ci.yml

name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

permissions:
  contents: read

jobs:
  use-case-matrix:
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v6

      - name: Set up Python
        uses: actions/setup-python@v6
        with:
          python-version: "3.12"

      - name: Install dependencies
        run: |
          python -m pip install --upgrade pip
          pip install -e ".[dev]"

      - name: Check competitive docs are up to date
        run: python3 scripts/refresh_competitive_docs.py --check

      - name: Sync acceptance tiers section
        run: python3 scripts/sync_acceptance_tiers_doc.py

      - name: Validate docs consistency
        run: python3 scripts/validate_docs_consistency.py

      - name: Upload use-case matrix artifact
        uses: actions/upload-artifact@v7
        with:
          name: use-case-matrix
          path: docs/use-case-matrix.md

  acceptance-p0:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
      - name: Set up Python
        uses: actions/setup-python@v6
        with:
          python-version: "3.12"
      - name: Install dependencies
        run: |
          python -m pip install --upgrade pip
          pip install -e ".[dev]"
      - name: Run acceptance P0
        run: python3 scripts/run_acceptance_tier.py --tier p0

  acceptance-p1:
    runs-on: ubuntu-latest
    needs: acceptance-p0
    steps:
      - uses: actions/checkout@v6
      - name: Set up Python
        uses: actions/setup-python@v6
        with:
          python-version: "3.12"
      - name: Install dependencies
        run: |
          python -m pip install --upgrade pip
          pip install -e ".[dev]"
      - name: Run acceptance P1
        run: python3 scripts/run_acceptance_tier.py --tier p1

  acceptance-all:
    runs-on: ubuntu-latest
    needs: acceptance-p1
    if: github.ref == 'refs/heads/main'
    steps:
      - uses: actions/checkout@v6
      - name: Set up Python
        uses: actions/setup-python@v6
        with:
          python-version: "3.12"
      - name: Install dependencies
        run: |
          python -m pip install --upgrade pip
          pip install -e ".[dev]"
      - name: Run full acceptance suite
        run: python3 scripts/run_acceptance_tier.py --tier all

  test:
    runs-on: ubuntu-latest
    strategy:
      matrix:
        python-version: ["3.10", "3.11", "3.12"]

    steps:
      - uses: actions/checkout@v6

      - name: Set up Python ${{ matrix.python-version }}
        uses: actions/setup-python@v6
        with:
          python-version: ${{ matrix.python-version }}

      - name: Install dependencies
        run: |
          python -m pip install --upgrade pip
          pip install -e ".[dev]"

      - name: Run tests
        run: pytest --cov=teaagent --cov-report=term-missing --cov-fail-under=75

  test-telemetry:
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v6

      - name: Set up Python
        uses: actions/setup-python@v6
        with:
          python-version: "3.12"

      - name: Install dependencies with telemetry extras
        run: |
          python -m pip install --upgrade pip
          pip install -e ".[dev,telemetry]"

      - name: Run telemetry tests
        run: pytest tests/test_telemetry.py -q

  lint:
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v6

      - name: Set up Python
        uses: actions/setup-python@v6
        with:
          python-version: "3.12"

      - name: Install dependencies
        run: |
          python -m pip install --upgrade pip
          pip install -e ".[dev]"

      - name: Lint with ruff
        run: ruff check .

      - name: Check formatting with ruff
        run: ruff format --check .

      - name: Type check with mypy
        run: mypy teaagent/

  governance-gate:
    runs-on: ubuntu-latest
    # Run after lint passes, before package build
    needs: lint

    steps:
      - uses: actions/checkout@v6

      - name: Set up Python
        uses: actions/setup-python@v6
        with:
          python-version: "3.12"

      - name: Install dependencies
        run: |
          python -m pip install --upgrade pip
          pip install -e ".[dev]"

      - name: Run governance fuzz tests
        run: pytest tests/test_governance_fuzz.py -v

      - name: Run tranche BC and approval queue integration tests
        run: pytest tests/test_tranche_bc_governance.py tests/test_subagent_approval_queue_integration.py -v

      - name: Run security selftest
        run: teaagent selftest --root .

      - name: Run tool lint validation
        run: teaagent tool lint --root .

      - name: Validate permission matrix tests
        run: pytest tests/policy/test_permission_matrix.py -v

      - name: Check plan-before-write enforcement
        run: pytest tests/test_tranche_b_governance.py -k "plan" -v

      - name: Run Phase 5 unit tests
        run: pytest tests/test_phase5_context_bus.py tests/test_phase5_workflow_engine.py tests/test_phase5_jit_approval_server.py tests/test_federated_sync.py tests/test_signature_relay.py tests/test_remediation_p1_p2.py -v

      - name: Run Phase 4-5 acceptance and adversarial governance tests
        run: pytest tests/acceptance/test_consensus_flow.py tests/acceptance/test_sandbox_enhancement_flow.py tests/test_governance_adversarial_runtime.py tests/test_skill_executor.py -v

  docker-smoke:
    runs-on: ubuntu-latest
    needs: lint
    # Advisory: Docker/Podman not guaranteed on all forks; failures do not block merge.
    continue-on-error: true

    steps:
      - uses: actions/checkout@v6

      - name: Set up Python
        uses: actions/setup-python@v6
        with:
          python-version: "3.12"

      - name: Install dependencies
        run: |
          python -m pip install --upgrade pip
          pip install -e ".[dev]"

      - name: Run docker sandbox smoke tests
        run: pytest tests/test_phase6_docker.py -v

  package:
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v6

      - name: Set up Python
        uses: actions/setup-python@v6
        with:
          python-version: "3.12"

      - name: Install package tooling
        run: |
          python -m pip install --upgrade pip
          pip install -e ".[release]"

      - name: Build package distributions
        run: python -m build

      - name: Check package distributions
        run: python -m twine check dist/*

      - name: Install wheel and smoke test metadata
        run: |
          python -m venv /tmp/teaagent-wheel-smoke
          /tmp/teaagent-wheel-smoke/bin/python -m pip install --upgrade pip
          /tmp/teaagent-wheel-smoke/bin/python -m pip install dist/*.whl
          /tmp/teaagent-wheel-smoke/bin/python - <<'PY'
          import importlib.resources
          import teaagent

          assert teaagent.__version__
          assert importlib.resources.files('teaagent').joinpath('py.typed').is_file()
          PY