ci.yml

name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

jobs:
  git-hygiene:
    name: Git hygiene (mandatory hooks + attribution)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Configure approved git identity
        run: |
          git config user.name "cyre"
          git config user.email "Lawrence@cyre.me"

      - name: Install mandatory repo hooks
        run: bash scripts/git/install-local-hooks.sh

      - name: Bootstrap private attribution patterns (self-contained)
        run: bash scripts/cursor/ci-bootstrap-private-attribution.sh

      - name: Checkout orama-system (PR branch for stacked cross-repo parity)
        if: github.event_name == 'pull_request'
        id: checkout-orama-pr
        uses: actions/checkout@v4
        with:
          repository: diazMelgarejo/orama-system
          ref: ${{ github.head_ref }}
          path: orama-system
          fetch-depth: 1
          persist-credentials: false
        continue-on-error: true

      - name: Clear orama-system before main fallback
        if: github.event_name != 'pull_request' || steps.checkout-orama-pr.outcome != 'success'
        run: rm -rf orama-system

      - name: Checkout orama-system (main fallback)
        if: github.event_name != 'pull_request' || steps.checkout-orama-pr.outcome != 'success'
        uses: actions/checkout@v4
        with:
          repository: diazMelgarejo/orama-system
          ref: main
          path: orama-system
          fetch-depth: 1
          persist-credentials: false
        continue-on-error: true

      - name: Sync gitignored .cursor/private
        run: |
          if [[ -f orama-system/scripts/cursor/write-openclaw-private-attribution.sh ]]; then
            export ORAMA_SYSTEM_PATH="$GITHUB_WORKSPACE/orama-system"
            bash orama-system/scripts/cursor/write-openclaw-private-attribution.sh
          fi
          bash scripts/cursor/sync-private-attribution-from-home.sh

      - name: Verify docs/adr pointers in sync with orama docs/v2 (zero-fragmentation)
        run: |
          if [ -d orama-system ]; then
            ORAMA_ROOT="$GITHUB_WORKSPACE/orama-system" \
              bash scripts/check_docs_v2_pointer_sync.sh
          else
            echo "skip: orama-system not available in this CI run"
          fi

      - name: Verify model endpoint policy parity with orama-system
        run: |
          if [ -d orama-system ]; then
            ORAMA_SYSTEM_ROOT="$GITHUB_WORKSPACE/orama-system" \
              python3 scripts/review/verify_model_endpoint_policy_parity.py
          else
            echo "skip: orama-system not available in this CI run"
          fi

      - name: Scan tracked files for banned tokens
        run: bash scripts/git/scan-tracked-banned-tokens.sh

      - name: Verify git guards
        run: bash scripts/git/verify-git-guards.sh

      - name: Provision verboten-literals for CI
        # CI checks out this repo in isolation, so repo_hygiene.py's
        # openclaw_workspace_root() ancestor walk never finds a sibling
        # orama-system/ directory the way a local multi-repo checkout does --
        # the private-literal scan silently checks against nothing on CI
        # today. If OPENCLAW_VERBOTEN_LITERALS_CONTENT is provisioned as a
        # repo secret (operator action, not this workflow), write it to an
        # ephemeral runner-temp file and point OPENCLAW_VERBOTEN_LITERALS at
        # it for the rest of this job. No-op (and the scan stays empty, same
        # as today) if the secret isn't set -- safe default for forked-repo
        # PRs, which never receive secrets.
        if: ${{ env.OPENCLAW_VERBOTEN_LITERALS_CONTENT != '' }}
        env:
          OPENCLAW_VERBOTEN_LITERALS_CONTENT: ${{ secrets.OPENCLAW_VERBOTEN_LITERALS_CONTENT }}
        run: |
          literals_path="$RUNNER_TEMP/.verboten-literals.local"
          printf '%s\n' "$OPENCLAW_VERBOTEN_LITERALS_CONTENT" > "$literals_path"
          chmod 600 "$literals_path"
          echo "OPENCLAW_VERBOTEN_LITERALS=$literals_path" >> "$GITHUB_ENV"

      - name: Repo hygiene gate
        run: python3 scripts/review/repo_hygiene.py .

      - name: Local runtime overlay gate (committed config)
        run: python3 scripts/git/check_local_runtime_overlay.py . --mode tree

      - name: Audit branch commit attribution (PR commits)
        if: github.event_name == 'pull_request'
        env:
          BASE_REF: ${{ github.base_ref }}
          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
        run: |
          git fetch origin "$BASE_REF:$BASE_REF" || true
          # actions/checkout checks out refs/pull/*/merge for pull_request events.
          # Audit the contributor's actual head commits, not GitHub's synthetic merge commit.
          RANGE="origin/$BASE_REF..$HEAD_SHA"
          GIT_AUDIT_RANGE="$RANGE" GIT_AUDIT_STRICT=1 bash scripts/git/audit_attribution.sh

      # docs-sync folded in 2026-07-31: same trigger as the rest of this
      # job already (both live in ci.yml), so a second full
      # checkout+Python+pyyaml setup for two lightweight script calls was
      # a redundant runner/checkout, not a real isolation boundary.
      #
      # if: ${{ !cancelled() }} on all 3 steps below is load-bearing, not
      # decorative: without it, a step failure earlier in THIS job (e.g.
      # repo hygiene, banned-token scan) would skip these by GitHub
      # Actions' own default step behavior, silently coupling docs/config
      # sync to git-hygiene's success -- exactly the independent-execution
      # property docs-sync had as its own separate job before this fold.
      # !cancelled() (not always()) deliberately still skips these on a
      # genuine manual cancellation, which always() would not.
      - name: Install pyyaml (for docs/config sync checks below)
        if: ${{ !cancelled() }}
        run: pip install pyyaml

      - name: Validate hardware/SKILL.md matches config/models.yml
        if: ${{ !cancelled() }}
        run: python scripts/check_docs_sync.py --quiet

      - name: Reject stale model as default_primary_model
        if: ${{ !cancelled() }}
        run: |
          # Only fail if qwen3.5-35b-a3b-q4 is set as the PRIMARY model.
          # It may still appear as a legacy fallback entry — that is intentional.
          if grep "default_primary_model:.*qwen3.5-35b-a3b-q4" hardware/SKILL.md; then
            echo "FAIL: stale model 'qwen3.5-35b-a3b-q4' is set as default_primary_model — update to canonical LM Studio model"
            exit 1
          fi
          echo "OK: default_primary_model is not a stale reference"

  lint-and-test:
    needs: [git-hygiene]
    runs-on: ubuntu-latest
    strategy:
      matrix:
        python-version: ["3.11", "3.12"]

    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Bootstrap private attribution patterns (self-contained)
        run: bash scripts/cursor/ci-bootstrap-private-attribution.sh

      - name: Set up Python ${{ matrix.python-version }}
        uses: actions/setup-python@v5
        with:
          python-version: ${{ matrix.python-version }}

      - name: Install dependencies
        run: |
          python -m pip install --upgrade pip
          # Core test deps + runtime deps needed by orchestrator.py at import time
          pip install pytest pytest-asyncio pytest-cov pyyaml
          pip install fastapi aiohttp redis httpx python-dotenv loguru pydantic
          # fix(ci): slowapi must be present before orchestrator.py can be imported
          pip install slowapi
          # fix(ci): respx is used by tests/discovery/ for mocking httpx calls
          pip install respx
          # fix(ci): hypothesis is used by tests/test_state_transition_manager.py
          # for property-based tests (declared in pyproject.toml's dev extra, but
          # this step installs an explicit list rather than `pip install -e .[dev]`,
          # so it needs to be listed here too or CI diverges from pyproject.toml).
          pip install hypothesis
          if [ -f requirements.txt ]; then pip install -r requirements.txt; fi

      - name: Lint with flake8 (warnings only)
        run: |
          pip install flake8
          flake8 . --count --max-line-length=120 --statistics --exit-zero
        continue-on-error: true

      - name: Run tests
        run: |
          pytest tests/ -v --tb=short
        env:
          ORAMA_ENDPOINT: http://localhost:8001/orama
          ORAMA_TIMEOUT: "120"
          ORAMA_ENABLED: "false"

      - name: Check routing.yml validity
        run: |
          python -c "
          import yaml
          with open('config/routing.yml') as f:
            cfg = yaml.safe_load(f)
          assert 'routes' in cfg, 'routes key missing'
          assert 'deep_reasoning' in cfg['routes'], 'deep_reasoning route missing'
          assert 'code_analysis' in cfg['routes'], 'code_analysis route missing'
          print('routing.yml OK -- all required routes present')
          "