ci.yml

name: ci

on:
  push:
    branches: [main]
  pull_request:

permissions:
  contents: read

env:
  CARGO_TERM_COLOR: always
  RUSTFLAGS: "-D warnings"

jobs:
  website:
    name: website build and SEO checks
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: website
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: "22"
          cache: npm
          cache-dependency-path: website/package-lock.json
      - name: install
        run: npm ci
      - name: build
        run: npm run build
      - name: validate SEO output
        run: npm run check:seo

  rust:
    name: cargo test (${{ matrix.os }})
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, macos-latest]
    runs-on: ${{ matrix.os }}
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@1.95.0
        with:
          components: rustfmt, clippy
      - uses: Swatinem/rust-cache@v2
      - name: fmt
        run: cargo fmt --all -- --check
      - name: clippy
        run: cargo clippy --workspace --all-targets -- -D warnings
      - name: test
        run: cargo test --workspace --all-targets
      - name: doc
        run: cargo doc --workspace --no-deps

  python:
    name: python sdk
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: "3.12"
      - name: install
        run: pip install -e "sdk/python[langgraph,dev]"
      - name: ruff
        run: ruff check sdk/python
      - name: mypy
        run: mypy --strict --config-file sdk/python/pyproject.toml sdk/python/agentic
      - name: pytest
        run: pytest sdk/python/tests -q

  # GCS integration tests against fsouza/fake-gcs-server. Closes the
  # ADR-0003 / ADR-0004 end-of-week-8 kill-criterion: GcsObjectStore must
  # pass integration tests, else revert Executor atomic integration to
  # the layered manifest-export shape and defer to v1.1.
  gcs:
    name: gcs integration (fake-gcs)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@1.95.0
      - uses: Swatinem/rust-cache@v2
      - name: start fake-gcs
        run: |
          docker run -d --name fake-gcs -p 54323:4443 \
            fsouza/fake-gcs-server:1.52.2 \
            -scheme http -port 4443 -public-host localhost:54323 -backend memory
          ready=""
          for i in $(seq 1 30); do
            if curl -fsSL http://localhost:54323/storage/v1/b >/dev/null 2>&1; then
              echo "fake-gcs ready after ${i}s"
              ready=1
              break
            fi
            sleep 1
          done
          if [ -z "$ready" ]; then
            echo "fake-gcs did not become ready within 30s" >&2
            docker logs fake-gcs || true
            exit 1
          fi
      - name: create bucket
        run: |
          # POST /storage/v1/b returns 200 on create, 409 if the bucket
          # already exists. Both are fine for our purposes (re-runs of a
          # job against the same still-running container should not fail).
          code=$(curl -s -o /tmp/resp.json -w '%{http_code}' \
            -X POST -H 'Content-Type: application/json' \
            -d '{"name":"agentic-test-bucket"}' \
            http://localhost:54323/storage/v1/b)
          case "$code" in
            200|201|409) echo "bucket ready (HTTP $code)";;
            *) echo "unexpected HTTP $code from fake-gcs:" >&2; cat /tmp/resp.json >&2; exit 1;;
          esac
      - name: run gcs integration tests
        env:
          GCS_ENDPOINT: http://localhost:54323
          GCS_BUCKET: agentic-test-bucket
        run: cargo test -p agentic-core --test gcs_integration -- --ignored --nocapture

  # Postgres+pgvector integration tests. Repo policy (CLAUDE.md "What not
  # to do") forbids mocking Postgres for snapshot/restore paths — the
  # snapshot algorithm leans on Postgres-specific behaviour (advisory
  # locks, pgvector storage, transactional DDL), so the ignored suites
  # must run against the real thing in CI. Mirrors the demo's
  # pgvector/pgvector:pg16 image and credentials
  # (examples/langgraph-rollback/docker-compose.yml). 2026-07-09 audit
  # finding #6 / wayfinder map #103.
  postgres:
    name: postgres integration (pgvector)
    runs-on: ubuntu-latest
    env:
      DATABASE_URL: postgres://agentic:agentic@localhost:54322/agentic
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@1.95.0
      - uses: Swatinem/rust-cache@v2
      - name: start postgres (pgvector) with logical decoding enabled
        run: |
          docker run -d --name agentic-ci-pg -p 54322:5432 \
            -e POSTGRES_USER=agentic \
            -e POSTGRES_PASSWORD=agentic \
            -e POSTGRES_DB=agentic \
            --health-cmd "pg_isready -U agentic -d agentic" \
            --health-interval 5s \
            --health-timeout 5s \
            --health-retries 12 \
            pgvector/pgvector:pg16 \
            postgres -c wal_level=logical -c max_wal_senders=10 -c max_replication_slots=10

          ready=""
          for i in $(seq 1 30); do
            if docker exec agentic-ci-pg pg_isready -U agentic -d agentic >/dev/null 2>&1; then
              echo "postgres ready after ${i}s"
              ready=1
              break
            fi
            sleep 1
          done
          if [ -z "$ready" ]; then
            echo "postgres did not become ready within 30s" >&2
            docker logs agentic-ci-pg || true
            exit 1
          fi
      - name: create pgvector extension
        # The adapter checks for the extension but cannot create it
        # (CREATE EXTENSION needs superuser); the demo does this in
        # seed.sql, CI does it here.
        run: docker exec -e PGPASSWORD=agentic agentic-ci-pg psql -U agentic -d agentic -c 'CREATE EXTENSION IF NOT EXISTS vector;'
      - name: memory adapter suite (snapshot/restore)
        # Runs at default parallelism: each test provisions its own
        # database (issue #100), so the suite no longer needs
        # --test-threads=1. Keeping it parallel here is deliberate —
        # CI is the regression guard for the isolation.
        run: cargo test -p agentic-memory --test integration -- --ignored --nocapture
      - name: reverse migration suite
        run: cargo test -p agenticd --test reverse_migration -- --ignored --nocapture
      - name: commit-with-memory suite
        run: cargo test -p agenticd --test commit_with_memory -- --ignored --nocapture

  # Release-profile build on macOS. CI otherwise builds debug only, which
  # made proc-macro corruption (issue #124 gap 1) invisible. The new macOS
  # linker corrupts stripped proc-macro dylibs at dlopen time; both
  # strip="symbols" and strip="debuginfo" failed. Release builds exercise
  # this, guarding against linker/profile breakage.
  release-build:
    name: release build (macos)
    runs-on: macos-latest
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@1.95.0
      - uses: Swatinem/rust-cache@v2
      - name: build release binaries
        run: cargo build --release -p agenticd -p agentic-cli
      - name: smoke-run binaries
        run: |
          ./target/release/agenticd --help >/dev/null
          ./target/release/agentic --help >/dev/null

  # The broken-prompt demo, end-to-end. The demo IS the MVP discipline
  # (CLAUDE.md); the ADR-0013 scanner regression (issue #124 gap 5) sat
  # unnoticed since 2026-05-21 because nothing ran it. run-demo.sh
  # bootstraps its own venv. CONTAINER_RUNTIME is pinned to docker:
  # ubuntu runners ship a podman binary whose compose path needs a
  # podman API socket that is not running, so autodetection picks a
  # runtime that cannot `compose up`.
  demo:
    name: demo smoke (run-demo.sh)
    runs-on: ubuntu-latest
    env:
      CONTAINER_RUNTIME: docker
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@1.95.0
      - uses: Swatinem/rust-cache@v2
      - uses: actions/setup-python@v5
        with:
          python-version: "3.12"
      - name: install postgres client
        run: sudo apt-get update && sudo apt-get install -y --no-install-recommends postgresql-client
      - name: run the broken-prompt demo end-to-end
        run: ./examples/langgraph-rollback/scripts/run-demo.sh