test.yml

name: tests

# The suite is ~485 offline cases with no network and no paid LLM calls, so it can
# run on every push. Until this existed it ran only when someone remembered to type
# `pytest` (doc/architecture/CODE_TOUR.md documents it as a manual step) — tests that nothing runs
# protect nothing.
#
# NOTE: this workflow is a SIGNAL, not a merge gate. Making it blocking needs a branch
# protection rule / ruleset naming the `suite` job as a required status check, which is
# a repository setting and cannot be done from a commit.

on:
  push:
  pull_request:
  merge_group:
  workflow_dispatch:

permissions:
  contents: read

jobs:
  suite:
    runs-on: ubuntu-latest
    steps:
      # Full history, not the default depth-1 shallow clone. check_spec_freshness
      # dates each source file with `git log -1 -- <path>`, and in a shallow clone
      # the single commit has no parent, so git reports EVERY tracked file as
      # created in it. All 62 SPEC pages then read as modified today and the
      # strict check fails wholesale. It only ever passed because the tip commit
      # happened to predate the pages' verified-against: dates; the first commit
      # made on a later day broke all 62 at once.
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - uses: actions/setup-python@v5
        with:
          python-version: "3.12"

      # pytest lives in the `dev` extra; `mcp` is needed for the MCP server tests;
      # `kb` (cryptography) for the knowledge service's signing.
      - name: Install
        run: pip install -e ".[dev,mcp,kb]"

      - name: Unit tests
        run: python -m pytest -q

      - name: CLI smoke
        run: infermatrix-copilot --help

      # doctor exits 1 when credentials are absent, which is the expected state in CI.
      # The claim under test is "it runs and emits valid JSON", not "it is configured",
      # so tolerate 0/1 explicitly rather than piping into a parser — steps run under
      # `pipefail`, where the expected exit 1 would fail the step.
      - name: doctor emits valid JSON
        run: |
          infermatrix-copilot doctor --json > doctor.json || [ $? -le 1 ]
          python -c "import json; json.load(open('doctor.json'))"

      # test_packaged_runtime.py asserts on pyproject's TEXT, so nothing else proves the
      # force-include data trees actually ship. Build the artifact and import it from a
      # clean venv, where a missing tree cannot be masked by the source checkout.
      - name: Wheel ships its runtime data
        run: |
          pip install build
          python -m build --wheel
          python -m venv /tmp/clean
          /tmp/clean/bin/pip install --quiet dist/*.whl
          cd /tmp   # import the INSTALLED package, never the source checkout
          /tmp/clean/bin/python - <<'PY'
          import importlib.metadata
          import importlib.resources
          import sys
          import tempfile
          from pathlib import Path
          from infermatrix_copilot import __version__
          from infermatrix_copilot.sdk.v1 import (
              ChangedPath, DirectClient, DirectReviewRequest,
              KNOWLEDGE_API_VERSION,
              KnowledgeCurator, KnowledgeEvidenceBatch,
              KnowledgeEvidenceEvent, RepositoryRef, StrictRuntime,
              get_capabilities,
          )
          forbidden = {
              "infermatrix_copilot.config",
              "infermatrix_copilot.contract",
              "infermatrix_copilot.direct_routing",
              "infermatrix_copilot.mcp_server",
          }
          loaded = sorted(forbidden.intersection(sys.modules))
          if loaded:
              sys.exit(f"public SDK import loaded private implementation: {loaded}")
          caps = get_capabilities()
          if "vllm-gr" not in caps.supported_repositories:
              sys.exit("installed SDK omits vLLM-GR review support")
          dist_version = importlib.metadata.version("infermatrix-copilot")
          if not (__version__ == dist_version == caps.distribution_version == "0.2.0"):
              sys.exit(
                  "version mismatch: "
                  f"module={__version__}, metadata={dist_version}, "
                  f"capabilities={caps.distribution_version}"
              )
          if not caps.resource_revision.startswith("sha256:"):
              sys.exit("SDK capabilities have no resource revision")
          if not caps.supports_knowledge_curation:
              sys.exit("SDK capabilities omit knowledge curation")
          if not (
              caps.knowledge_api_version == KNOWLEDGE_API_VERSION == "1.1.0"
          ):
              sys.exit("installed SDK knowledge API version mismatch")
          if KnowledgeCurator.proposal_schema(max_rules=3)["properties"][
              "rules"
          ]["maxItems"] != 3:
              sys.exit("installed SDK has a broken knowledge proposal schema")
          evidence = KnowledgeEvidenceBatch(
              batch_id="wheel-smoke",
              repository=RepositoryRef(alias="vllm-omni"),
              events=(KnowledgeEvidenceEvent(
                  event_id="event-1", source_kind="merged_pr",
                  source_reference="PR #1", title="wheel smoke",
              ),),
          )
          if evidence.to_dict()["events"][0]["event_id"] != "event-1":
              sys.exit("installed SDK knowledge models are not serializable")
          if not importlib.resources.files("infermatrix_copilot").joinpath(
              "py.typed"
          ).is_file():
              sys.exit("wheel does not ship py.typed")

          from infermatrix_copilot.config import _resource_dir, _RESOURCE_MARKERS
          # resolve through the production probe and require its marker to exist:
          # a present-but-empty directory would satisfy a bare is_dir() check
          bad = []
          for name, marker in _RESOURCE_MARKERS.items():
              d = _resource_dir(name)
              if not d.is_dir():
                  bad.append(f"{name}: {d} missing")
              elif not any(m.is_file() for m in d.glob(marker)):
                  bad.append(f"{name}: {d} has no {marker}")
          if bad:
              sys.exit("wheel runtime data broken: " + "; ".join(bad))
          client = DirectClient()
          for repo, changed in (
              ("vllm-omni", "vllm_omni/core/sched/scheduler.py"),
              ("afd-plugin", "afd_plugin/compat/vllm.py"),
          ):
              plan = client.plan(DirectReviewRequest(
                  review_id="wheel-smoke",
                  repository=RepositoryRef(alias=repo),
                  pr_number=1,
                  expected_head_sha="a" * 40,
                  title="runtime change",
                  body="exercise the installed SDK",
                  changed_paths=(ChangedPath(changed),),
              ))
              if not plan.knowledge_routes:
                  sys.exit(f"installed SDK did not route {repo}")
              if any("/" == ref.document.document_id[:1]
                     for ref in plan.knowledge_routes):
                  sys.exit("installed SDK leaked an absolute document path")
              if Path(plan.navigation_policy["fallback_document_id"]).is_absolute():
                  sys.exit("installed SDK leaked an absolute fallback path")
          with tempfile.TemporaryDirectory() as run_root:
              with StrictRuntime(settings_overrides={
                  "_env_file": None, "run_root": run_root,
              }) as strict:
                  if strict.capabilities().distribution_version != "0.2.0":
                      sys.exit("Strict facade capabilities mismatch")
          print("packaged runtime data resolves via _resource_dir:",
                ", ".join(_RESOURCE_MARKERS))
          PY

      # Doc integrity. These exist because the doc/ refactor measured the damage
      # they prevent: 29 in-code citations of doc/ paths that no linter checked,
      # and 44 of 45 SPEC pages silently behind their own source.
      - name: Doc linters
        run: |
          python tools/check_doc_links.py
          python tools/check_doc_citations.py

      # BLOCKING as of the P5 rewrite: all 92 modules have a SPEC page and all
      # 62 pages carry a `verified-against:` date. --strict additionally fails
      # on a page whose source changed after that date, or one that dropped its
      # marker — which is the whole point: 44 of 45 pages had silently fallen
      # behind before this check existed.
      - name: SPEC coverage and freshness
        run: python tools/check_spec_freshness.py --strict

      # Written, tested, and until now invoked only from prose (AGENTS.md, DEVELOPMENT.md).
      - name: Knowledge linters
        run: |
          python knowledge/tools/check_knowledge_tree.py
          python knowledge/tools/check_wiki_lint.py
          python -m pytest -q knowledge/tools/test_check_knowledge_tree.py \
                    knowledge/tools/test_check_review_report.py