ci.yml

name: CI

on:
  push:
    branches: [main]
  pull_request:

jobs:
  lint:
    name: Lint
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1

      - uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884  # v10.3.0
        with:
          python-version: "3.11"

      # --locked: install exactly what uv.lock pins, and fail if the lock no
      # longer matches pyproject.toml; a pull request that changes
      # dependencies commits the regenerated lock with them. The release PR
      # gets its lock refreshed by release-please.yml, so it passes too.
      #
      # --no-build: third-party packages come from wheels only, so no setup
      # script from a source distribution runs here. uv still builds this
      # workspace's own three packages from a matching lock; only resolving a
      # stale one would need those builds, and --locked refuses that first.
      - run: uv sync --locked --no-build
      - run: uv run --locked --no-build ruff check coordinode/ langchain-coordinode/ llama-index-coordinode/ tests/
      - run: uv run --locked --no-build ruff format --check coordinode/ langchain-coordinode/ llama-index-coordinode/ tests/

  test:
    name: Test (Python ${{ matrix.python-version }})
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        python-version: ["3.11", "3.12", "3.13", "3.14"]
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
        with:
          submodules: recursive

      - uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884  # v10.3.0
        with:
          python-version: ${{ matrix.python-version }}

      # --locked --no-build: see the lint job.
      - name: Install dependencies
        run: uv sync --all-packages --locked --no-build

      - name: Generate proto stubs
        run: uv run --all-packages --locked --no-build make proto

      - name: Unit tests
        run: uv run --all-packages --locked --no-build pytest tests/unit/ -v

  build-embedded:
    name: Build embedded (CI check)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
        with:
          submodules: recursive

      - name: Build (maturin / Linux x86_64)
        uses: PyO3/maturin-action@e83996d129638aa358a18fbd1dfb82f0b0fb5d3b  # v1.51.0
        with:
          command: build
          args: >-
            --manifest-path coordinode-embedded/Cargo.toml
            --out dist
          manylinux: manylinux_2_28
          before-script-linux: |
            dnf install -y protobuf-compiler

      - uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884  # v10.3.0
        with:
          python-version: "3.12"

      - name: Install wheel + run embedded tests
        # The main `test` job skips coordinode_embedded with importorskip
        # because that runner doesn't build the wheel.  This job has the
        # wheel, so install it and run the embedded tests here, then assert
        # nothing was skipped (a skip with the wheel installed means a
        # broken manylinux glibc / missing numpy / etc., not the expected
        # "no wheel" condition).
        # maturin-action runs inside a manylinux container; only paths
        # under $GITHUB_WORKSPACE are bind-mounted back to the host, so
        # the wheel goes to ./dist/ (workspace-relative), not /tmp/.
        run: |
          set -euo pipefail
          WHL=$(find dist -name 'coordinode_embedded-*.whl' -print -quit)
          test -n "$WHL"
          uv venv --python 3.12 /tmp/test-venv
          # Pinned to the versions uv.lock already resolves for the workspace,
          # so this throwaway venv tests against the same stack as the other
          # jobs instead of whatever is newest on PyPI that morning.
          # Wheels only (--no-build), as everywhere else in this workflow.
          uv pip install --no-build --python /tmp/test-venv/bin/python "$WHL" \
            numpy==2.4.6 pytest==9.1.1 pytest-timeout==2.4.0
          # Every test file that needs the extension belongs here: the main
          # `test` job skips them all for want of a wheel, so a file left out
          # of this list runs in no job at all.
          OUTPUT=$(/tmp/test-venv/bin/python -m pytest \
            tests/unit/test_hnsw.py tests/unit/test_embedded_values.py \
            -v --strict-markers -ra 2>&1)
          echo "$OUTPUT"
          # `-ra` prints a "SKIPPED [N]" short summary header when anything was
          # skipped; importorskip-based skip also surfaces this way.  Use the
          # full output instead of the exit code because pytest treats skips
          # as success.
          if echo "$OUTPUT" | grep -qE '^SKIPPED|=+ .* skipped'; then
            echo "::error::Tests were skipped in build-embedded; the wheel is installed so this is a real failure (broken glibc / missing numpy / etc.)"
            exit 1
          fi
          if ! echo "$OUTPUT" | grep -qE '=+ [0-9]+ passed'; then
            echo "::error::No tests passed; the module was likely not collected"
            exit 1
          fi

  demo-stack:
    # The demo image's install, without Docker: the demo group of uv.lock,
    # hashed wheels only, on the image's Python, then the SDK the way
    # install-sdk.sh puts it in (no dependencies, no build isolation, so
    # nothing reaches the index). A lock change that breaks the demo fails
    # here instead of at someone's container start.
    name: Demo stack
    runs-on: ubuntu-latest
    env:
      # hatch-vcs reads the version from tags, which a shallow checkout lacks;
      # the demo container sets the same value.
      SETUPTOOLS_SCM_PRETEND_VERSION: "999.0.0"
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
        with:
          submodules: recursive

      - uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884  # v10.3.0
        with:
          python-version: "3.13"

      - name: Install the demo group from the lock
        run: |
          uv export --frozen --all-packages --no-default-groups --group demo \
            --no-emit-workspace --format requirements-txt -o "$RUNNER_TEMP/demo-requirements.txt"
          uv venv --seed --python 3.13 "$RUNNER_TEMP/demo"
          "$RUNNER_TEMP/demo/bin/python" -m pip install --only-binary :all: --require-hashes \
            -r "$RUNNER_TEMP/demo-requirements.txt"

      - name: Install the SDK as the container does
        # Editable installs of this repository build from source by design;
        # the rule against setup scripts targets third-party packages.
        run: |
          "$RUNNER_TEMP/demo/bin/python" -m pip install --no-deps --no-build-isolation -e coordinode -e llama-index-coordinode -e langchain-coordinode  # NOSONAR
          make proto PYTHON="$RUNNER_TEMP/demo/bin/python"
          "$RUNNER_TEMP/demo/bin/python" -c "import coordinode, langchain_coordinode, llama_index.graph_stores.coordinode; from coordinode._proto.coordinode.v1.query.cypher_pb2 import ExecuteCypherRequest; ExecuteCypherRequest(query='RETURN 1')"

  test-integration:
    name: Integration tests
    runs-on: ubuntu-latest
    services:
      coordinode:
        # Pinned by digest, not by tag: the proto submodule pins a server
        # version, and a tag can be re-pushed, so `:0.7.2` alone does not name
        # one fixed server. The digest below is 0.7.2; bump both together with
        # the submodule.
        image: ghcr.io/structured-world/coordinode@sha256:3a3657306cbb050f9ab9562965e7645f332d63a30b360813128434559c6cfae7
        ports:
          - 7080:7080
          - 7084:7084
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
        with:
          submodules: recursive

      - uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884  # v10.3.0
        with:
          python-version: "3.11"

      - name: Wait for coordinode
        run: |
          echo "Waiting for coordinode to be ready (HTTP :7084 + gRPC :7080)..."
          for i in $(seq 1 30); do
            if curl -sf http://localhost:7084/health >/dev/null 2>&1 && \
               (echo > /dev/tcp/localhost/7080) 2>/dev/null; then
              echo "coordinode is ready (attempt $i)"
              exit 0
            fi
            echo "Attempt $i/30, not ready yet, sleeping 5s..."
            sleep 5
          done
          echo "Error: coordinode did not become healthy after 150s" >&2
          exit 1

      # --locked --no-build: see the lint job.
      - name: Install + generate proto
        run: |
          uv sync --all-packages --locked --no-build
          uv run --all-packages --locked --no-build make proto

      - name: Integration tests
        env:
          COORDINODE_ADDR: "localhost:7080"
        run: uv run --all-packages --locked --no-build pytest tests/integration/ -v --timeout=30