ci.yml

name: CI

on:
  push:
    branches: [main]
  pull_request:
  workflow_dispatch:

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

defaults:
  run:
    shell: bash

jobs:
  check:
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, windows-latest]
        python-version: ["3.12", "3.13"]

    steps:
      - uses: actions/checkout@v4

      - uses: astral-sh/setup-uv@v5
        with:
          enable-cache: true
          cache-dependency-glob: "pyproject.toml"

      # A venv pinned to the matrix version, put on PATH. Deliberately not
      # `uv run`: without a lockfile that re-resolves the project across every
      # interpreter `requires-python` allows, which fails on a dependency that
      # has nothing to do with the version under test. `uv pip --system` is
      # also out -- the Linux runner's interpreter is externally managed, and
      # it would silently ignore the matrix version.
      - name: Install
        run: |
          uv venv --python ${{ matrix.python-version }}
          uv pip install -e ".[dev]"
          if [ -d .venv/Scripts ]; then echo "$PWD/.venv/Scripts" >> "$GITHUB_PATH"
          else echo "$PWD/.venv/bin" >> "$GITHUB_PATH"; fi

      # A matrix that silently tests one version twice reports coverage it
      # does not have. This is the guard against that.
      - name: Confirm the interpreter is the one the matrix asked for
        run: |
          python -c "import sys; v='${{ matrix.python-version }}'; assert sys.version.startswith(v), f'wanted {v}, got {sys.version}'; print(sys.version)"

      - name: Lint
        run: ruff check .

      - name: Type check
        run: mypy

      # The whole suite runs against the mock provider: no credentials, no
      # network, no cost. That is a deliberate property of the architecture --
      # a company of a hundred agents has to be free to test.
      - name: Test
        run: pytest -q

      # The playbook regression gate (ADR-0005). A revision of the company's
      # critique procedure that catches fewer real defects on the scenario
      # suite fails here and does not ship. Offline, deterministic and free --
      # the worlds are generated, so this never waits on a market.
      - name: Playbook regression
        run: |
          aurelis training regression
          # And the gate must actually bite. A blunted survivorship check
          # misses defects that are really there, so this must exit non-zero;
          # a gate that passed everything would be worse than no gate.
          if aurelis training regression --defect survivorship --degradation 5; then
            echo "the regression gate accepted a procedure that finds less" >&2
            exit 1
          fi

      - name: End-to-end acceptance
        run: |
          workspace="${RUNNER_TEMP}/aurelis-ci"
          mkdir -p "$workspace"
          aurelis db init -w "$workspace"
          aurelis doctor -w "$workspace"
          aurelis demo -w "$workspace"
          # Staffing routes through onboarding: every hire is scored on the
          # scenario suite before it may work, and the roster prints what each
          # one started with.
          aurelis agent hire -w "$workspace"
          aurelis training roster -w "$workspace"
          # The company reorganises itself twice, against predictions hashed
          # before the Board saw them. The first one fails; the record says so.
          aurelis orgdev develop -w "$workspace"
          aurelis orgdev changes -w "$workspace"
          aurelis orgdev metrics -w "$workspace"
          aurelis ledger verify -w "$workspace"