ci.yml

name: CI

on:
  pull_request:
    branches: [main]
  push:
    branches: [main]
  workflow_dispatch:
    inputs:
      run_live:
        description: "Run live provider tests (consumes API tokens)"
        type: boolean
        default: true

permissions:
  contents: read

jobs:
  test:
    name: build / vet / test
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Set up Go
        uses: actions/setup-go@v5
        with:
          go-version: stable
          cache: true

      - name: Build
        run: go build ./...

      - name: gofmt
        run: |
          out=$(gofmt -l .)
          if [ -n "$out" ]; then
            echo "gofmt drift in:"
            echo "$out"
            exit 1
          fi

      - name: Vet
        run: go vet ./...

      - name: Test
        run: go test ./...

  live:
    name: live (gemini)
    needs: test
    # Manual-only: triggered via the "Run workflow" button (workflow_dispatch)
    # to avoid spending API tokens on every push/PR. Run locally for routine
    # verification; dispatch in GitHub when you want CI-side confirmation.
    if: github.event_name == 'workflow_dispatch' && inputs.run_live
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Set up Go
        uses: actions/setup-go@v5
        with:
          go-version: stable
          cache: true

      - name: Live Gemini smoke
        env:
          GEMINI_API_KEY: ${{ secrets.GEMINI_API_KEY }}
        run: |
          if [ -z "$GEMINI_API_KEY" ]; then
            echo "GEMINI_API_KEY not configured; skipping live tests."
            exit 0
          fi
          go test ./providers/gemini -run Live -count=1
          go test ./examples/local-agent -run Live -count=1

  live-nvidia:
    name: live (nvidia)
    needs: test
    # Always-on: build.nvidia.com is free for dev, so we exercise the live
    # provider on every push/PR to catch wire-protocol regressions early.
    # On a manual workflow_dispatch with run_live=false we still skip, so
    # the dispatch toggle remains useful when you explicitly want the test
    # job's other resources without hitting the API. Fork PRs without the
    # secret skip quietly via the runtime guard below. Promote to a
    # required status check once we have a few weeks of green history.
    if: github.event_name != 'workflow_dispatch' || inputs.run_live
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Set up Go
        uses: actions/setup-go@v5
        with:
          go-version: stable
          cache: true

      - name: Live NVIDIA smoke
        env:
          NVIDIA_API_KEY: ${{ secrets.NVIDIA_API_KEY }}
          # Use Llama 3.3 70B in CI: faster first-byte and more stable than
          # Kimi K2.6, while exercising the same OpenAI-compatible wire
          # protocol the provider implements. Local devs default to
          # moonshotai/kimi-k2.6 unless they override NVIDIA_LIVE_MODEL.
          NVIDIA_LIVE_MODEL: meta/llama-3.3-70b-instruct
        run: |
          if [ -z "$NVIDIA_API_KEY" ]; then
            echo "NVIDIA_API_KEY not configured; skipping live tests."
            exit 0
          fi
          go test ./providers/nvidia -run Live -count=1 -timeout 300s

  live-openrouter:
    name: live (openrouter)
    needs: test
    # Always-on (free): openrouter/free auto-routes to a free underlying
    # model so we get real OpenAI-compat coverage on every push/PR.
    # Skips quietly on fork PRs (no secret).
    if: github.event_name != 'workflow_dispatch' || inputs.run_live
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Set up Go
        uses: actions/setup-go@v5
        with:
          go-version: stable
          cache: true

      - name: Live OpenRouter smoke
        env:
          OPENROUTER_API_KEY: ${{ secrets.OPENROUTER_API_KEY }}
          # Use openrouter/free, the meta-router that auto-selects
          # from currently-available free models. Pinning a specific
          # free model burned us twice (#115, May 2026 ring-2.6 → paid;
          # before that, ling-2.6). The meta-router trades determinism
          # for robustness, which is the right call for CI. Local devs
          # who need determinism can override OPENROUTER_LIVE_MODEL.
          # See docs/issue-automation.md "Live OpenRouter model" for
          # the refresh-recipe if the meta-router itself ever breaks.
          OPENROUTER_LIVE_MODEL: openrouter/free
          # agents/glue-review's TestFixtureReplay replays fixtures against
          # the non-deterministic free router. It is a prompt-regression
          # tool, not a per-PR gate, so it is opt-in: only the manual
          # full-live dispatch sets GLUE_REVIEW_LIVE_FIXTURES. On normal
          # push/PR it stays unset and the replay skips, so model-quality
          # variance never flakes an unrelated PR. See issue #283.
          GLUE_REVIEW_LIVE_FIXTURES: ${{ github.event_name == 'workflow_dispatch' && '1' || '' }}
        run: |
          if [ -z "$OPENROUTER_API_KEY" ]; then
            echo "OPENROUTER_API_KEY not configured; skipping live tests."
            exit 0
          fi
          go test ./providers/openrouter -run Live -count=1 -timeout 300s
          # The fixture replay shares this job (and the same free model) but
          # only runs when GLUE_REVIEW_LIVE_FIXTURES is set (manual full-live
          # dispatch); otherwise it skips quickly.
          go test ./agents/glue-review -run TestFixtureReplay -count=1 -timeout 600s