ci.yml

name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

jobs:
  test:
    runs-on: ubuntu-latest
    strategy:
      matrix:
        python-version: ["3.11", "3.12"]

    steps:
      - uses: actions/checkout@v4

      - name: Set up Python ${{ matrix.python-version }}
        uses: actions/setup-python@v5
        with:
          python-version: ${{ matrix.python-version }}

      # clang builds the cmplog/tracecmp shims and the instrumented fuzz
      # targets; z3 backs the SMT path-constraint solver. Neither is pulled
      # by ".[dev]", and conftest.py skips rather than fails without them —
      # so without this step CI silently never runs ~76 tests.
      - name: Install toolchain (clang, z3)
        run: |
          sudo apt-get update
          sudo apt-get install -y clang
          clang --version

      - name: Install dependencies
        run: |
          python -m pip install --upgrade pip
          pip install -e ".[dev,smt]"

      - name: Verify the toolchain-gated tests are not skipped
        run: |
          python - <<'PY'
          import importlib.util, shutil, sys
          missing = [n for n, ok in
                     (("clang", shutil.which("clang")),
                      ("z3", importlib.util.find_spec("z3")))
                     if not ok]
          if missing:
              sys.exit(f"toolchain missing: {', '.join(missing)} — "
                       "conftest.py would skip the tests that need them")
          PY

      # W3: fuzz_loader is gitignored, so a fresh checkout has none. Without
      # it the suite *hangs* rather than fails -- a ForkserverRunner blocks
      # waiting for a reply from a loader that does not exist, and each such
      # test only unblocks after its grace period. conftest.py builds it in a
      # session fixture, but do it explicitly here too: as a step it either
      # succeeds or fails the job with a compiler error, instead of being
      # swallowed by the fixture's best-effort except.
      - name: Build fuzz_loader
        run: |
          python -c "from fuzzer_tool.adapters.forkserver import _ensure_compiled; \
                     import sys; sys.exit(0 if _ensure_compiled() else 'fuzz_loader failed to build')"

      - name: Lint with ruff
        run: ruff check src/ tests/

      # Ratcheted: see the [[tool.mypy.overrides]] block in pyproject.toml.
      # Modules leave the exemption list one at a time; this gate keeps the
      # list from growing.
      - name: Type check with mypy
        run: mypy src/

      - name: Run tests
        run: pytest --cov=fuzzer_tool --cov-report=term-missing