name: CI

on:
  push:
    branches:
      - master
    paths:
      - 'roboco/**'
      - 'agents/**'
      - 'alembic/**'
      - 'tests/**'
      - 'scripts/**'
      - 'docker/**'
      - 'docker-compose.yml'
      - 'Makefile'
      - 'pyproject.toml'
      - 'uv.lock'
      - 'alembic.ini'
      - '.github/workflows/ci.yml'
  pull_request:
    branches:
      - master
    paths:
      - 'roboco/**'
      - 'agents/**'
      - 'alembic/**'
      - 'tests/**'
      - 'scripts/**'
      - 'docker/**'
      - 'docker-compose.yml'
      - 'Makefile'
      - 'pyproject.toml'
      - 'uv.lock'
      - 'alembic.ini'
      - '.github/workflows/ci.yml'
  workflow_dispatch:

jobs:
  quality:
    name: Python quality gate
    runs-on: ubuntu-latest

    services:
      postgres:
        image: pgvector/pgvector:pg16
        env:
          POSTGRES_USER: roboco
          POSTGRES_PASSWORD: roboco
          POSTGRES_DB: roboco
        ports:
          - 5432:5432
        options: >-
          --health-cmd "pg_isready -U roboco"
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5

      redis:
        image: redis:7
        ports:
          - 6379:6379
        options: >-
          --health-cmd "redis-cli ping"
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5

    env:
      # Runtime settings (roboco.config.Settings reads ROBOCO_*).
      ROBOCO_DATABASE_HOST: localhost
      ROBOCO_DATABASE_PORT: '5432'
      ROBOCO_DATABASE_USER: roboco
      ROBOCO_DATABASE_PASSWORD: roboco
      ROBOCO_DATABASE_NAME: roboco
      ROBOCO_REDIS_HOST: localhost
      ROBOCO_REDIS_PORT: '6379'
      # Fernet key required by the security layer (utils/crypto). Test-only —
      # a valid generated key (the previous value was 43 chars, not a real
      # Fernet key, so encryption tests failed with "Incorrect padding").
      ROBOCO_ENCRYPTION_KEY: 'yp3Awiv0zmxpRa6Gi9Y9hJbi4pZ2FXHRNr4EI6-Gx9U='
      # The pytest harness (tests/conftest.py) provisions its own ephemeral
      # databases via an admin connection to the `postgres` DB and reads a
      # separate ROBOCO_TEST_DB_* set. The pgvector image's POSTGRES_USER is a
      # superuser, so it can CREATE/DROP DATABASE and enable the vector extension.
      ROBOCO_TEST_DB_HOST: localhost
      ROBOCO_TEST_DB_PORT: '5432'
      ROBOCO_TEST_DB_USER: roboco
      ROBOCO_TEST_DB_PASSWORD: roboco
      ROBOCO_TEST_DB_ADMIN_DB: postgres

    steps:
      - name: Checkout code
        uses: actions/checkout@v7
        with:
          # The release-readiness smoke test calls ``git describe --tags`` to
          # find the most recent release tag. ``actions/checkout``'s default
          # shallow + no-tags clone makes that return empty, which made
          # ``test_gather_snapshot_reads_the_real_repo`` fail with
          # ``last_tag is None`` even though master had a tagged v0.13.0.
          # ``fetch-depth: 0`` clones full history; the default ``fetch-tags``
          # would still skip tags on shallow clones, so we also pin it true.
          fetch-depth: 0
          fetch-tags: true

      - name: Set up Python
        uses: actions/setup-python@v6
        with:
          python-version: '3.13'

      - name: Install uv
        run: pip install uv

      - name: Install dependencies
        run: uv sync --extra dev

      - name: Apply database migrations
        run: uv run alembic upgrade head

      - name: Run quality gate
        run: make quality