name: CI
on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: pnpm/action-setup@v4
        with:
          version: 10.18.2
      - uses: actions/setup-node@v4
        with:
          node-version: 22
          cache: pnpm
      - run: pnpm install --frozen-lockfile
      - run: pnpm build
      - run: pnpm typecheck
      - run: pnpm --filter @agentkitai/agentlens-core test -- --coverage
      - run: pnpm --filter @agentkitai/agentlens-server test -- --coverage
      - run: pnpm --filter @agentkitai/agentlens-mcp test -- --coverage
      - run: pnpm --filter @agentkitai/agentlens-sdk test -- --coverage
      - run: pnpm --filter @agentkitai/agentlens-auth test -- --coverage
      - run: pnpm --filter @agentkitai/agentlens-cli test -- --coverage
      - run: pnpm --filter @agentkitai/agentlens-sdk-integration-tests test
      - run: pnpm --filter @agentkitai/agentlens-dashboard test
      - run: pnpm --filter @agentkitai/agentlens-dashboard build
      - name: Verify SDK packaging
        run: cd packages/sdk && npm pack --dry-run
      - name: Upload coverage
        if: always()
        uses: codecov/codecov-action@v4
        with:
          token: ${{ secrets.CODECOV_TOKEN }}
          files: ./packages/*/coverage/lcov.info
          fail_ci_if_error: false

  test-python-sdk:
    runs-on: ubuntu-latest
    strategy:
      matrix:
        python-version: ['3.9', '3.10', '3.11', '3.12', '3.13']
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: ${{ matrix.python-version }}
      - name: Install dependencies
        working-directory: packages/python-sdk
        run: |
          pip install -e ".[dev]"
      - name: Lint
        working-directory: packages/python-sdk
        run: ruff check .
      - name: Type check
        working-directory: packages/python-sdk
        run: mypy src/ --exclude '_pytest|pytest'
      - name: Test
        working-directory: packages/python-sdk
        run: pytest
      - name: Verify build
        working-directory: packages/python-sdk
        run: |
          pip install build
          python -m build
          rm -rf dist/

  test-postgres:
    runs-on: ubuntu-latest
    services:
      postgres:
        image: pgvector/pgvector:pg16
        env:
          POSTGRES_USER: test
          POSTGRES_PASSWORD: test
          POSTGRES_DB: agentlens_test
        ports:
          - 5432:5432
        options: >-
          --health-cmd "pg_isready -U test"
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5
    steps:
      - uses: actions/checkout@v4
      - uses: pnpm/action-setup@v4
        with:
          version: 10.18.2
      - uses: actions/setup-node@v4
        with:
          node-version: 22
          cache: pnpm
      - run: pnpm install --frozen-lockfile
      - run: pnpm build
      - run: pnpm --filter @agentkitai/agentlens-server exec vitest run --config vitest.postgres.config.ts
        env:
          DB_DIALECT: postgresql
          DATABASE_URL: postgres://test:test@localhost:5432/agentlens_test

  # Smoke-tests the README headline: ingest a trace, verify the hash chain,
  # tamper a record, confirm verification fails. demo/aha.sh exits non-zero
  # if the audit log ever stops catching tampering.
  aha-demo:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Build image
        run: docker build -t agentlens:demo .
      - name: Run the tamper-evident audit-log demo
        run: AGENTLENS_IMAGE=agentlens:demo ./demo/aha.sh