ci.yml

name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

jobs:
  test:
    name: Lint · Type · Security · Test (${{ matrix.os }} · Python ${{ matrix.python-version }})
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, windows-latest]
        python-version: ["3.10", "3.11", "3.12"]

    steps:
      - uses: actions/checkout@v4

      - name: Set up Python ${{ matrix.python-version }}
        uses: actions/setup-python@v5
        with:
          python-version: ${{ matrix.python-version }}
          cache: pip

      - name: Install dependencies
        run: |
          python -m pip install --upgrade pip
          # CI 中不需要真实的 LLM 流量，只装不依赖 langchain-openai 实时调用的最小集合即可。
          # 但为了一次跑通 smoke 测试中的安全计算器，需要 langchain-core。
          pip install -r requirements.txt
          pip install pytest ruff mypy bandit coverage[toml]

      # P27：CI 加 requirements.lock 可解析性校验（dry-run，不实际安装）
      - name: Verify requirements.lock is installable (P27)
        run: pip install --dry-run -r requirements.lock

      - name: Lint (ruff check)
        run: ruff check examples/ tests/

      - name: Lint (ruff format check)
        run: ruff format --check examples/ tests/

      - name: Type check (mypy)
        # 渐进式开启：只检查 _common/ 子模块与 tests/，examples/ 0x_*.py 暂略
        # （因 examples/ 大量使用 langchain 动态 API，mypy 噪声大）
        run: mypy examples/_common/ tests/ --ignore-missing-imports

      - name: Security scan (bandit)
        # P26：Windows 装包较慢，跳过；其余平台照常
        if: runner.os != 'Windows'
        run: bandit -ll -q -r examples/ tests/

      - name: Test (pytest)
        env:
          OPENAI_API_KEY: dummy-not-used
        run: |
          coverage run -m pytest tests/ -q
          coverage report --fail-under=85

      # P26：用 PowerShell 跑 Makefile.ps1，验证 Windows 路径可用
      - name: Verify PowerShell Makefile (P26)
        if: runner.os == 'Windows'
        shell: pwsh
        env:
          OPENAI_API_KEY: dummy-not-used
        run: powershell -ExecutionPolicy Bypass -File .\Makefile.ps1 test