ci.yml

name: tests

on:
  push:
    branches: [main]
  pull_request:

permissions:
  contents: read

jobs:
  # This repository is public and everything in it is English by rule. The gate
  # is a COPY and not a reference to the one in the sibling packages, on purpose:
  # it scans the tree it is run from, and running a sibling's copy from here
  # silently scans the wrong repository and reports clean. That happened once
  # already, which is why each package carries its own.
  english:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: "3.12"
      - name: the repository is English
        run: |
          python scripts/check_english_only.py --selftest
          python scripts/check_english_only.py

  test:
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, windows-latest]
        python-version: ["3.11", "3.12", "3.13"]
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: ${{ matrix.python-version }}
      - name: install and test
        # The default selection excludes `ui`, which drives a real browser: those
        # need an engine download and a machine doing nothing else, and a runner
        # is neither. They are run by hand, serially, before a release.
        run: |
          python -m pip install --upgrade pip
          pip install -e ".[test]"
          python -m pytest -q

  # Every version on the index has a GitHub release page. Carried over from the
  # server's own CI when it moved in here: the guard was one version wide until
  # 2026-08-02 on the sibling packages, and the whole index is walked since.
  releases:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: "3.12"
      - name: every published version has a release page
        env:
          AIHAWK_CHECK_RELEASES: "1"
          GITHUB_TOKEN: ${{ github.token }}
        run: |
          python -m pip install --upgrade pip pytest
          python -m pytest -q tests/test_release_pages.py

  # The server's browser tests: they start a real engine, downloaded into the
  # runner's cache on first use, and drive it through the tools. Deselected by
  # default because of the download and the time; this job runs them the way
  # the server's own CI did before the merge, on one platform.
  e2e:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: "3.12"
      - name: the tools drive a real engine
        run: |
          python -m pip install --upgrade pip
          pip install -e ".[test]"
          # The tests that spawn the server as a subprocess and drive it
          # through a real engine skip unless the engine is named to them.
          export STEALTHFOX_BINARY="$(invisible-playwright fetch | tail -n 1)"
          python -m pytest -q -m e2e tests/mcp_server

  # This package is published, so the thing that must work is the WHEEL, not the
  # checkout. An editable install can pass every test while the built artifact is
  # missing a module: the tests import from src/ either way, and only a clean
  # install from the wheel can tell the difference.
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: "3.12"
      - name: the wheel builds, installs clean, and answers
        run: |
          python -m pip install --upgrade pip
          pip install build
          python -m build --wheel
          python -m venv /tmp/clean
          /tmp/clean/bin/pip install dist/*.whl
          /tmp/clean/bin/aihawk --help
          /tmp/clean/bin/python -c "import aihawk.web, aihawk.brain, aihawk.link, aihawk.cli, aihawk.mcp.server"
          /tmp/clean/bin/python -m aihawk --help > /dev/null
          unzip -l dist/*.whl | grep -q "aihawk/mcp/server.py"

  # 2026-09-04: aihawk 0.4.0 went to the index, then main gained two more
  # changes while pyproject still said 0.4.0. A release from there would have
  # published NOTHING and reported success, because publish.yml treats a version
  # already on the index as a deliberate no-op - which is right for a re-pushed
  # tag and indistinguishable from somebody forgetting to bump.
  #
  # Pull requests only: on main straight after a release the version IS the
  # published one until somebody bumps, and a gate that is red at rest is a gate
  # people learn to skip. The job sets the variable itself, so it cannot silently
  # skip the way a local run does.
  version:
    if: github.event_name == 'pull_request'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          # The gate diffs the tree against the tag of the published
          # version; a shallow clone has no tags and cannot tell.
          fetch-depth: 0
      - uses: actions/setup-python@v5
        with:
          python-version: "3.12"
      - name: the version this change proposes is still free
        env:
          AIHAWK_CHECK_VERSION: "1"
        run: |
          python -m pip install --upgrade pip
          pip install pytest
          python -m pytest -q tests/test_version_is_not_taken.py