ci.yml

name: CI

on:
  push:
    branches:
      - main
  pull_request:

permissions:
  contents: read

concurrency:
  group: ci-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  python:
    name: Python checks and backend tests
    runs-on: ubuntu-latest
    timeout-minutes: 10

    steps:
      - name: Check out repository
        uses: actions/checkout@v4

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: "3.12"

      - name: Install backend test dependencies
        run: |
          python -m pip install --upgrade pip
          python -m pip install -r backend/requirements.txt
          python -m pip install pytest

      - name: Compile Python sources
        run: |
          python -m compileall -q \
            backend \
            scripts \
            capture.py \
            github_store.py \
            ingest.py \
            instrumentation.py \
            mcp_server.py \
            redis_store.py \
            ui.py

      - name: Run backend unit tests
        # pytest is the canonical runner: conftest.py provides fixtures + temp-dir
        # isolation that `unittest discover` bypasses, and some tests/subtests only
        # behave correctly under pytest.
        run: python -m pytest backend/tests -q

      - name: Run retrieval quality regression gate
        run: python scripts/retrieval_eval.py

      - name: Run MCP tool-routing gate
        run: python scripts/tool_routing_eval.py

      - name: Run universal adapter contract gate
        run: python scripts/adapter_contract_eval.py

      - name: Run context-pack quality gate
        run: python scripts/context_pack_eval.py

      - name: Run per-model token-calibration gate
        run: python scripts/token_calibration_eval.py

      - name: Run agent-task end-to-end gate
        run: python scripts/agent_task_eval.py --deterministic

      - name: Run delivery/push safety gate
        run: python scripts/delivery_eval.py

      # EMBEDDINGS DEMO-INTEGRITY GUARD (CI-visible skip): this job installs
      # backend/requirements.txt only, which does NOT provision the model2vec package or the
      # potion-base-8M weights, so the model2vec-seeded gate legitimately skips here. We do NOT
      # pass --forbid-skip (that would break CI without adding new model-provisioning
      # infrastructure); instead the skip is made EXPLICIT: the eval output is captured and a
      # status=skipped result emits a GitHub notice annotation, so a skip shows up in the job
      # log/summary rather than passing silently. Strict enforcement lives in the release path,
      # where the model is guaranteed present: macos/package_release.sh exports
      # CORTEX_REQUIRE_MODEL=1 and runs check_vector_runtime.py --require-model2vec.
      - name: Run model2vec retrieval-lift gate (explicit skip when model not provisioned)
        run: |
          python scripts/rerank_eval.py | tee "$RUNNER_TEMP/rerank_eval.json"
          if grep -q '"status": "skipped"' "$RUNNER_TEMP/rerank_eval.json"; then
            echo "::notice title=rerank_eval status=skipped::model2vec is not provisioned in this CI job, so the semantic retrieval-lift gate did not run. Release artifacts enforce the real model via CORTEX_REQUIRE_MODEL=1 + check_vector_runtime.py --require-model2vec."
          fi

      - name: Run adaptation quality evaluation
        run: python scripts/adaptation_eval.py

      - name: Check connector baseline contract
        run: python scripts/check_connector_baseline.py

      - name: Check beta docs currency
        run: python scripts/check_docs_current.py

      - name: Run backend beta smoke
        run: python scripts/backend_beta_smoke.py

      - name: Run lightweight ops readiness
        run: python scripts/ops_readiness_check.py --skip-tests --skip-build --output-root "$RUNNER_TEMP/cortex-empty-outputs"

      - name: App Store compliance gate (guidelines 2.5.1 / 2.5.2 / 4.8 + privacy/entitlements)
        run: python scripts/appstore_compliance_lint.py

  security-scan:
    name: Security scan (bandit + pip-audit)
    runs-on: ubuntu-latest
    timeout-minutes: 10

    steps:
      - name: Check out repository
        uses: actions/checkout@v4

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: "3.12"

      - name: Install security tools
        run: |
          python -m pip install --upgrade pip
          python -m pip install bandit pip-audit

      - name: Bandit static security scan
        # Fail on MEDIUM-or-higher severity findings; documented false-positive test IDs are
        # skipped in .bandit.yaml. Verified this still fails on real issues (e.g. shell=True/B602).
        run: bandit -c .bandit.yaml -r backend scripts -ll

      - name: Audit backend dependencies for known vulnerabilities
        run: pip-audit --strict -r backend/requirements.txt

      - name: Audit top-level dependencies for known vulnerabilities
        run: pip-audit --strict -r requirements.txt

  distribution:
    name: Distribution site and update manifest
    runs-on: ubuntu-latest
    timeout-minutes: 10

    steps:
      - name: Check out repository
        uses: actions/checkout@v4

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: "3.12"

      - name: Validate distribution site
        run: python scripts/check_distribution_site.py

      - name: Validate site update manifest
        run: python scripts/validate_update_manifest.py site/downloads/latest.json

  obsidian-plugin:
    name: Obsidian plugin build
    runs-on: ubuntu-latest
    timeout-minutes: 10

    steps:
      - name: Check out repository
        uses: actions/checkout@v4

      - name: Set up Node
        uses: actions/setup-node@v4
        with:
          node-version: "22"
          cache: npm
          cache-dependency-path: packages/obsidian-cortex-plugin/package-lock.json

      - name: Typecheck and build Obsidian plugin
        run: scripts/check_obsidian_plugin.sh

  macos-app:
    name: macOS app build
    runs-on: macos-latest
    timeout-minutes: 15

    steps:
      - name: Check out repository
        uses: actions/checkout@v4

      # Dev-mode build: CORTEX_BUNDLE_PYTHON=0 means no bundled interpreter and no bundled
      # model2vec model, so build.sh prints its loud "EMBEDDINGS FALLBACK" warning here — that is
      # expected and non-fatal. CORTEX_REQUIRE_MODEL is deliberately NOT set: this CI job does not
      # provision the model; only release packaging (macos/package_release.sh) enforces it.
      - name: Build app bundle
        env:
          CORTEX_BUNDLE_PYTHON: "0"
          CORTEX_CODESIGN_IDENTITY: "-"
          CORTEX_CODESIGN_TIMESTAMP: "0"
        run: ./macos/build.sh

      - name: Verify ad-hoc signed app
        run: codesign --verify --deep --strict --verbose=2 macos/build/Cortex.app