ci.yml

name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
  workflow_dispatch:

concurrency:
  group: ci-${{ github.ref }}
  cancel-in-progress: true

# Read-only by default. A job that needs more asks for it itself, so a
# compromised dependency in one step cannot push to the repository.
permissions:
  contents: read

jobs:
  lint-and-test:
    name: lint + fast tests (py${{ matrix.python-version }})
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        python-version: ["3.9", "3.10", "3.11", "3.12", "3.13"]
    steps:
      - uses: actions/checkout@v7
      - uses: actions/setup-python@v7
        with:
          python-version: ${{ matrix.python-version }}
          cache: pip
      - name: Install (CPU torch)
        run: |
          python -m pip install --upgrade pip
          pip install torch --index-url https://download.pytorch.org/whl/cpu
          pip install -e ".[dev]"
      - name: Ruff
        run: ruff check .
      - name: Mypy
        run: mypy
      - name: Fast tests
        run: pytest -m "not slow" -q --cov=decisionrl --cov-report=term-missing

  learning-tests:
    name: learning / integration tests
    runs-on: ubuntu-latest
    needs: lint-and-test
    steps:
      - uses: actions/checkout@v7
      - uses: actions/setup-python@v7
        with:
          python-version: "3.11"
          cache: pip
      - name: Install (CPU torch)
        run: |
          python -m pip install --upgrade pip
          pip install torch --index-url https://download.pytorch.org/whl/cpu
          pip install -e ".[dev]"
      - name: Slow tests
        # Parallelize the learning/integration tests across cores; single-thread each
        # worker's torch so the processes don't oversubscribe the runner.
        env:
          OMP_NUM_THREADS: "1"
        run: pytest -m "slow" -q -n auto -p no:cacheprovider

  docker-serve:
    name: docker serving image (build + smoke test)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - name: Build the serving image
        run: docker build -f deploy/Dockerfile -t decisionrl-serve .
      - name: Run the container
        run: docker run -d -p 8000:8000 --name serve decisionrl-serve
      - name: Wait for /health
        run: |
          for i in $(seq 1 30); do
            if curl -sf localhost:8000/health; then echo " -> up"; exit 0; fi
            sleep 1
          done
          echo "server did not become healthy"; docker logs serve; exit 1
      - name: Smoke-test /info and /predict
        run: |
          set -euo pipefail
          curl -sf localhost:8000/info
          action=$(curl -sf -X POST localhost:8000/predict \
            -H 'content-type: application/json' -d '{"observation": [0, 0, 0, 0]}')
          echo "predict -> $action"
          echo "$action" | grep -q '"action"' || { echo "no action in response"; exit 1; }
      - name: Report image size
        run: docker image inspect decisionrl-serve --format 'serving image size {{.Size}} bytes'
      - name: Stop the container
        if: always()
        run: docker rm -f serve || true

  ci:
    name: CI
    runs-on: ubuntu-latest
    if: always()
    needs: [lint-and-test, learning-tests, docker-serve]
    steps:
      # One aggregate check to require in branch protection. Without it, adding
      # a Python version to the matrix silently leaves it unrequired, and a red
      # job stops blocking merges.
      - name: Fail if any job did not succeed
        if: contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled')
        run: |
          echo "One or more jobs failed:"
          echo '${{ toJSON(needs) }}'
          exit 1
      - run: echo "All checks passed."