name: Quality Gate

# Repository quality gate. Before this workflow existed, ruff, ty, and pytest were
# enforced only by .pre-commit-config.yaml for developers who had run
# `pre-commit install`.

on:
  push:
  pull_request:

jobs:
  gate:
    runs-on: ubuntu-latest
    steps:
      - name: Check out the commit under test
        uses: actions/checkout@v4

      - name: Install uv
        run: |
          curl -LsSf https://astral.sh/uv/install.sh | sh
          echo "$HOME/.local/bin" >> "$GITHUB_PATH"

      - name: Install dependencies from the lockfile
        # --locked fails if uv.lock has drifted from pyproject.toml, so a stale
        # lockfile is caught here rather than producing an untested dependency set.
        run: uv sync --locked

      - name: Write placeholder configuration
        # Settings requires openrouter_api_key and 115 tests cannot construct
        # Settings without it. This is written to .env.production rather than exported
        # as an environment variable on purpose: the external tests guard on
        # os.getenv("OPENROUTER_API_KEY"), which reads the process environment and
        # not the file, so writing the file reproduces the local result exactly -
        # the 4 external tests skip instead of running against a fake key and
        # failing. Exporting it instead produces 3 failures.
        run: echo "OPENROUTER_API_KEY=ci-placeholder-not-a-real-key" > .env.production

      - name: Lint and type check
        # Runs the hooks defined in .pre-commit-config.yaml instead of repeating
        # "ruff check" and "ty check" here. The commands then have one definition,
        # so the local and CI gates cannot drift apart.
        run: uv run pre-commit run --all-files --show-diff-on-failure

      - name: Tests
        # Deliberately unfiltered, unlike the "-m 'not external'" form the guidance files
        # use for local runs. Tests marked "external" skip themselves when live-service
        # credentials are absent, so CI gets the same effective set plus a real run of any
        # external test whose credentials are configured. Not drift -- do not "fix" this to
        # match the local command without also giving those tests a way to run.
        run: uv run pytest