ci.yml

name: CI

on:
  push:
    branches: [main, claude/**]
  pull_request:
    branches: [main]

jobs:
  test:
    name: Unit Tests
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v4

      - name: Set up Python 3.11
        uses: actions/setup-python@v5
        with:
          python-version: "3.11"
          cache: "pip"
          cache-dependency-path: apps/api/requirements*.txt

      - name: Install dependencies
        run: |
          python -m pip install --upgrade pip
          pip install -r apps/api/requirements-test.txt

      - name: Run unit tests
        run: |
          cd apps/api
          PYTHONPATH=$PYTHONPATH:../../services/runner/app pytest tests/ --tb=short -v

      - name: Run tests with coverage
        run: |
          cd apps/api
          PYTHONPATH=$PYTHONPATH:../../services/runner/app pytest tests/ --cov=app --cov-report=xml --cov-report=term-missing

      - name: Upload coverage report
        uses: actions/upload-artifact@v4
        with:
          name: coverage-report
          path: apps/api/coverage.xml

  integration:
    name: Integration Tests
    runs-on: ubuntu-latest
    needs: test

    steps:
      - uses: actions/checkout@v4

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Create .env file
        run: |
          cat > .env << 'EOF'
          M87_API_KEY=m87-ci-test-key
          M87_ENABLE_TEST_ENDPOINTS=true
          POSTGRES_PASSWORD=ci-test-password
          EOF

      - name: Start services
        run: |
          docker compose -f infra/docker-compose.yml up -d --build
          sleep 10

      - name: Wait for API health
        run: |
          for i in {1..30}; do
            if curl -s http://localhost:8000/health | grep -q '"ok":true'; then
              echo "API is healthy"
              exit 0
            fi
            echo "Waiting for API... ($i/30)"
            sleep 2
          done
          echo "API failed to start"
          docker compose -f infra/docker-compose.yml logs
          exit 1

      - name: Run proof-test.sh
        run: ./scripts/proof-test.sh

      - name: Collect logs on failure
        if: failure()
        run: |
          docker compose -f infra/docker-compose.yml logs > docker-logs.txt

      - name: Upload logs on failure
        if: failure()
        uses: actions/upload-artifact@v4
        with:
          name: docker-logs
          path: docker-logs.txt

      - name: Stop services
        if: always()
        run: docker compose -f infra/docker-compose.yml down -v

  audit:
    name: Audit Rail
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v4

      - name: Set up Python 3.11
        uses: actions/setup-python@v5
        with:
          python-version: "3.11"
          cache: "pip"
          cache-dependency-path: apps/api/requirements*.txt

      - name: Set up Node.js
        uses: actions/setup-node@v4
        with:
          node-version: "20"
          cache: "npm"
          cache-dependency-path: apps/ui/package-lock.json

      - name: Install Python dependencies
        run: |
          python -m pip install --upgrade pip
          pip install -r apps/api/requirements-test.txt

      - name: Install Node dependencies
        run: |
          cd apps/ui
          npm ci

      - name: Run audit.sh
        env:
          PYTHONPATH: ${{ github.workspace }}/services/runner/app
        run: ./scripts/audit.sh

      - name: Upload evidence artifacts
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: audit-evidence
          path: evidence/

  layer0-proof-rail:
    name: Layer 0 Proof Rail
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v4

      - name: Set up Python 3.11
        uses: actions/setup-python@v5
        with:
          python-version: "3.11"
          cache: "pip"
          cache-dependency-path: apps/api/requirements*.txt

      - name: Install dependencies
        run: |
          python -m pip install --upgrade pip
          pip install -r apps/api/requirements-test.txt

      - name: Run TOCTOU red-team probes
        run: |
          cd apps/api
          python -m pytest tests/test_layer0_toctou_probes.py -v --tb=short

      - name: Run Layer 0 traceable demo
        run: |
          python scripts/layer0_demo.py --json > layer0_proof.json 2>layer0_demo.log
          python -c "
          import json, sys
          d = json.load(open('layer0_proof.json'))
          v = d['verdict']
          c = d['provenance']['repo_commit']
          assert v == 'LAYER_0_ENFORCED', f'Verdict: {v}'
          assert c != 'unknown', 'Missing commit provenance'
          print(f'Layer 0 proof: {v} | commit: {c[:12]} | checks: {d[\"passed\"]}/{d[\"total_checks\"]}')
          "

      - name: Upload proof artifact
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: layer0-proof
          path: |
            layer0_proof.json
            layer0_demo.log

  lint:
    name: Lint
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v4

      - name: Set up Python 3.11
        uses: actions/setup-python@v5
        with:
          python-version: "3.11"

      - name: Check Python syntax
        run: |
          python -m py_compile apps/api/app/*.py
          python -m py_compile apps/api/app/**/*.py 2>/dev/null || true
          python -m py_compile apps/api/tests/*.py