ci.yml

name: CI

on:
  pull_request:
    branches: [main]
  push:
    branches: [main]

# Least-privilege: the workflow only needs to read code (checkout +
# submodule). No writes anywhere.
permissions:
  contents: read

# Cancel in-flight runs on the same ref when a new push lands.
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
        with:
          # Conformance fixtures live in the openarmature-spec submodule.
          submodules: recursive

      - name: Fetch submodule tags
        # actions/checkout's submodule clone is shallow and doesn't
        # carry tags. ``scripts/build_agents_md.py`` asserts the
        # submodule HEAD is AT a ``v*`` tag (``git tag --points-at
        # HEAD``; refuses to bundle draft spec text or text from
        # a commit between two release tags);
        # ``tests/test_agents_md_drift.py`` runs that assertion.
        # Fetch tag refs only — the HEAD commit is already present
        # from the submodule checkout, and we don't need history
        # beyond what tags point at.
        run: git -C openarmature-spec fetch --tags

      - name: Install uv
        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39  # v8.2.0
        with:
          enable-cache: true

      # No explicit `uv python install` — `uv sync` auto-provisions the
      # interpreter pinned in `.python-version`, so CI tests the same
      # version developers run locally.

      - name: Sync deps
        # ``--all-extras`` installs every optional-dependency group
        # (currently ``[otel]``) so pyright type-checks the
        # OTel-using modules with real types and tests covering
        # extras-gated code paths run end-to-end. Without this,
        # ``opentelemetry.*`` symbols come back Unknown and pyright
        # produces hundreds of false-positive errors on
        # ``tests/unit/test_observability_otel.py``.
        run: uv sync --frozen --all-extras --group examples

      - name: Validate conformance.toml against pinned spec
        # Catches drift between conformance.toml and the pinned spec
        # submodule's proposals/. External readers (notably the
        # openarmature-spec docs build) fetch this manifest to surface
        # python's impl status on the proposals index page, so a stale
        # entry quietly serves wrong data to the docs site.
        run: uv run python scripts/check_conformance_manifest.py

      - name: Lint (ruff check)
        run: uv run ruff check .

      - name: Format check (ruff format --check)
        run: uv run ruff format --check .

      - name: Type check (pyright)
        run: uv run pyright src/ tests/

      - name: Run tests (pytest)
        run: uv run pytest -q

      # Build the wheel + sdist so packaging bugs (missing files in the
      # wheel, malformed metadata, README that won't render on PyPI)
      # surface here rather than waiting for a release tag. No upload —
      # the artifact is discarded after the job ends.
      - name: Build package
        run: uv build