ci.yml

name: CI

# SHA-pinning policy: actions are pinned to the tagged releases below; the
# maintainers must replace the tags with full commit SHAs (with a version
# comment) via Dependabot/Renovate PRs before any release. Never accept a
# dependency-update PR that moves an action to an untagged ref.
on:
  push:
    branches: [main]
  pull_request:
  workflow_dispatch:

concurrency:
  group: ci-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: read

jobs:
  fast-tests-windows:
    runs-on: windows-latest
    timeout-minutes: 60
    strategy:
      matrix:
        python-version: ['3.10', '3.11']
    steps:
      - name: Checkout
        uses: actions/checkout@v7.0.1 # v7.0.1 - pin to full SHA before release
      - name: Install uv
        uses: astral-sh/setup-uv@v9.0.0 # v9.0.0
        with:
          python-version: ${{ matrix.python-version }}
          enable-cache: true
      - name: Sync locked environment
        run: uv sync --locked --all-groups --python ${{ matrix.python-version }}
      - name: Run deterministic tests
        run: uv run --python ${{ matrix.python-version }} pytest -q
      - name: Parse PowerShell scripts
        shell: powershell
        run: |
          $parseErrors = @()
          Get-ChildItem -Recurse -Filter *.ps1 | ForEach-Object {
            $errors = $null
            [void][System.Management.Automation.Language.Parser]::ParseFile(
              $_.FullName, [ref]$null, [ref]$errors
            )
            if ($errors) { $parseErrors += $errors }
          }
          if ($parseErrors.Count -gt 0) {
            $parseErrors | ForEach-Object { Write-Error $_.Message }
            exit 1
          }
      - name: Benchmark table drift check
        run: |
          uv run --python ${{ matrix.python-version }} python scripts/render_benchmark_tables.py
          git diff --exit-code -- README.md README.zh-CN.md
      - name: Benchmark evidence + adapter manifest validation
        run: |
          uv run --python ${{ matrix.python-version }} python scripts/validate_benchmark_index.py
          uv run --python ${{ matrix.python-version }} python scripts/validate_adapter_manifest.py --adapter paddleocr-vl-1.6 --strict
          uv run --python ${{ matrix.python-version }} python scripts/validate_adapter_manifest.py --adapter mineru --strict

  fast-tests-ubuntu:
    runs-on: ubuntu-latest
    timeout-minutes: 40
    strategy:
      matrix:
        python-version: ['3.10', '3.11']
    steps:
      - name: Checkout
        uses: actions/checkout@v7.0.1 # v7.0.1 - pin to full SHA before release
      - name: Install uv
        uses: astral-sh/setup-uv@v9.0.0 # v9.0.0
        with:
          python-version: ${{ matrix.python-version }}
          enable-cache: true
      - name: Sync locked environment
        run: uv sync --locked --all-groups --python ${{ matrix.python-version }}
      - name: Run pure-Python tests (PowerShell tests auto-skip)
        run: uv run --python ${{ matrix.python-version }} pytest -q
      - name: "Ruff lint (safety-critical rules: E9 syntax errors, F63/F7 undefined names, F82 invalid literals)"
        run: |
          uv run --python ${{ matrix.python-version }} --with ruff ruff check --select E9,F63,F7,F82 scripts tests --exclude 'eval-infra/01-omnidocbench'
      - name: Pyright typecheck
        run: |
          uv run --python ${{ matrix.python-version }} --with pyright pyright scripts tests
        continue-on-error: true

  psscriptanalyzer:
    runs-on: windows-latest
    timeout-minutes: 30
    steps:
      - name: Checkout
        uses: actions/checkout@v7.0.1 # v7.0.1 - pin to full SHA before release
      - name: Lint PowerShell
        shell: pwsh
        run: |
          Install-Module PSScriptAnalyzer -RequiredVersion 1.24.0 -Scope CurrentUser -Force -Repository PSGallery
          $errors = Invoke-ScriptAnalyzer -Path . -Recurse -Severity Error
          if ($errors) {
            $errors | Format-Table ScriptName, Line, RuleName, Message -AutoSize | Out-String | Write-Host
            exit 1
          }
          Write-Host "PSScriptAnalyzer: 0 errors"

  bash-syntax:
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - name: Checkout
        uses: actions/checkout@v7.0.1 # v7.0.1 - pin to full SHA before release
      - name: Parse our Bash scripts (repo-owned .sh only; the cloned upstream OmniDocBench tree is excluded)
        run: |
          find eval-infra/02-cdm-environment eval-infra/03-scoring adapters -type f -name '*.sh' -print0 | xargs -0 -n1 bash -n
      - name: "ShellCheck (SC1090: dynamic source is a known false positive)"
        run: |
          sudo apt-get update -qq && sudo apt-get install -y -qq shellcheck
          find eval-infra/02-cdm-environment eval-infra/03-scoring adapters -type f -name '*.sh' -print0 | xargs -0 -n1 shellcheck -S warning -e SC1090

  actionlint:
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - name: Checkout
        uses: actions/checkout@v7.0.1 # v7.0.1 - pin to full SHA before release
      - name: Run actionlint
        run: |
          go run github.com/rhysd/actionlint/cmd/actionlint@v1.7.7 -config-file actionlint.yaml .github/workflows/*.yml
        shell: bash

  markdown-links:
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - name: Checkout
        uses: actions/checkout@v7.0.1 # v7.0.1 - pin to full SHA before release
      - name: Install uv
        uses: astral-sh/setup-uv@v9.0.0 # v9.0.0
        with:
          python-version: '3.11'
          enable-cache: true
      - name: Validate internal markdown links
        run: |
          uv sync --locked --all-groups --python 3.11
          uv run --python 3.11 python -m pytest tests/test_markdown_links.py -q

  dependency-review:
    if: github.event_name == 'pull_request'
    runs-on: ubuntu-latest
    timeout-minutes: 10
    permissions:
      contents: read
      pull-requests: write
    steps:
      - name: Checkout
        uses: actions/checkout@v7.0.1 # v7.0.1 - pin to full SHA before release
      - name: Check Dependency Graph availability
        id: depgraph
        shell: bash
        run: |
          ENABLED=$(gh api repos/${{ github.repository }} --jq '.security_and_analysis.dependency_graph.enabled // false' 2>/dev/null || echo false)
          echo "enabled=$ENABLED" >> "$GITHUB_OUTPUT"
          if [ "$ENABLED" = "true" ]; then
            echo "Dependency Graph enabled - running Dependency Review"
          else
            echo "Dependency Graph not enabled on this repository - skipping Dependency Review (enable at Settings -> Code security and analysis)"
          fi
      - name: Dependency Review
        if: steps.depgraph.outputs.enabled == 'true'
        uses: actions/dependency-review-action@v5.0.0 # v5.0.0 - pin to full SHA before release
        with:
          fail-on-severity: high

  scorecard:
    if: github.event_name == 'push'
    runs-on: ubuntu-latest
    timeout-minutes: 20
    permissions:
      security-events: write
      id-token: write
    steps:
      - name: Checkout
        uses: actions/checkout@v7.0.1 # v7.0.1 - pin to full SHA before release
        with:
          persist-credentials: false
      - name: Run OpenSSF Scorecard
        uses: ossf/scorecard-action@v2.4.1 # v2.4.1 - pin to full SHA before release
        with:
          results_file: results.sarif
          results_format: sarif
          publish_results: true
      - name: Upload SARIF
        uses: actions/upload-artifact@v4.6.2 # v4.6.2 - pin to full SHA before release
        with:
          name: scorecard-sarif
          path: results.sarif

# CI intentionally excludes WSL provisioning, AMD GPU inference, model/dataset
# downloads, TeX/ImageMagick CDM, scoring, and benchmarks. Those require the
# dated physical-machine evidence documented under docs/ (see
# .github/workflows/amd-gpu.yml for the manual self-hosted HIP smoke path).