ci.yml

name: CI

on:
  push:
    branches: [main]
  pull_request:

permissions:
  contents: read

jobs:
  quality:
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@v7
      - uses: actions/setup-python@v7
        with:
          python-version: "3.12"
          cache: pip
      - name: Install
        run: python -m pip install -e ".[dev]"
      - name: Build immutable Docker sandbox image
        shell: pwsh
        run: |
          $imagePath = Join-Path $env:RUNNER_TEMP "agentloom-sandbox-image.txt"
          ./deploy/sandbox/build-runner.ps1 -OutputPath $imagePath
          $imageId = (Get-Content -LiteralPath $imagePath -Raw).Trim()
          if ($imageId -notmatch "^sha256:[a-f0-9]{64}$") {
            throw "Sandbox build did not produce an immutable image ID"
          }
          Add-Content -LiteralPath $env:GITHUB_ENV `
            -Value "AGENTLOOM_TEST_SANDBOX_IMAGE=$imageId" `
            -Encoding utf8
      - name: Test
        run: python -m pytest
      - name: Verify Full test snapshot
        shell: pwsh
        run: |
          # The committed snapshot is the local Lite baseline. CI has Docker
          # enabled, so its 380/0 result belongs in a runner-local artifact.
          $fullSnapshot = Join-Path $env:RUNNER_TEMP "agentloom-full-test-results.txt"
          $ciPython = (Get-Command python -ErrorAction Stop).Source
          ./scripts/refresh-test-results.ps1 -VenvPython $ciPython -OutputPath $fullSnapshot
          Write-Host "Full test snapshot: $fullSnapshot"
      - name: Lint
        run: ruff check .
      - name: Type check
        run: mypy src tests
      - name: Audit dependencies
        run: python -m pip_audit .
      - name: Parse deployment scripts
        shell: pwsh
        run: |
          $failed = $false
          Get-ChildItem scripts/*.ps1,deploy/agentteams/*.ps1 | ForEach-Object {
            $tokens = $null
            $parseErrors = $null
            [System.Management.Automation.Language.Parser]::ParseFile(
              $_.FullName,
              [ref]$tokens,
              [ref]$parseErrors
            ) | Out-Null
            if ($parseErrors.Count -gt 0) {
              $failed = $true
              $parseErrors | ForEach-Object { Write-Error $_.Message }
            }
          }
          if ($failed) { exit 1 }
      - name: Build source and wheel distributions
        run: python -m build
      - name: Smoke test installed wheel
        run: |
          python -m venv .tmp/release-venv
          .tmp/release-venv/bin/python -m pip install --disable-pip-version-check dist/*.whl
          .tmp/release-venv/bin/python -c "import importlib.metadata as m; import agentloom; assert m.version('agentloom') == agentloom.__version__"
          .tmp/release-venv/bin/agentloom --help