ci.yml

name: CI

on:
  push:
  pull_request:

jobs:
  migrations:
    if: github.event_name == 'pull_request' || github.ref == 'refs/heads/master'
    runs-on: ubuntu-latest
    services:
      postgres:
        image: postgres:16-alpine
        env:
          POSTGRES_DB: rag_assistant
          POSTGRES_USER: rag
          POSTGRES_PASSWORD: rag_dev_password
        ports:
          - 5432:5432
        options: >-
          --health-cmd "pg_isready -U rag -d rag_assistant"
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5
    env:
      DATABASE_URL: postgresql://rag:rag_dev_password@localhost:5432/rag_assistant
      DB_ENCRYPTION_KEY: ci-test-key-32-characters-long-xyz

    steps:
      - uses: actions/checkout@v6

      - uses: actions/setup-python@v6
        with:
          python-version: "3.13"
          cache: "pip"
          cache-dependency-path: requirements.lock

      - name: Install dependencies
        run: |
          python -m pip install --upgrade pip
          pip install --require-hashes -r requirements.lock

      - name: Run migration round-trip audit
        run: python scripts/migration_round_trip.py

  helm:
    if: github.event_name == 'pull_request' || github.ref == 'refs/heads/master'
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v6

      - uses: azure/setup-helm@v4

      - name: Helm lint
        run: helm lint deploy/helm/ --strict

      - name: Render chart
        run: |
          helm template deploy/helm/ --values deploy/helm/values.yaml \
            --set secrets.existingSecret=ci-placeholder \
            --set env.CORS_ORIGINS=https://support.example.com \
            --set postgresql.auth.password=ci-placeholder \
            > /tmp/rendered.yaml

      - uses: helm/kind-action@v1

      - name: Client dry-run
        run: kubectl apply --dry-run=client -f /tmp/rendered.yaml

  lint:
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v6

      - uses: actions/setup-python@v6
        with:
          python-version: "3.13"
          cache: "pip"
          cache-dependency-path: |
            requirements-dev.lock

      - name: Install dependencies
        run: |
          python -m pip install --upgrade pip
          pip install --require-hashes -r requirements-dev.lock

      - name: Lint
        run: ruff check .

  type-check:
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v6

      - uses: actions/setup-python@v6
        with:
          python-version: "3.13"
          cache: "pip"
          cache-dependency-path: |
            requirements-dev.lock

      - name: Install dependencies
        run: |
          python -m pip install --upgrade pip
          pip install --require-hashes -r requirements-dev.lock

      - name: Run mypy on strict scope
        # Strict modules (auth, db.*, llm.providers, config/settings.py,
        # agent/state.py, agent/prompts.py, agent/prompt_registry.py,
        # agent/tools.py, agent/graph.py, tasks.*, utils.*, monitoring.*,
        # channels.*, tracing.*, ingestion.*, evaluation.*, api/app.py +
        # api/_shared.py, api/correlation.py, api/rate_limit.py, api/routers/*,
        # vectordb.*) must remain green. Codex audit 2026-04-27 H3 + next-steps
        # Steps 6, 9 + api.app strict promotion 2026-04-28 + db/tasks/utils
        # 2026-06-13 + monitoring/channels 2026-06-13 + tracing/ingestion
        # 2026-06-13 + evaluation 2026-06-13 + api routers/helpers 2026-06-14 +
        # vectordb 2026-06-14.
        # The first (main) path list is kept in sync across this job,
        # scripts/local-gate.ps1, and scripts/autopilot.ps1 by
        # test_mypy_strict_scope_is_synced_across_gates. The second command keeps
        # --follow-imports=skip for its heavy-graph modules: api/_shared.py
        # transitively imports api.app, whose full FastAPI graph times out under
        # mypy, and vectordb pulls langchain/sentence-transformers, whose type
        # graph spikes memory. It is intentionally outside the sync guard.
        run: |
          python -m mypy auth db llm/providers/ config/settings.py agent/state.py agent/prompts.py agent/prompt_registry.py agent/tools.py agent/graph.py tasks utils monitoring channels tracing ingestion evaluation --no-incremental --show-error-codes
          python -m mypy api/app.py api/_shared.py api/correlation.py api/rate_limit.py api/routers vectordb --no-incremental --follow-imports=skip --show-error-codes

  test-unit:
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        python-version: ["3.11", "3.13"]

    steps:
      - uses: actions/checkout@v6

      - uses: actions/setup-python@v6
        with:
          python-version: ${{ matrix.python-version }}
          cache: "pip"
          cache-dependency-path: |
            requirements-dev.lock

      - name: Install dependencies
        run: |
          python -m pip install --upgrade pip
          pip install --require-hashes -r requirements-dev.lock

      - name: Run unit tests
        run: pytest tests/ -q --ignore=tests/integration -p no:cacheprovider

  test-integration:
    # Codex audit 2026-04-27 H4: integration job must block PRs.
    # If a Postgres/Redis-backed test fails, the PR should turn red.
    runs-on: ubuntu-latest
    timeout-minutes: 20
    strategy:
      fail-fast: false
      matrix:
        python-version: ["3.11", "3.13"]
    services:
      postgres:
        image: postgres:16
        env:
          POSTGRES_DB: rag_test
          POSTGRES_USER: rag
          POSTGRES_PASSWORD: rag_test_password
        ports:
          - 5432:5432
        options: >-
          --health-cmd "pg_isready -U rag -d rag_test"
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5
      redis:
        image: redis:7
        ports:
          - 6379:6379
        options: >-
          --health-cmd "redis-cli ping"
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5
    env:
      DATABASE_URL: postgresql+asyncpg://rag:rag_test_password@127.0.0.1:5432/rag_test
      REDIS_URL: redis://127.0.0.1:6379/0
      OLLAMA_BASE_URL: http://127.0.0.1:65535

    steps:
      - uses: actions/checkout@v6

      - uses: actions/setup-python@v6
        with:
          python-version: ${{ matrix.python-version }}
          cache: "pip"
          cache-dependency-path: |
            requirements-dev.lock

      - name: Install dependencies
        run: |
          python -m pip install --upgrade pip
          pip install --require-hashes -r requirements-dev.lock

      - name: Run integration tests
        run: pytest tests/integration -q --timeout=120 --timeout-method=thread

  pre-commit:
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v6

      - uses: actions/setup-python@v6
        with:
          python-version: "3.13"
          cache: "pip"

      - name: Install pre-commit
        run: |
          python -m pip install --upgrade pip
          pip install pre-commit==4.5.1

      - name: Run pre-commit
        run: pre-commit run --all-files

  security:
    # Codex audit 2026-04-27 next-steps Step 7: bandit + pip-audit run as
    # blocking PR gates (also live in pre-commit, but a dedicated job
    # surfaces them clearly in GitHub Checks and audits the locked deps,
    # not the loose constraint file).
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v6

      - uses: actions/setup-python@v6
        with:
          python-version: "3.13"
          cache: "pip"

      - name: Install audit tooling
        run: |
          python -m pip install --upgrade pip
          pip install bandit[toml]==1.9.4 pip-audit==2.10.0

      - name: Bandit static analysis
        # -ll: Medium+ severity blocks. Low findings are advisory only.
        run: bandit -r . -ll -c pyproject.toml -x ./tests,./.venv,./reports,./data,./archive-legacy,./.tmp

      - name: pip-audit (locked dependencies)
        # --disable-pip: skip pip resolution; the lock is already complete.
        # --require-hashes: enforce that every line carries a sha256.
        # CVE-2026-45829/GHSA-f4j7-r4q5-qw2c is an unfixed ChromaDB server
        # advisory (PyPI fixed_in is empty). This app uses embedded
        # PersistentClient, not an exposed Chroma server; keep Chroma latest and
        # retain a narrow ignore until upstream publishes a fixed release.
        # CVE-2025-3000 is an unfixed torch advisory (local memory corruption in
        # torch.jit.script, PyPI fixed_in empty). torch is used only for local
        # sentence-transformers inference and torch.jit.script never receives
        # untrusted input; drop the ignore once an upstream fix ships. Keep this
        # list in sync with the pip-audit hook in .pre-commit-config.yaml.
        run: >
          pip-audit --strict --disable-pip --require-hashes
          --timeout 15
          --progress-spinner off
          --cache-dir .tmp/pip-audit-cache
          --ignore-vuln CVE-2026-45829
          --ignore-vuln GHSA-f4j7-r4q5-qw2c
          --ignore-vuln CVE-2025-3000
          -r requirements.lock

  regression-eval:
    # Deterministic PR gate: experiment targets use mock runtime and report-only
    # mode, so this does not require Ollama, vector-store setup, or database
    # persistence.  When regression inputs and the curated dataset are present,
    # the script exit code enforces the regression gate.
    if: github.event_name == 'pull_request'
    name: regression-eval
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v6
        with:
          fetch-depth: 0

      - uses: dorny/paths-filter@v4
        id: regression_changes
        with:
          list-files: shell
          filters: |
            regression:
              - 'agent/prompts.py'
              - 'config/settings.py'
              - 'evaluation/curated_cases.jsonl'
              - 'evaluation/experiments/*.yaml'

      - name: Skip when regression inputs did not change
        if: steps.regression_changes.outputs.regression != 'true'
        run: echo "No prompt/settings/experiment changes detected."

      - uses: actions/setup-python@v6
        if: steps.regression_changes.outputs.regression == 'true'
        with:
          python-version: "3.13"
          cache: "pip"
          cache-dependency-path: |
            requirements-dev.lock

      - name: Install dependencies
        if: steps.regression_changes.outputs.regression == 'true'
        run: |
          python -m pip install --upgrade pip
          pip install --require-hashes -r requirements-dev.lock

      - name: Resolve regression candidate
        if: steps.regression_changes.outputs.regression == 'true'
        id: regression_target
        shell: bash
        run: |
          candidate="current"
          for file in ${{ steps.regression_changes.outputs.regression_files }}; do
            if [[ "$file" == evaluation/experiments/*.yaml ]]; then
              candidate="$(basename "$file" .yaml)"
              break
            fi
          done
          echo "candidate=$candidate" >> "$GITHUB_OUTPUT"

      - name: Skip when curated dataset is unavailable
        if: steps.regression_changes.outputs.regression == 'true' && !hashFiles('evaluation/curated_cases.jsonl')
        run: echo "evaluation/curated_cases.jsonl is missing; skipping informational regression run."

      - name: Run regression eval
        if: steps.regression_changes.outputs.regression == 'true' && hashFiles('evaluation/curated_cases.jsonl')
        run: >
          python scripts/regression_eval.py
          --baseline current
          --candidate ${{ steps.regression_target.outputs.candidate }}
          --dataset evaluation/curated_cases.jsonl
          --tenant all
          --max-cases 100
          --seed 42
          --mock-experiment-runtime
          --no-persist