ci.yml

name: Tests

on:
  push:
    branches: [main]
    tags: ["v*"]
  pull_request:
  workflow_dispatch:

concurrency:
  group: ci-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: read

jobs:
  guard:
    name: Guard (paths, pycache)
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: No hardcoded user/mount paths in tracked non-md files
        run: |
          # split literals so this line cannot match its own pattern
          re="/m""nt/|/h""ome/[a-z]+/|/U""sers/"
          if git grep -nE "$re" -- ':!*.md'; then
            echo "::error::hardcoded absolute path(s) above; use env vars (\$HOME, \$PROJECTS_ROOT)" >&2
            exit 1
          fi

      - name: No __pycache__ under bin/
        run: |
          if find bin -type d -name __pycache__ | grep -q .; then
            echo "::error::__pycache__ directories found under bin/:" >&2
            find bin -type d -name __pycache__
            exit 1
          fi

  test:
    name: Test
    runs-on: ubuntu-latest
    timeout-minutes: 30

    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - uses: actions/setup-go@v4
        with:
          go-version-file: go.mod

      - name: Shell syntax check
        run: |
          bash -n scripts/db/psql-yq
          bash -n scripts/db/ssh-tunnel
          bash -n scripts/docker-entrypoint
          bash -n bin/cgo/zig
          sh -n bin/cgo/zcc
          sh -n bin/cgo/zc++

      - name: Go tests (root module; duckdb-go CGO via gcc, no ladybug)
        if: github.server_url == 'https://github.com'
        run: |
          CC=gcc CXX=g++ CGO_CFLAGS= CGO_LDFLAGS= go vet ./...
          CC=gcc CXX=g++ CGO_CFLAGS= CGO_LDFLAGS= go test ./... -count=1

      - name: Go tests (root module, no duckdb CGO; Gitea runner libstdc++ is too old for duckdb static lib)
        if: github.server_url != 'https://github.com'
        run: |
          PKGS="$(go list ./... | grep -v /pkg/duckdb)"
          go vet $PKGS
          go test $PKGS -count=1

      - name: brain ranking tests (no cgo / no ladybug)
        run: go test ./internal/brain/rank -count=1

      - name: brain client (P-9.5, cgo-free SDK + CLI compile)
        run: |
          go test ./pkg/brainclient/... -count=1
          go run -tags=brain_client ./bin/brain/client.go help >/dev/null

      - name: facts/audit self (lexicon consistency, no network)
        run: ./bin/facts/audit.go self

      - name: CGO via Zig (compile brain/search + index + add + eval + bench + ann)
        run: |
          chmod +x bin/cgo/zig bin/cgo/zcc bin/cgo/zc++
          bin/cgo/zig go build -tags system_ladybug -o /tmp/brain-search ./bin/brain/search.go
          bin/cgo/zig go build -tags 'system_ladybug,brain_index' -o /tmp/brain-index ./bin/brain/index.go
          bin/cgo/zig go build -tags 'system_ladybug,brain_add' -o /tmp/brain-add ./bin/brain/add.go
          bin/cgo/zig go build -tags 'system_ladybug,brain_eval' -o /tmp/brain-eval ./bin/brain/eval.go
          bin/cgo/zig go build -tags 'system_ladybug,brain_bench' -o /tmp/brain-bench ./bin/brain/bench.go
          bin/cgo/zig go build -tags 'system_ladybug,brain_ann' -o /tmp/brain-ann ./bin/brain/ann.go

      - name: Go write-path tests (Zig CGO ladybug, in-process)
        if: github.server_url == 'https://github.com'
        run: bin/cgo/zig go test -tags system_ladybug ./internal/brain/... -count=1

      - name: mailgraph import cycle (gcc CGO ladybug + duckdb, D-1.3)
        if: github.server_url == 'https://github.com'
        run: |
          # zig-линковка duckdb static lib не встаёт (libstdc++ ABI), поэтому
          # полный цикл parquet → Ladybug гоняется gcc: bin/cgo/zig env ниже
          # только скачивает liblbug в lib-ladybug.
          ./bin/cgo/zig env >/dev/null
          CC=gcc CXX=g++ \
            CGO_CFLAGS="-I$PWD/lib-ladybug" \
            CGO_LDFLAGS="-L$PWD/lib-ladybug -Wl,-rpath,$PWD/lib-ladybug -llbug" \
            LD_LIBRARY_PATH="$PWD/lib-ladybug${LD_LIBRARY_PATH:+:$LD_LIBRARY_PATH}" \
            go test -tags system_ladybug ./internal/mailgraph/ -run TestImportCycle -count=1

      - uses: actions/cache@v4
        with:
          path: ~/.cache/huggingface
          key: ${{ runner.os }}-hf-potion-multilingual-128M

      - name: recall@5 SoT (Go index + Zig bin/brain/eval.go)
        if: github.server_url == 'https://github.com'
        run: |
          # Go downloader fetches potion weights into the HF cache (skips if cached)
          go run ./bin/brain/model.go
          /tmp/brain-index --rebuild --json
          KB_ROOT="$PWD" /tmp/brain-eval --json

      - name: search bench gate (golden-set recall@5 >= 0.95, offline)
        if: github.server_url == 'https://github.com'
        run: |
          # Same schema as eval.go: corpus rebuilt above, DB quiescent →
          # --inproc opens it read-only; the /embed daemon spawns from the
          # bench binary itself. Exits 2 when the recall gate fails.
          KB_ROOT="$PWD" /tmp/brain-bench --inproc --json

  secret-scan:
    name: Secret scan (gitleaks)
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Compute scan range (diff of new commits only)
        id: range
        run: |
          if [ "$GITHUB_EVENT_NAME" = "pull_request" ]; then
            RANGE="${{ github.event.pull_request.base.sha }}...${{ github.event.pull_request.head.sha }}"
          else
            BEFORE="${{ github.event.before }}"
            if [ "$BEFORE" = "0000000000000000000000000000000000000000" ]; then
              RANGE="$(git rev-list --max-parents=0 HEAD | tail -1)..$GITHUB_SHA"
            else
              RANGE="$BEFORE..$GITHUB_SHA"
            fi
          fi
          echo "RANGE=$RANGE" >> "$GITHUB_ENV"
          echo "Scanning range: $RANGE"

      - name: Gitleaks (diff-only, fail on leak)
        env:
          GITLEAKS_RANGE: ${{ env.RANGE }}
        run: |
          set -euo pipefail
          # install the gitleaks binary (linux-amd64) instead of a docker action:
          # the docker://zricethezav/gitleaks action hardcodes /github/workspace,
          # which does not exist on the Gitea (act) runner. $GITHUB_WORKSPACE is the
          # checkout dir on BOTH runners (GitHub and Gitea act).
          curl -fsSLo /tmp/gitleaks.tar.gz \
            https://github.com/gitleaks/gitleaks/releases/download/v8.30.1/gitleaks_8.30.1_linux_x64.tar.gz
          tar -xzf /tmp/gitleaks.tar.gz -C /tmp gitleaks
          chmod +x /tmp/gitleaks
          /tmp/gitleaks detect \
            --source "$GITHUB_WORKSPACE" \
            --log-opts="$GITLEAKS_RANGE" \
            --redact \
            --verbose

  ocr:
    name: OCR (tesseract fixture)
    if: github.server_url == 'https://github.com'
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-go@v4
        with:
          go-version-file: go.mod
      - name: OCR tests (tesseract in docker, no apt)
        run: |
          go test -c -o /tmp/ocr.test ./internal/ocr
          docker run --rm --user root --entrypoint bash \
            -e OCR_LANG=eng \
            -v /tmp/ocr.test:/ocr.test \
            -v "$PWD":/work:ro -w /work/internal/ocr \
            jitesoft/tesseract-ocr:latest -c '/ocr.test -test.v'

  release:
    name: Release (semver)
    if: github.event_name == 'push' && github.ref == 'refs/heads/main' && github.server_url == 'https://github.com'
    needs: [test, ocr]
    runs-on: ubuntu-latest
    timeout-minutes: 15
    permissions:
      contents: write

    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - uses: actions/setup-go@v4
        with:
          go-version-file: go.mod

      - name: Compute next semver from conventional commits
        id: semver
        run: |
          bin/semver/next.go > /tmp/next
          echo "next=$(cat /tmp/next)" >> "$GITHUB_OUTPUT"

      - name: Create tag + GitHub Release
        if: steps.semver.outputs.next != 'none'
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          TAG: ${{ steps.semver.outputs.next }}
        run: |
          set -euo pipefail
          PREV=$(git tag --sort=-v:refname | grep -v "^$TAG$" | head -1 || true)
          RANGE=""
          [ -n "$PREV" ] && RANGE="$PREV..HEAD"
          # git log limited with -n (not piped to head) to avoid SIGPIPE under pipefail
          { echo "2dph $TAG — changes from conventional commits";
            git log --format='- %s' -n 40 $RANGE; } > /tmp/notes
          gh release create "$TAG" \
            --repo "${{ github.repository }}" \
            --target "$GITHUB_SHA" \
            --title "$TAG" \
            --notes-file /tmp/notes

  docker:
    name: Docker (api image)
    if: github.event_name == 'push' && github.server_url == 'https://github.com' && (github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/v'))
    needs: [test, ocr]
    runs-on: ubuntu-latest
    timeout-minutes: 60
    permissions:
      contents: read
      packages: write

    steps:
      - uses: actions/checkout@v4

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Login to GHCR
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Image tags
        id: meta
        run: |
          REPO="ghcr.io/${GITHUB_REPOSITORY,,}"
          if [ "$GITHUB_REF_TYPE" = "tag" ]; then
            echo "tags=$REPO:api,$REPO:$GITHUB_REF_NAME,$REPO:latest" >> "$GITHUB_OUTPUT"
          else
            echo "tags=$REPO:api,$REPO:sha-${GITHUB_SHA::12}" >> "$GITHUB_OUTPUT"
          fi

      - name: Build and push api image
        uses: docker/build-push-action@v6
        with:
          context: .
          file: Dockerfile
          target: api
          push: true
          platforms: linux/amd64
          tags: ${{ steps.meta.outputs.tags }}
          cache-from: type=gha
          cache-to: type=gha,mode=max