ci.yml

name: SOVEREIGN PRIME CI

on:
  push:
    branches: [ "main" ]
  pull_request:
    branches: [ "main" ]

jobs:
  build-test-audit:
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v4

    - name: Set up Python 3.13
      uses: actions/setup-python@v5
      with:
        python-version: '3.13'
        cache: 'pip'

    - name: Install Dependencies
      run: |
        python -m pip install --upgrade pip
        pip install ruff pytest httpx fastapi uvicorn pydantic pydantic-settings \
          redis pyyaml pyotp
        if [ -f requirements.txt ]; then pip install -r requirements.txt; fi

    - name: Syntax Check All Core Modules
      run: |
        python -m py_compile core/*.py
        echo "All core modules syntax OK"

    - name: Enforce Formatting & Linting (Ruff)
      run: |
        ruff check core/ tests/ --ignore E501
        ruff format --check core/ tests/

    - name: Security Scan (no secrets in source)
      run: |
        grep -rn "sk-[a-zA-Z0-9]\{40\}" core/ && echo "FAIL: OpenAI key found" && exit 1 || true
        grep -rn "AIza[a-zA-Z0-9_-]\{35\}" core/ && echo "FAIL: Google key found" && exit 1 || true
        echo "Secret scan passed"

    - name: Execute Unit Tests
      run: |
        pytest tests/ -v --tb=short -x

    - name: Verify Console Script Entry Points
      run: |
        python -c "
        import importlib
        entries = [
          ('core.mycelium', 'main'), ('core.agent_sre', 'main'),
          ('core.healer', 'main'), ('core.result_collector', 'main'),
          ('core.hydra_gateway', 'app'), ('core.elastic_router', 'ElasticRouter'),
        ]
        for mod, attr in entries:
            m = importlib.import_module(mod)
            assert hasattr(m, attr), f'{mod}:{attr} missing'
            print(f'OK {mod}:{attr}')
        "