ci.yml

# .github/workflows/ci.yml
name: diffctx CI

'on':
  pull_request:
    branches: ['**']
  push:
    branches:
      - main

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  # ============================================================================
  # Pre-commit checks (fast feedback)
  # ============================================================================
  pre-commit:
    name: Pre-commit hooks
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1

      - name: Set up uv
        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d  # v10.0.1
        with:
          python-version: '3.12'
          enable-cache: true

      # This job runs the cargo fmt and clippy hooks, so it is the one place
      # that needs those components; rust-toolchain.toml deliberately does not
      # pin them (see the comment there). It also compiles the extension, so
      # cargo has to be on PATH at the pinned version rather than whatever the
      # runner image happens to ship.
      - name: Install Rust
        uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable
        with:
          toolchain: "1.92.0"
          components: rustfmt, clippy

      - name: Cache pre-commit
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9  # v6.1.0
        with:
          path: ~/.cache/pre-commit
          key: pre-commit-${{ hashFiles('.pre-commit-config.yaml') }}

      - name: Install dependencies
        run: |
          uv sync --locked --no-build --extra dev
          echo "$PWD/.venv/bin" >> "$GITHUB_PATH"

      - name: Run pre-commit
        run: pre-commit run --all-files

  # ============================================================================
  # Rust dependency advisories. Separate job because the pre-commit hook can
  # only skip when cargo-audit is absent, and it is absent on GitHub runners —
  # so this is the only place the check actually runs.
  # ============================================================================
  cargo-audit:
    name: Rust dependency advisories
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1

      - name: Install Rust
        uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable
        with:
          toolchain: "1.92.0"

      - name: Install cargo-audit
        run: cargo install cargo-audit --locked

      - name: Audit
        run: cargo audit

  # ============================================================================
  # Cargo.toml splits 39 tree-sitter grammars into lang-core/lang-extra, but
  # only the default (both) feature set was ever compiled. Under lang-core
  # alone 21 LANG_CONFIGS entries resolve to no grammar and silently degrade to
  # generic chunking, and nothing would have caught the build breaking outright.
  # ============================================================================
  cargo-feature-sets:
    name: Rust builds without default features
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1

      - name: Install Rust
        uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable
        with:
          toolchain: "1.92.0"

      - name: Cache Cargo
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9  # v6.1.0
        with:
          path: |
            ~/.cargo/registry
            ~/.cargo/git
            target
          key: cargo-features-${{ runner.os }}-${{ hashFiles('Cargo.lock') }}
          restore-keys: cargo-features-${{ runner.os }}-

      - name: Check lang-core only
        working-directory: crates/diffctx-native
        run: cargo check --no-default-features --features lang-core

      - name: Check with no language grammars at all
        working-directory: crates/diffctx-native
        run: cargo check --no-default-features

  # ============================================================================
  # Docker image build. Gated here rather than only at release time: cd.yml's
  # build-image needs finalize-release, so the first build of this Dockerfile
  # happened after PyPI and the GitHub Release had already shipped — a broken
  # COPY whitelist left ghcr.io with no tag while every other channel moved.
  # ============================================================================
  docker-build:
    name: Docker image builds
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1

      - name: Build image
        run: docker build -f Dockerfile -t diffctx:ci .

      # A synthetic two-commit repo, not this repo's own HEAD~1..HEAD: whether
      # the latest commit's diff fits a fixed budget depends on what that
      # commit happens to touch, which made the smoke fail on a docs-only or
      # test-only push. The fixture mirrors cd.yml's publish-image smoke.
      - name: Smoke the image on a real two-commit diff
        run: |
          docker run --rm -v "$PWD:/repo" diffctx:ci --version
          SMOKE=$(mktemp -d)
          cd "$SMOKE"
          git init -q
          git config user.email "smoke@test.local"
          git config user.name "Smoke"
          printf 'def add(a, b):\n    return a + b\n' > util.py
          printf 'from util import add\n\ndef main():\n    print(add(1, 2))\n' > app.py
          git add -A && git commit -q -m "initial"
          printf 'def add(a, b):\n    return a + b\n\ndef sub(a, b):\n    return a - b\n' > util.py
          git add -A && git commit -q -m "add sub"
          # mktemp -d creates the dir 0700 for the runner user, while the image
          # runs as the unprivileged uid 10001 — without this the container
          # sees "'/repo' is not a git repository".
          chmod -R a+rwX "$SMOKE"
          docker run --rm -v "$SMOKE:/repo" diffctx:ci . \
            --diff HEAD~1..HEAD --budget 2000 > /tmp/out.md
          test -s /tmp/out.md
          grep -q "def sub" /tmp/out.md

  # ============================================================================
  # Linting and Type Checking
  # ============================================================================
  lint-type-check:
    name: Lint & Type Check
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - name: Checkout Code
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1

      - name: Set up uv
        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d  # v10.0.1
        with:
          python-version: '3.10'
          enable-cache: true

      # Same reason as the pre-commit job: installing this package compiles the
      # native extension, so cargo has to be on PATH at the pinned version.
      - name: Install Rust
        uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable
        with:
          toolchain: "1.92.0"

      - name: Install Linters and Type Checker
        run: |
          uv sync --locked --no-build --extra dev
          echo "$PWD/.venv/bin" >> "$GITHUB_PATH"

      - name: Run Linters and Formatters Check
        run: |
          ruff check src eval tests
          black --check src eval tests

      - name: Run Type Checker (Mypy)
        run: |
          mypy src

  # ============================================================================
  # Rust diffctx tests (the full YAML corpus under tests/cases, real git repos)
  # ============================================================================
  rust-diffctx-test:
    name: Rust diffctx tests
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1

      - name: Install Rust
        uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable
        with:
          toolchain: "1.92.0"
          components: rustfmt, clippy

      - name: Cache Cargo
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9  # v6.1.0
        with:
          path: |
            ~/.cargo/registry
            ~/.cargo/git
            target
          key: cargo-${{ runner.os }}-${{ hashFiles('Cargo.lock') }}
          restore-keys: cargo-${{ runner.os }}-

      # No DIFFCTX_YAML_CASES_LIMIT: the whole corpus is gated here (~2 min).
      # Cases below threshold at the shipped operating point are enumerated in
      # crates/diffctx-native/tests/known_below_threshold.txt (the file is the
      # count — numbers written here rotted twice), enforced bidirectionally, so
      # a regression in ANY case fails the build. A limit still works locally
      # for a fast stratified subset.
      - name: Build and test
        working-directory: crates/diffctx-native
        run: |
          cargo test --lib
          cargo test --test native_cli
          cargo build --release --examples
          # --release, the profile the wheel ships: it unwinds, so the corpus
          # exercises the same panic strategy production runs under.
          cargo test --release --test yaml_cases

  # ============================================================================
  # Cross-platform Python Testing (diffctx core)
  # ============================================================================
  test:
    needs: [lint-type-check]
    # CI is Linux-only across all Python versions (minimal, cheap: 1x minutes).
    # macOS (10x) / Windows (2x) cross-platform coverage runs at RELEASE time in
    # cd.yml — build-wheels compiles the Rust ext per-OS and smoke-pypi installs
    # and exercises diffctx on ubuntu/macos/windows. No per-push macOS/Windows.
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest]
        python-version: ['3.10', '3.11', '3.12', '3.13']

    runs-on: ${{ matrix.os }}
    permissions:
      contents: read

    steps:
      - name: Checkout Code
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
        with:
          # tests/test_concurrent_deadlines.py runs the engine over this
          # repository's own full history (root..HEAD) as a workload no build profile
          # finishes inside a one-second ceiling; a shallow clone has no such range.
          fetch-depth: 0

      - name: Set up uv with Python ${{ matrix.python-version }}
        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d  # v10.0.1
        with:
          python-version: ${{ matrix.python-version }}
          enable-cache: true

      - name: Install Rust
        uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable
        with:
          toolchain: "1.92.0"
          components: rustfmt, clippy

      - name: Cache Cargo
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9  # v6.1.0
        with:
          path: |
            ~/.cargo/registry
            ~/.cargo/git
            target
          key: cargo-${{ runner.os }}-py${{ matrix.python-version }}-${{ hashFiles('Cargo.lock') }}
          restore-keys: cargo-${{ runner.os }}-py${{ matrix.python-version }}-

      - name: Build and install diffctx (with Rust _diffctx) and dev deps
        shell: bash
        env:
          PYO3_USE_ABI3_FORWARD_COMPATIBILITY: "1"
        run: |
          # Editable install of the project plus every extra the suite needs.
          # uv provisions maturin in its own build environment, so the build
          # backend is not a separate step and cannot drift from pyproject.
          uv sync --locked --no-build --extra dev --extra full --extra mcp
          echo "$PWD/.venv/bin" >> "$GITHUB_PATH"

      - name: Run Tests with Coverage
        shell: bash
        run: |
          pytest -v --cov=src/diffctx --cov-report=xml \
            --cov-report=term-missing --cov-branch --junitxml=test-results.xml

      - name: Coverage report with threshold
        run: |
          coverage report --fail-under=40

      - name: Upload coverage reports to Codecov
        if: runner.os == 'Linux' && matrix.python-version == '3.12'
        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f  # v7.0.0
        with:
          token: ${{ secrets.CODECOV_TOKEN }}
          files: ./coverage.xml
          flags: integration
          fail_ci_if_error: false
          verbose: true

  # ============================================================================
  # Complexity & Maintainability Metrics
  # ============================================================================
  complexity-checks:
    name: Complexity & Maintainability Analysis
    runs-on: ubuntu-latest
    permissions:
      contents: read

    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1

      - name: Set up uv
        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d  # v10.0.1
        with:
          python-version: '3.12'
          enable-cache: true

      # Installing this package compiles the native extension, so cargo must
      # be on PATH at the pinned version.
      - name: Install Rust
        uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable
        with:
          toolchain: "1.92.0"

      - name: Install dependencies
        run: |
          uv sync --locked --no-build --extra dev
          echo "$PWD/.venv/bin" >> "$GITHUB_PATH"

      - name: Check cyclomatic complexity
        run: |
          echo "=== Cyclomatic Complexity Report ==="
          radon cc src/diffctx/ --min B --show-complexity --total-average

      - name: Check maintainability index
        run: |
          echo "=== Maintainability Index Report ==="
          radon mi src/diffctx/ --min B --show

  # ============================================================================
  # Architecture & Import Contracts
  # ============================================================================
  architecture-checks:
    name: Architecture & Import Contracts
    runs-on: ubuntu-latest
    permissions:
      contents: read

    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1

      - name: Set up uv
        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d  # v10.0.1
        with:
          python-version: '3.12'
          enable-cache: true

      # Installing this package compiles the native extension, so cargo must
      # be on PATH at the pinned version.
      - name: Install Rust
        uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable
        with:
          toolchain: "1.92.0"

      - name: Install dependencies
        run: |
          uv sync --locked --no-build --extra dev
          echo "$PWD/.venv/bin" >> "$GITHUB_PATH"

      - name: Check import contracts
        run: lint-imports