ci.yaml

# Runs on every pull request (including from forks), on each merge group in the merge queue, and on main. Needs
# no secrets: the engine tests use a scripted fake model and mocked APIs.
name: CI

on:
  pull_request:
  merge_group:
  push:
    branches: [main]
  workflow_dispatch:

# A new push to a pull request replaces its older run. Merge groups each have their own ref
# (gh-readonly-queue/main/pr-...), and they and main are never cancelled: the queue decides what to drop.
concurrency:
  group: ci-${{ github.workflow }}-${{ github.event_name }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

permissions:
  contents: read

jobs:
  lint:
    name: Lint
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - uses: astral-sh/setup-uv@v7
      - run: uvx ruff@0.16.7 check sentient tests packaging

  engine:
    name: Engine tests (${{ matrix.os }})
    runs-on: ${{ matrix.os }}
    timeout-minutes: 55
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, windows-latest]
    env:
      # CI machines have no desktop keychain; a file-backed keyring stands in for it.
      PYTHON_KEYRING_BACKEND: keyrings.alt.file.PlaintextKeyring
      PYTHONUTF8: "1"
    steps:
      - uses: actions/checkout@v7
      - uses: astral-sh/setup-uv@v7
        with:
          python-version: "3.12"
          enable-cache: true
          activate-environment: true
      - name: Install
        run: uv pip install -e ".[dev,voice,node,whatsapp]" keyrings.alt
      - name: Test
        # one worker per CPU: in one process the Windows job took 35 to 43 minutes. A failed test runs once more
        # (--reruns 1); the next step lists every test that needed it, so flakes are seen and get an issue.
        shell: bash
        run: |
          set -o pipefail
          python -m pytest -q -p no:warnings -n auto --timeout=300 --durations=30 \
            --reruns 1 --reruns-delay 2 -rR --rerun-show-tracebacks 2>&1 | tee pytest-output.txt
      - name: Report tests that needed a rerun
        if: always()
        shell: bash
        run: |
          reruns=$(grep -E '^RERUN ' pytest-output.txt 2>/dev/null | sed 's/^RERUN //' | sort -u || true)
          if [ -z "$reruns" ]; then
            echo "No test needed a rerun."
            exit 0
          fi
          {
            echo "### Tests that needed a rerun on ${{ matrix.os }}"
            echo
            echo "These failed once and were run again. Each one is flaky: open an issue with the \`flaky\` label"
            echo "(see docs/DEVELOPING.md, Flaky tests) unless one already exists. The first failure's traceback is in"
            echo "the Test step's log, under \"rerun test summary info\"."
            echo
            sed 's/^/- `/; s/$/`/' <<<"$reruns"
          } >> "$GITHUB_STEP_SUMMARY"
          while read -r test; do
            echo "::warning title=Flaky test (needed a rerun)::$test"
          done <<<"$reruns"

  desktop:
    name: Desktop typecheck and build
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: desktop
    steps:
      - uses: actions/checkout@v7
      - uses: actions/setup-node@v6
        with:
          node-version: 22
          cache: npm
          cache-dependency-path: desktop/package-lock.json
      - run: npm ci
      - run: npm run typecheck
      - run: npm test
      - run: npm run build

  secrets:
    name: Secret scan
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - name: Gitleaks (working tree)
        run: |
          docker run --rm -v "$PWD:/repo" ghcr.io/gitleaks/gitleaks:v8.28.0 \
            dir /repo --config /repo/.github/gitleaks.toml --redact --no-banner