ci.yml

name: CI

on:
  push:
    branches: [main]
  pull_request:
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  # OPUS_SPEC §3.7: Python 3.12 / 3.13 x Linux, macOS, Windows.
  # 3.12 is the strict floor -- do not add 3.10/3.11 back.
  test:
    name: pytest (py${{ matrix.python-version }} / ${{ matrix.os }})
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, macos-latest, windows-latest]
        python-version: ["3.12", "3.13"]
    steps:
      - uses: actions/checkout@v4

      - name: Install Poetry
        run: pipx install poetry

      - uses: actions/setup-python@v5
        with:
          python-version: ${{ matrix.python-version }}

      - name: Install dependencies
        run: poetry install --no-interaction

      # The coverage gate (100% line AND branch) lives in pyproject.toml.
      - name: Run tests with coverage gate
        run: poetry run pytest --cov --cov-branch

  quality:
    name: types, lint, codegen drift
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Install Poetry
        run: pipx install poetry

      - uses: actions/setup-python@v5
        with:
          python-version: "3.12"

      - name: Install dependencies
        run: poetry install --no-interaction

      - name: mypy --strict
        run: poetry run mypy --strict n8n_iac

      - name: ruff
        run: poetry run ruff check n8n_iac tests

      # The async facade is committed generated code; this fails if it was
      # hand-edited or if the sync source moved without regenerating.
      - name: Async facade is regeneration-stable
        run: poetry run python -m n8n_iac.client._async_codegen --check