ci.yml

name: CI

on:
  push:
    branches: [main, master]
  pull_request:

concurrency:
  group: ci-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  quality:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - uses: actions/setup-python@v7
        with:
          python-version: "3.14"
          cache: pip
      - run: pip install -e ".[dev]"
      - name: Ruff check
        run: ruff check src tests eval
      - name: Ruff format
        run: ruff format --check src tests eval
      - name: Mypy
        run: mypy src/analyzer

  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - uses: actions/setup-python@v7
        with:
          python-version: "3.14"
          cache: pip
      - run: pip install -e ".[dev]"
      - name: pip-audit
        run: pip-audit
      - name: Pytest
        run: pytest tests/ -q --cov=src/analyzer --cov-report=term-missing

  eval:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - uses: actions/setup-python@v7
        with:
          python-version: "3.14"
          cache: pip
      - run: pip install -e ".[dev]"
      - name: In-process catalog eval
        run: |
          python - <<'PY'
          import json
          from eval.catalog_loader import load_catalog
          from eval.catalog_runner import run_catalog_inprocess
          from eval.metrics import global_counts, precision_recall_f1
          rows = run_catalog_inprocess(load_catalog())
          counts = global_counts(rows)
          p, r, f1 = precision_recall_f1(counts["TP"], counts["FP"], counts["FN"])
          print(json.dumps({"counts": counts, "precision": p, "recall": r, "f1": f1}))
          assert counts["FN"] == 0, f"FN regression: {counts['FN']}"
          assert counts["FP"] <= 10, f"FP budget exceeded: {counts['FP']}"
          PY

  docker:
    runs-on: ubuntu-latest
    services:
      postgres:
        image: postgres:17-alpine
        env:
          POSTGRES_USER: analyzer
          POSTGRES_PASSWORD: ci-postgres
          POSTGRES_DB: analyzer
        ports:
          - 5432:5432
        options: >-
          --health-cmd "pg_isready -U analyzer"
          --health-interval 5s
          --health-timeout 3s
          --health-retries 10
      redis:
        image: redis:8-alpine
        ports:
          - 6379:6379
        options: >-
          --health-cmd "redis-cli ping"
          --health-interval 5s
          --health-timeout 3s
          --health-retries 10
    steps:
      - uses: actions/checkout@v7
      - uses: docker/setup-buildx-action@v4
      - name: Docker smoke
        env:
          IMAGE: analyzer-ci:local
          POSTGRES_PASSWORD: ci-postgres
          REDIS_PASSWORD: ""
          ANALYZER_API_KEY: ci-smoke-key
        run: bash scripts/ci_docker_smoke.sh