ci: GitHub Actions for backend, UI, and Docker build (#6)

* chore: fix ruff unused-import errors

* style: remove stray blank line in test_generate_router_dataset.py

* fix: resolve pre-existing tsc and eslint errors in UI

* ci: add GitHub Actions workflow (backend + ui + docker build)

* ci: fix hidden network dependency in backend tests

- Several rag-chat endpoint tests didn't mock enqueue_memory_refresh,
  a fire-and-forget outbox write. They only passed locally because
  the (gitignored) .env pointed at a real Supabase project; in CI
  there's no such project, so the write failed. Mock it by default
  in conftest.py; tests that care about the call still patch/assert
  it explicitly.
- Backend Test step now sets dummy SUPABASE_URL/SECRET_KEY/JWKS_URL
  env vars so Settings' "is this configured" checks pass without a
  real project. example.com is used because it actually resolves via
  DNS (unlike a fabricated *.supabase.co host), even though invalid
  JWTs fail parsing before any network call is made.

* test: fix flaky race on fire-and-forget Neo4j persistence task

_execute_research_run schedules Neo4j persistence via asyncio.create_task,
intentionally decoupled from run completion. The test asserted on it right
after asyncio.run() returned, racing the background task — it usually won
locally but lost more often on the slower/loaded GitHub Actions runner.
Drain pending tasks before asserting so the test is deterministic.

* ci: add job timeouts and clarify non-blocking mypy step

Author: KostasCherv

.github/workflows/ci.yml

@@ -0,0 +1,66 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+jobs:
+  backend:
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@v4
+      - uses: astral-sh/setup-uv@v5
+        with:
+          enable-cache: true
+      - name: Install
+        run: uv sync --extra dev
+      - name: Lint
+        run: uv run ruff check src tests
+      - name: Typecheck (non-blocking)
+        # 38 pre-existing errors as of this workflow's introduction; tighten
+        # once the backlog is cleared instead of blocking every PR on it.
+        run: uv run mypy src || true
+      - name: Test
+        env:
+          # Dummy values so config "is this configured?" checks pass; no real
+          # network calls are made in the mocked test suite (see auth.py /
+          # supabase_store.py — invalid tokens fail parsing before any
+          # request reaches these URLs).
+          SUPABASE_URL: https://example.com
+          SUPABASE_SECRET_KEY: dummy-secret-key-for-ci
+          SUPABASE_JWKS_URL: https://example.com/auth/v1/.well-known/jwks.json
+        run: uv run python -m pytest tests/ -q
+
+  ui:
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    defaults:
+      run:
+        working-directory: ui
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: npm
+          cache-dependency-path: ui/package-lock.json
+      - name: Install
+        run: npm ci
+      - name: Lint
+        run: npx eslint src --max-warnings=0
+      - name: Typecheck
+        run: npx tsc --noEmit -p tsconfig.app.json
+      - name: Test
+        run: npx vitest run
+
+  docker:
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    if: github.ref == 'refs/heads/main'
+    needs: [backend, ui]
+    steps:
+      - uses: actions/checkout@v4
+      - name: Build image
+        run: docker build -t cortex:${{ github.sha }} .

src/api/rag_chat_helpers.py

@@ -5,7 +5,6 @@
 import asyncio
 import logging
 import time
-import uuid
 from dataclasses import dataclass, field
 from typing import TYPE_CHECKING, Any
 
@@ -28,16 +27,13 @@
 from src.prompts.registry import prompt_registry
 from src.config import settings
 from src.rag import (
-    RagChatMessage,
-    append_chat_message,
     create_or_get_chat_session,
     create_or_get_workspace_chat_session,
     get_agent_for_chat,
     list_chat_messages as list_rag_chat_messages,
     list_rag_chat_session_attachments,
-    list_ready_rag_chat_session_attachment_resource_ids,
+    list_ready_rag_chat_session_attachment_resource_ids,  # noqa: F401 - patched by tests/conftest.py
     list_workspace_ready_resource_ids,
-    retrieve_context_for_query,
     retrieve_merged_context_for_agent_chat,
 )
 from src.rag_engine import RagQueryResult

tests/conftest.py

@@ -25,6 +25,19 @@ def mock_list_ready_session_attachment_resource_ids():
         yield
 
 
+@pytest.fixture(autouse=True)
+def mock_enqueue_memory_refresh():
+    # ponytail: several endpoint tests don't mock this fire-and-forget outbox
+    # write and previously only passed because a local .env pointed at a real
+    # Supabase project. Default it to a no-op here; tests that care about the
+    # call still patch/assert it explicitly (see test_api.py:1363).
+    with patch(
+        "src.api.endpoints.enqueue_memory_refresh",
+        new=AsyncMock(return_value=False),
+    ):
+        yield
+
+
 @pytest.fixture(autouse=True)
 def mock_list_session_attachments():
     with (

tests/finetune/test_generate_router_dataset.py

@@ -2,8 +2,6 @@
 import json
 from pathlib import Path
 
-import pytest
-
 from scripts.generate_router_dataset import deduplicate_inputs, split_records, write_jsonl
 
 _ACTIONS = [

tests/test_api.py

@@ -485,14 +485,24 @@ def _mock_trace_ctx(**_kwargs):
         patch("src.api.endpoints.start_workflow_run", side_effect=_mock_trace_ctx),
         patch("src.api.endpoints.end_workflow_run"),
     ):
-        asyncio.run(
-            _execute_research_run(
+
+        async def _run_and_drain() -> None:
+            # ponytail: _execute_research_run fires Neo4j persistence via a
+            # fire-and-forget asyncio.create_task (intentionally decoupled
+            # from run completion). asyncio.run() only awaits the main
+            # coroutine, so the background task's completion is a race —
+            # drain pending tasks here so the assertion below is deterministic.
+            await _execute_research_run(
                 session_id="session-1",
                 run_id="run-1",
                 user_id="user-1",
                 query="What is LangGraph?",
             )
-        )
+            pending = [t for t in asyncio.all_tasks() if t is not asyncio.current_task()]
+            if pending:
+                await asyncio.gather(*pending)
+
+        asyncio.run(_run_and_drain())
 
     assert any(
         call.kwargs.get("patch", {}).get("status") == "completed"

tests/test_dspy_optimizer.py

@@ -2,17 +2,15 @@
 
 from __future__ import annotations
 
-import json
 from pathlib import Path
-from unittest.mock import MagicMock, PropertyMock, patch
+from unittest.mock import MagicMock, patch
 
 import dspy
 import pytest
 
 from src.prompts.dspy_optimizer import (
     DspyPromptOptimizer,
     FollowupAnswerModule,
-    OptimizedPrompt,
     OptimizationResult,
     RagChatSystemModule,
     ReportModule,

ui/src/components/chat/ChatThreadContainer.tsx

@@ -293,7 +293,7 @@ export function ChatThreadContainer({
     async (files: File[]) => {
       if (files.length === 0 || !transport.uploadAttachments || !transport.ensureSession) return
 
-      const uploadIds = files.map(() => crypto.randomUUID())
+      const uploadIds: string[] = files.map(() => crypto.randomUUID())
       setPendingUploads((prev) => [
         ...prev,
         ...files.map((file, index) => ({

ui/src/components/chat/transports.ts

@@ -158,7 +158,7 @@ export const workspaceChatTransport: ChatTransport = {
   deleteAttachment: async (sessionId, attachmentId, accessToken) => {
     await deleteRagWorkspaceChatSessionAttachment(sessionId, attachmentId, accessToken)
   },
-  streamMessage: async (message, sessionId, accessToken, callbacks, tools, _files) => {
+  streamMessage: async (message, sessionId, accessToken, callbacks, tools) => {
     await streamRagWorkspaceChat(message, sessionId, accessToken, {
       signal: callbacks.signal,
       onSession: callbacks.onSession,