ci.yml

name: CI

on:
  pull_request:

permissions:
  contents: read

jobs:
  checks:
    runs-on: ubuntu-latest
    env:
      # Settings() is a module-level singleton and validates on import, so
      # every test run needs a value here even though nothing calls the LLM.
      # Not a real secret — the app refuses to boot without SOME key, by
      # design (see app/config.py) — so a fixed placeholder is fine to keep
      # in plain text rather than a GitHub secret.
      SCREENING_SERVICE_API_KEY: ci-placeholder-not-a-real-secret
    steps:
      - uses: actions/checkout@v4
        with:
          persist-credentials: false

      - name: Install uv
        uses: astral-sh/setup-uv@v3
        with:
          version: "0.11.6"
          enable-cache: true          # caches deps — torch/transformers are heavy

      - name: Set up Python
        run: uv python install 3.14

      - name: Sync dependencies
        run: uv sync --frozen --python 3.14

      - name: Type check
        run: uv run ty check

      - name: Test (deterministic only)
        run: uv run pytest -m "not live and not prod and not quality"