ci.yml

name: ci

on:
  push:
    branches: [main]
  pull_request:

permissions:
  contents: read

concurrency:
  group: ci-${{ github.ref }}
  cancel-in-progress: true

jobs:
  checks:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
      - uses: astral-sh/setup-uv@d4b2f3b6ecc6e67c4457f6d3e41ec42d3d0fcb86 # v5.4.2
        with:
          python-version: "3.11"
      - name: Sync workspace
        run: uv sync --all-packages --locked
      - name: Lint
        run: uv run ruff check .
      - name: Type-check libs
        run: |
          (cd libs/core && uv run mypy src)
          (cd libs/llm && uv run mypy src)
      - name: Test libs/core
        run: cd libs/core && uv run pytest -q --cov=auropro_core --cov-report=term-missing --cov-fail-under=100
      - name: Test libs/llm
        run: cd libs/llm && uv run pytest -q --cov=auropro_llm --cov-report=term-missing --cov-fail-under=100
      - name: Test apps/dla (unit)
        run: cd apps/dla && uv run pytest tests/unit -q
      - name: Test repo scripts
        run: uv run pytest scripts/tests -q --cov=scripts --cov-report=term-missing --cov-fail-under=100
      - name: Samples smoke
        run: |
          uv run python libs/core/samples/quickstart.py
          uv run python libs/llm/samples/quickstart.py
      - name: Workspace pin guard
        run: uv run python scripts/check_workspace_pins.py
      - name: Contract mirror guard
        run: uv run python scripts/check_contract_mirror.py
      - name: License gate (denylist)
        run: uv run python scripts/check_licenses.py
      - name: License gate (allowlist)
        run: |
          IGNORE=$(grep -v '^#' scripts/license_ignore.txt | awk '{print $1}' | grep -v '^$' | tr '\n' ' ')
          uv run pip-licenses --allow-only="MIT License;Apache Software License;BSD License;ISC License (ISCL);Python Software Foundation License;The Unlicense (Unlicense);BSD-3-Clause;BSD-2-Clause;Apache-2.0;MIT;Apache License 2.0;PSF-2.0;Apache-2.0 AND MIT;Apache-2.0 AND CNRI-Python;Apache-2.0 OR BSD-2-Clause;Apache Software License; BSD License;Apache Software License; MIT License;MIT OR Apache-2.0;BSD-3-Clause AND 0BSD AND MIT AND Zlib AND CC0-1.0" --ignore-packages $IGNORE
        shell: bash

  # Wave 8 — the full pipeline against a real Postgres (both committed
  # fixtures), per PR: manifest==disk, zero-diff idempotency re-run, seeded
  # readiness ground truth, exit-code contract, recommender routing.
  e2e:
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        include:
          - fixture: small
            compose: apps/dla/tests/fixtures/postgres/docker-compose.yaml
          - fixture: large
            compose: apps/dla/tests/fixtures/postgres_large/docker-compose.yaml
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
      - uses: astral-sh/setup-uv@d4b2f3b6ecc6e67c4457f6d3e41ec42d3d0fcb86 # v5.4.2
        with:
          python-version: "3.11"
      - name: Sync workspace
        run: uv sync --all-packages --locked
      - name: Start Postgres fixture (${{ matrix.fixture }})
        run: docker compose -f ${{ matrix.compose }} up -d --wait --wait-timeout 120
      - name: E2E (${{ matrix.fixture }} fixture)
        env:
          DLA_E2E_FIXTURE: ${{ matrix.fixture }}
          DLA_DB_PASSWORD: dla_dev_password
        run: cd apps/dla && uv run pytest tests/e2e -q
      - name: Fixture logs (on failure)
        if: failure()
        run: docker compose -f ${{ matrix.compose }} logs --tail 100

  osv-scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
      - name: OSV scan (lockfile)
        uses: google/osv-scanner-action/osv-scanner-action@9a498708959aeaef5ef730655706c5a1df1edbc2 # v2.3.8
        with:
          scan-args: |-
            --config=osv-scanner.toml
            --lockfile=uv.lock