name: CI

on:
  push:
    branches:
      - master
      # Fleet task branches (GitService push/merge, roboco/services/git.py).
      # A revision commit that lands on a PR's head via the merge API
      # (squash-merging a subtask PR into a parent branch) doesn't reliably
      # fire `pull_request`'s synchronize trigger for the PR that already
      # has that branch as its head — proven live on PR #406, where two
      # revision merges left CI/CodeQL absent (not red) while `push` and
      # `pull_request_target` both fired for the same ref update. A real git
      # push always fires `pull_request`; this redundant trigger (paired
      # with the concurrency group below) closes the gap for merge-API
      # revisions without double-running when both events land.
      - 'feature/**'
      - 'bug/**'
      - 'chore/**'
      - 'docs/**'
      - 'hotfix/**'
    paths:
      - 'roboco/**'
      - 'agents/**'
      - 'alembic/**'
      - 'tests/**'
      - 'scripts/**'
      - 'docker/**'
      - 'docker-compose.yml'
      - 'Makefile'
      - 'pyproject.toml'
      - 'uv.lock'
      - 'alembic.ini'
      - '.github/workflows/ci.yml'
  pull_request:
    branches:
      - master
    paths:
      - 'roboco/**'
      - 'agents/**'
      - 'alembic/**'
      - 'tests/**'
      - 'scripts/**'
      - 'docker/**'
      - 'docker-compose.yml'
      - 'Makefile'
      - 'pyproject.toml'
      - 'uv.lock'
      - 'alembic.ini'
      - '.github/workflows/ci.yml'
  workflow_dispatch:

# A fleet branch that's also an open PR head can get both a `push` and a
# `pull_request` run for the same commit; cancel the older one instead of
# burning two runners on identical work. `head_ref` (set only for
# pull_request) and `ref_name` (the short branch name, valid for push) both
# resolve to the SAME branch name, so the two event shapes share one group —
# plain `github.ref` would NOT (it's `refs/pull/<n>/merge` for pull_request
# vs `refs/heads/<branch>` for push, so it'd never collapse them).
concurrency:
  group: ${{ github.workflow }}-${{ github.head_ref || github.ref_name }}
  cancel-in-progress: true

jobs:
  quality:
    name: Python quality gate
    runs-on: ubuntu-latest

    services:
      postgres:
        image: pgvector/pgvector:pg16
        env:
          POSTGRES_USER: roboco
          POSTGRES_PASSWORD: roboco
          POSTGRES_DB: roboco
        ports:
          - 5432:5432
        options: >-
          --health-cmd "pg_isready -U roboco"
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5

      redis:
        image: redis:7
        ports:
          - 6379:6379
        options: >-
          --health-cmd "redis-cli ping"
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5

    env:
      # Runtime settings (roboco.config.Settings reads ROBOCO_*).
      ROBOCO_DATABASE_HOST: localhost
      ROBOCO_DATABASE_PORT: '5432'
      ROBOCO_DATABASE_USER: roboco
      ROBOCO_DATABASE_PASSWORD: roboco
      ROBOCO_DATABASE_NAME: roboco
      ROBOCO_REDIS_HOST: localhost
      ROBOCO_REDIS_PORT: '6379'
      # Fernet key required by the security layer (utils/crypto). Test-only —
      # a valid generated key (the previous value was 43 chars, not a real
      # Fernet key, so encryption tests failed with "Incorrect padding").
      ROBOCO_ENCRYPTION_KEY: 'yp3Awiv0zmxpRa6Gi9Y9hJbi4pZ2FXHRNr4EI6-Gx9U='
      # The pytest harness (tests/conftest.py) provisions its own ephemeral
      # databases via an admin connection to the `postgres` DB and reads a
      # separate ROBOCO_TEST_DB_* set. The pgvector image's POSTGRES_USER is a
      # superuser, so it can CREATE/DROP DATABASE and enable the vector extension.
      ROBOCO_TEST_DB_HOST: localhost
      ROBOCO_TEST_DB_PORT: '5432'
      ROBOCO_TEST_DB_USER: roboco
      ROBOCO_TEST_DB_PASSWORD: roboco
      ROBOCO_TEST_DB_ADMIN_DB: postgres

    steps:
      - name: Checkout code
        uses: actions/checkout@v7
        with:
          # The release-readiness smoke test calls ``git describe --tags`` to
          # find the most recent release tag. ``actions/checkout``'s default
          # shallow + no-tags clone makes that return empty, which made
          # ``test_gather_snapshot_reads_the_real_repo`` fail with
          # ``last_tag is None`` even though master had a tagged v0.13.0.
          # ``fetch-depth: 0`` clones full history; the default ``fetch-tags``
          # would still skip tags on shallow clones, so we also pin it true.
          fetch-depth: 0
          fetch-tags: true

      - name: Set up Python
        uses: actions/setup-python@v6
        with:
          python-version: '3.13'

      - name: Install uv
        run: pip install uv

      - name: Install dependencies
        run: uv sync --extra dev

      - name: Apply database migrations
        run: uv run alembic upgrade head

      - name: Run quality gate
        run: make quality