ci.yml

name: CI

on:
  push:
    branches: [main]
  pull_request:

jobs:
  # ── Python tests ─────────────────────────────────────────────────────────────
  python-tests:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: "3.11"

      - name: Set up Rust
        uses: dtolnay/rust-toolchain@stable

      - name: Cache cargo registry
        uses: Swatinem/rust-cache@v2
        with:
          workspaces: ". -> target"

      - name: Build engram-core wheel
        run: |
          pip install maturin
          maturin build --release --manifest-path engram-core/Cargo.toml --out dist
          pip install dist/engram_core-*.whl

      - name: Install Python dependencies
        run: pip install ".[dev]" faiss-cpu

      - name: Run tests
        run: python -m pytest tests/ -q --tb=short --cov=engram --cov-report=term-missing

  # ── Type checking ─────────────────────────────────────────────────────────────
  typecheck:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: "3.11"

      - name: Install dependencies
        run: |
          pip install ".[dev]"
          pip install bittensor --quiet || true   # optional; mypy ignore_missing_imports=true

      - name: mypy
        run: mypy engram/ --ignore-missing-imports --no-error-summary

  # ── Rust tests ────────────────────────────────────────────────────────────────
  rust-tests:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Set up Rust
        uses: dtolnay/rust-toolchain@stable

      - name: Cache cargo registry
        uses: Swatinem/rust-cache@v2
        with:
          workspaces: ". -> target"

      - name: Run Rust tests
        run: cargo test --manifest-path engram-core/Cargo.toml --no-default-features

  # ── Build wheel smoke-test ────────────────────────────────────────────────────
  build-wheel:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: "3.11"

      - name: Set up Rust
        uses: dtolnay/rust-toolchain@stable

      - name: Install maturin
        run: pip install maturin

      - name: Build engram-core wheel
        run: maturin build --release --manifest-path engram-core/Cargo.toml --out dist

      - name: Smoke-test wheel
        run: |
          pip install dist/engram_core-*.whl
          python -c "
          import engram_core

          # CID round-trip
          cid = engram_core.generate_cid([0.1, 0.2, 0.3], {}, 'v1')
          assert cid.startswith('v1::') and len(cid.split('::')[1]) == 64

          # Single-CID proof
          challenge = engram_core.generate_challenge(cid, 30)
          response = engram_core.generate_response(challenge, [0.1, 0.2, 0.3])
          assert engram_core.verify_response(challenge, response, [0.1, 0.2, 0.3])
          response2 = engram_core.generate_response_from_parts(
              challenge.cid,
              challenge.nonce_hex,
              challenge.expires_at,
              [0.1, 0.2, 0.3],
          )
          assert response2.proof == response.proof
          assert response2.embedding_hash == response.embedding_hash

          # Batch proof
          cid2 = engram_core.generate_cid([0.4, 0.5, 0.6], {}, 'v1')
          batch = engram_core.generate_batch_challenge([cid, cid2], 30)
          embs = [[0.1, 0.2, 0.3], [0.4, 0.5, 0.6]]
          br = engram_core.generate_batch_response(batch, embs)
          results = engram_core.verify_batch_response(batch, br, embs)
          assert results == [True, True], f'batch verify failed: {results}'

          print('engram_core smoke test: PASS')
          "

  # ── Docker image — GHCR ──────────────────────────────────────────────────────
  # Builds and pushes ghcr.io/dipraise1/engram:latest on every push to main.
  # This image is used by the cloud mining layer (Akash SDL manifests).
  docker:
    needs: [python-tests, rust-tests]
    runs-on: ubuntu-latest
    if: github.ref == 'refs/heads/main'
    permissions:
      contents: read
      packages: write
    steps:
      - name: Free disk space
        run: |
          sudo rm -rf /usr/share/dotnet /usr/share/swift /opt/ghc /opt/hostedtoolcache/CodeQL
          sudo docker image prune -af
          df -h

      - name: Checkout
        uses: actions/checkout@v4

      - name: Log in to GHCR
        run: echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u "${{ github.actor }}" --password-stdin

      - name: Build miner image
        run: |
          IMAGE="ghcr.io/$(echo '${{ github.repository_owner }}' | tr '[:upper:]' '[:lower:]')/engram"
          docker build -t "${IMAGE}:latest" -t "${IMAGE}:${{ github.sha }}" .
          echo "IMAGE=${IMAGE}" >> "$GITHUB_ENV"

      - name: Push miner image
        run: |
          docker push "${IMAGE}:latest"
          docker push "${IMAGE}:${{ github.sha }}"

  # ── Publish to PyPI ───────────────────────────────────────────────────────────
  # Triggered on version tags: git tag v0.1.2 && git push --tags
  publish:
    needs: [python-tests, typecheck, rust-tests, build-wheel]
    runs-on: ubuntu-latest
    if: startsWith(github.ref, 'refs/tags/v')
    environment: pypi
    permissions:
      id-token: write   # required for trusted publishing (OIDC)
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: "3.11"

      - name: Install build tools
        run: pip install build twine

      - name: Build Python distribution
        run: python -m build --sdist --wheel

      - name: Publish to PyPI
        uses: pypa/gh-action-pypi-publish@release/v1
        with:
          # Uses OIDC trusted publishing — no API token needed.
          # Configure at: https://pypi.org/manage/project/engram-subnet/settings/publishing/
          # Add publisher: owner=Dipraise1, repo=-Engram-, workflow=ci.yml, env=pypi
          skip-existing: true