .github/scripts/check_rules.py
          fi