ci.yml

name: ci

on:
  push:
  pull_request:

permissions:
  contents: read

jobs:
  test:
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: ubuntu-latest
            python-version: "3.10"
          - os: ubuntu-latest
            python-version: "3.11"
          - os: ubuntu-latest
            python-version: "3.12"
          - os: ubuntu-latest
            python-version: "3.13"
          - os: ubuntu-latest
            python-version: "3.14"
          - os: windows-latest
            python-version: "3.12"
          - os: macos-latest
            python-version: "3.12"
    steps:
      - uses: actions/checkout@v7
      - uses: actions/setup-python@v7
        with:
          python-version: ${{ matrix.python-version }}
      - run: python -m pip install -e .
      - run: python -m unittest discover -s tests -v
      - name: Validate installed doctor entrypoint
        shell: bash
        run: |
          agent-config-score doctor . --json > .ci-doctor.json
          python - .ci-doctor.json <<'PY'
          import json
          import sys

          with open(sys.argv[1], encoding="utf-8") as handle:
              data = json.load(handle)
          assert data["ok"] is True
          assert data["errors"] == 0
          assert any(check["name"] == "config" for check in data["checks"])
          PY
      - name: Generate and validate SARIF
        shell: bash
        run: |
          agent-config-score . --fail-under 90 --sarif .ci-agent-config-score.sarif
          python - .ci-agent-config-score.sarif <<'PY'
          import json
          import sys

          with open(sys.argv[1], encoding="utf-8") as handle:
              data = json.load(handle)
          assert data["version"] == "2.1.0"
          assert data["runs"][0]["tool"]["driver"]["name"] == "AgentConfigScore"
          PY

  package:
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, windows-latest, macos-latest]
    steps:
      - uses: actions/checkout@v7
      - uses: actions/setup-python@v7
        with:
          python-version: "3.12"
      - name: Build wheel and source distribution
        shell: bash
        run: |
          set -euo pipefail
          python -m pip install build
          python -m build
          test "$(find dist -maxdepth 1 -type f -name '*.whl' | wc -l)" -eq 1
          test "$(find dist -maxdepth 1 -type f -name '*.tar.gz' | wc -l)" -eq 1
      - name: Verify installed wheel end to end
        shell: bash
        run: |
          set -euo pipefail
          wheel="$(find "$GITHUB_WORKSPACE/dist" -maxdepth 1 -type f -name '*.whl' -print -quit)"
          expected="$(python - <<'PY'
          import sys
          import tomllib
          with open('pyproject.toml', 'rb') as handle:
              sys.stdout.write(tomllib.load(handle)['project']['version'])
          PY
          )"
          python -m venv "$RUNNER_TEMP/agent-config-score-wheel-test"
          if [[ "$RUNNER_OS" == "Windows" ]]; then
            wheel_python="$RUNNER_TEMP/agent-config-score-wheel-test/Scripts/python.exe"
          else
            wheel_python="$RUNNER_TEMP/agent-config-score-wheel-test/bin/python"
          fi
          "$wheel_python" -m pip install --no-deps "$wheel"
          cd "$RUNNER_TEMP"
          python "$GITHUB_WORKSPACE/scripts/verify_installed_package.py" \
            --python "$wheel_python" --expected-version "$expected"

  score_history:
    if: github.event_name == 'pull_request'
    uses: ./.github/workflows/score-history.yml
    with:
      retention_days: 1

  score_history_contract:
    if: github.event_name == 'pull_request'
    needs: score_history
    runs-on: ubuntu-latest
    steps:
      - name: Validate reusable workflow outputs
        env:
          ACS_SCORE: ${{ needs.score_history.outputs.score }}
          ACS_GRADE: ${{ needs.score_history.outputs.grade }}
          ACS_ARTIFACT_ID: ${{ needs.score_history.outputs.artifact-id }}
          ACS_ARTIFACT_URL: ${{ needs.score_history.outputs.artifact-url }}
        shell: bash
        run: |
          set -euo pipefail
          python - <<'PY'
          import os

          score = os.environ["ACS_SCORE"]
          grade = os.environ["ACS_GRADE"]
          artifact_id = os.environ["ACS_ARTIFACT_ID"]
          artifact_url = os.environ["ACS_ARTIFACT_URL"]

          assert score.isdigit(), score
          assert 0 <= int(score) <= 100, score
          assert grade in {"A", "B", "C", "D", "F"}, grade
          assert artifact_id.isdigit() and int(artifact_id) > 0, artifact_id
          assert artifact_url.startswith("https://github.com/"), artifact_url
          assert "/actions/runs/" in artifact_url, artifact_url
          PY