ci.yml

# CI for surmado-python SDK
# Runs unit tests + example contract validation on every PR and main push.
# Examples are validated against JSON schemas in /schemas — no live API calls.
name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

jobs:
  test:
    runs-on: ubuntu-latest
    strategy:
      matrix:
        python-version: ["3.9", "3.10", "3.12"]

    steps:
      - uses: actions/checkout@v4

      - name: Set up Python ${{ matrix.python-version }}
        uses: actions/setup-python@v5
        with:
          python-version: ${{ matrix.python-version }}

      - name: Install dependencies
        run: |
          python -m pip install --upgrade pip
          pip install -e .
          pip install pytest jsonschema

      - name: Run unit tests
        run: python -m pytest client/tests/test_client.py -v

      - name: Run example contract tests
        run: python -m pytest client/tests/test_examples.py -v

      - name: Check for hardcoded API keys
        run: |
          # Fail if any real API key pattern appears outside of comments/docs
          if grep -rn "sur_live_[A-Za-z0-9_]\{20,\}" examples/ client/ --include="*.py" | grep -v "^.*#.*sur_live_" | grep -v "docstring"; then
            echo "::error::Found hardcoded live API key in source files"
            exit 1
          fi
          echo "No hardcoded keys found"