ci.yml

name: CI

on:
  workflow_dispatch:
  pull_request:
  push:
    branches: [main]

permissions:
  contents: read

concurrency:
  group: ci-${{ github.event.pull_request.number || github.ref }}-${{ github.event_name }}
  cancel-in-progress: true

jobs:
  test:
    name: Unit tests
    runs-on: ubuntu-latest
    env:
      # uv.lock pins packages to Databricks' internal pypi-proxy, which hosted
      # GitHub runners can't reach (downloads time out). Re-resolve against
      # public PyPI at CI time: UV_INDEX_URL + a `uv lock` before install.
      UV_INDEX_URL: https://pypi.org/simple
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
      - uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b  # v8.1.0
      - run: uv lock
      - run: uv run pytest --ignore=tests/test_e2e.py

  e2e-shards:
    name: ${{ matrix.name }}
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        include:
          - group: gateway
            name: Gateway API tests
            keyword: not (TestCodexLaunch or TestClaudeLaunch or TestConfigureSubset or TestModelProviderLaunch or TestGeminiLaunch or TestGeminiFreshInstall or TestGeminiAuthRecovery or TestOpencodeLaunch or TestCopilotLaunch or TestPiLaunch)
            package: ''
          - group: claude
            name: Agent launch tests · Claude
            keyword: TestClaudeLaunch or TestConfigureSubset or (TestModelProviderLaunch and not codex)
            package: '@anthropic-ai/claude-code@2.1.274'
          - group: codex
            name: Agent launch tests · Codex
            keyword: TestCodexLaunch or (TestModelProviderLaunch and codex)
            package: '@openai/codex'
          - group: gemini
            name: Agent launch tests · Gemini
            keyword: TestGeminiLaunch or TestGeminiFreshInstall or TestGeminiAuthRecovery
            package: '@google/gemini-cli'
          - group: opencode
            name: Agent launch tests · OpenCode
            keyword: TestOpencodeLaunch
            package: opencode-ai@1
          - group: copilot
            name: Agent launch tests · Copilot
            keyword: TestCopilotLaunch
            package: '@github/copilot@1.0.80'
          - group: pi
            name: Agent launch tests · Pi
            keyword: TestPiLaunch
            package: '@earendil-works/pi-coding-agent'
    env:
      # See the test job: hosted runners can't reach the internal pypi-proxy,
      # so resolve against public PyPI (paired with the `uv lock` step below).
      UV_INDEX_URL: https://pypi.org/simple
      UCODE_TEST_WORKSPACE: ${{ secrets.UCODE_TEST_WORKSPACE }}
      DATABRICKS_HOST: ${{ secrets.UCODE_TEST_WORKSPACE }}
      # DATABRICKS_BEARER is the CI escape hatch: `databricks auth token`
      # only retrieves cached user-OAuth tokens, so on a hosted runner
      # (no databrickscfg, no cached login) it can never produce a bearer.
      # Pre-fetch one (e.g. via M2M OAuth client_credentials against
      # /oidc/v1/token) and store it as a repo secret. Both
      # has_valid_databricks_auth + get_databricks_token + the agents'
      # apiKeyHelper short-circuit to this value when set. Tokens are
      # short-lived (~1h); rotate when CI starts failing with 401s.
      DATABRICKS_BEARER: ${{ secrets.DATABRICKS_BEARER }}
      # Subscription OAuth token for the relayed-launch e2e test; the test skips when unset.
      CLAUDE_CODE_OAUTH_TOKEN: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
      AGENT_PACKAGE: ${{ matrix.package }}
      TEST_KEYWORD: ${{ matrix.keyword }}
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020  # v4
      - uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b  # v8.1.0
      - uses: databricks/setup-cli@bdb89f81c11a5bd647fd55b585b7c396ec68a25a  # v1.0.0
      - name: Install the shard's agent CLI
        if: ${{ matrix.package != '' }}
        run: npm install -g "$AGENT_PACKAGE"
      - run: uv lock
      - run: uv tool install .
      # Redirect stdin so any interactive `databricks auth login --no-browser`
      # fallback EOFs instead of hanging the runner. With DATABRICKS_BEARER
      # set, the auth code path doesn't shell out at all — this is a safety
      # net for any code path we may have missed.
      - run: uv run pytest tests/test_e2e.py -v -k "$TEST_KEYWORD" < /dev/null

  e2e:
    name: All agent tests
    if: ${{ !cancelled() }}
    needs: e2e-shards
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
      - name: Require every e2e shard to pass
        env:
          RESULT: ${{ needs.e2e-shards.result }}
        run: test "$RESULT" = success

  integration:
    name: Integration
    # Start alongside unit/agent tests. Only the final required-e2e gate
    # waits for both suites; an agent failure must not skip integration.
    if: ${{ !cancelled() }}
    uses: ./.github/workflows/integration.yml
    secrets: inherit

  # Preserve the exact contexts required by the repository's branch rules.
  # Keep these aliases until the rules and all active branches migrate together.
  required-tests:
    name: test
    if: ${{ !cancelled() }}
    needs: test
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
      - name: Require unit tests to pass
        env:
          RESULT: ${{ needs.test.result }}
        run: test "$RESULT" = success

  required-e2e:
    name: e2e
    if: ${{ !cancelled() }}
    needs: [e2e, integration]
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
      - name: Require all agent and integration tests to pass
        env:
          RESULT: ${{ needs.e2e.result }}
          INTEGRATION_RESULT: ${{ needs.integration.result }}
        run: test "$RESULT" = success && test "$INTEGRATION_RESULT" = success