ci.yml

name: CI

on:
  push:
    branches:
      - main
  pull_request:
    types: [opened, synchronize, reopened, ready_for_review]

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  ci:
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v4

      - name: Generate GitHub App token
        id: app-token
        uses: actions/create-github-app-token@v1
        with:
          app-id: ${{ vars.DEPENDABOT_APP_ID }}
          private-key: ${{ secrets.DEPENDABOT_APP_PRIVATE_KEY }}
          owner: gradientlabs-ai

      - name: Configure git to use HTTPS for gradientlabs-ai repos
        env:
          GH_TOKEN: ${{ steps.app-token.outputs.token }}
        run: |
          git config --global url."https://x-access-token:${GH_TOKEN}@github.com/gradientlabs-ai/".insteadOf "ssh://git@github.com/gradientlabs-ai/"

      - name: Install uv
        uses: astral-sh/setup-uv@v5

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: "3.12"

      - name: Install dependencies
        run: uv sync

      # uv run, not uvx: uvx resolves ruff at run time, so a new release silently
      # changes what CI enforces. This uses the version pinned in the lockfile.
      - name: Check formatting
        run: uv run ruff format --check .

      - name: Lint
        run: uv run ruff check .

      # No test declares a "unit" marker, so `-m unit` deselected every test and the
      # exit-5 guard reported that as success — the suite never actually ran.
      - name: Run unit tests
        run: |
          if [ -d "tests" ]; then
            uv run pytest tests/
          else
            echo "No tests directory, skipping"
          fi