name: Tests

on:
  push:
    branches: [main]
    paths-ignore:
      - '**/*.md'
      - 'docs/**'
  pull_request:
    branches: [main]
    paths-ignore:
      - '**/*.md'
      - 'docs/**'

permissions:
  contents: read

# Cancel in-progress runs for the same PR/branch
concurrency:
  group: tests-${{ github.ref }}
  cancel-in-progress: true

jobs:
  test:
    runs-on: ubuntu-latest
    timeout-minutes: 20
    steps:
      - name: Checkout code
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4

      - name: Install system dependencies
        run: sudo apt-get update && sudo apt-get install -y ripgrep

      - name: Install uv
        # Pin uv version explicitly so setup-uv constructs the release
        # download URL directly instead of resolving "latest" via the
        # GitHub REST API. The operator host's anon IP (5.78.80.188)
        # is anonymous-rate-limited at GitHub post-2026-05-06 (no org
        # PAT available — see internal#79). Without the pin, the
        # action's `octokit.repos.getLatestRelease()` call hits the
        # 60-req/hr cap and fails Install uv with "API rate limit
        # exceeded". With a pin, no API call is needed.
        uses: astral-sh/setup-uv@d4b2f3b6ecc6e67c4457f6d3e41ec42d3d0fcb86  # v5
        with:
          version: "0.11.11"

      - name: Set up Python 3.11
        run: uv python install 3.11

      - name: Install dependencies
        run: |
          uv venv .venv --python 3.11
          source .venv/bin/activate
          uv pip install -e ".[all,dev]"

      - name: Run tests
        run: |
          source .venv/bin/activate
          python -m pytest tests/ -q --ignore=tests/integration --ignore=tests/e2e --tb=short -n auto
        env:
          # Ensure tests don't accidentally call real APIs
          OPENROUTER_API_KEY: ""
          OPENAI_API_KEY: ""
          NOUS_API_KEY: ""

  e2e:
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - name: Checkout code
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4

      - name: Install uv
        # Pin uv version explicitly so setup-uv constructs the release
        # download URL directly instead of resolving "latest" via the
        # GitHub REST API. The operator host's anon IP (5.78.80.188)
        # is anonymous-rate-limited at GitHub post-2026-05-06 (no org
        # PAT available — see internal#79). Without the pin, the
        # action's `octokit.repos.getLatestRelease()` call hits the
        # 60-req/hr cap and fails Install uv with "API rate limit
        # exceeded". With a pin, no API call is needed.
        uses: astral-sh/setup-uv@d4b2f3b6ecc6e67c4457f6d3e41ec42d3d0fcb86  # v5
        with:
          version: "0.11.11"

      - name: Set up Python 3.11
        run: uv python install 3.11

      - name: Install dependencies
        run: |
          uv venv .venv --python 3.11
          source .venv/bin/activate
          uv pip install -e ".[all,dev]"

      - name: Run e2e tests
        run: |
          source .venv/bin/activate
          python -m pytest tests/e2e/ -v --tb=short
        env:
          OPENROUTER_API_KEY: ""
          OPENAI_API_KEY: ""
          NOUS_API_KEY: ""