ci.yml

# AgentOps Toolkit — CI/CD Pipelines
#
# Workflows:
#   1. ci.yml          — Lint + changelog guard + test on every push/PR; publish dev builds to TestPyPI on develop; VSIX build validation
#   2. _build.yml      — Reusable build (test + package), called by staging and release
#   3. staging.yml     — Staging: release/* branch → TestPyPI → verify; VSIX artifact only
#   4. release.yml     — Production: v* tag → TestPyPI → verify → PyPI → GH Release; VSIX stable → Marketplace
#   5. cut-release.yml — Manual dispatch: create release branch + PR from develop
#
# NOTE: VSIX publishing is handled exclusively by staging.yml (pre-release)
# and release.yml (stable). CI only validates that the VSIX packages correctly.
#
# Trusted Publishing (OIDC):
#   The publish-dev job uses PyPI Trusted Publishing — no API tokens required.
#   Authentication is handled via OpenID Connect (OIDC) between GitHub Actions
#   and TestPyPI.
#
# Setup (Trusted Publishing):
#   1. https://test.pypi.org/manage/project/agentops-accelerator/settings/publishing/
#      → Add publisher: GitHub, owner=Azure, repo=agentops, workflow=ci.yml, environment=staging
#      (This is a SEPARATE entry from the workflow=staging.yml / workflow=release.yml
#       publishers — TestPyPI matches workflow filename exactly.)
#   2. GitHub repo → Settings → Environments → "staging" → confirm "Deployment branches
#      and tags" allows `develop` (publish-dev is the only consumer triggered from develop).

name: CI

on:
  push:
    branches: [develop]
  pull_request:
    branches: [develop]

permissions:
  contents: read

jobs:
  lint:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Install uv
        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0
        with:
          version: ">=0.9.0"
          enable-cache: false  # test matrix saves this cache key

      - name: Set up Python
        run: uv python install 3.11

      - name: Install dependencies
        run: uv sync --group dev

      - name: Lint with ruff
        run: uv run ruff check src/ tests/

      - name: Type check with mypy
        run: uv run mypy src/agentops/ --ignore-missing-imports

  # Fail a PR that changes user-visible behaviour without a CHANGELOG entry.
  # cut-release.yml inserts a versioned heading beneath `## [Unreleased]`; it
  # never writes content, so
  # an omission here silently ships an empty release section (0.8.4, 0.8.5).
  # Skipped by the `no-changelog` label. See docs/release-process.md.
  changelog:
    if: github.event_name == 'pull_request'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0  # need the merge base to diff against develop

      - name: Set up Python
        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: "3.12"

      - name: Check for a CHANGELOG entry
        env:
          PR_TITLE: ${{ github.event.pull_request.title }}
          PR_LABELS: ${{ toJSON(github.event.pull_request.labels.*.name) }}
          PR_AUTHOR: ${{ github.event.pull_request.user.login }}
        run: |
          python scripts/check_changelog.py check-pr \
            --base "origin/${{ github.base_ref }}"

  test:
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, windows-latest]
        python-version: ["3.11", "3.12", "3.13"]
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Install uv
        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0
        with:
          version: ">=0.9.0"

      - name: Set up Python ${{ matrix.python-version }}
        run: uv python install ${{ matrix.python-version }}

      - name: Install dependencies
        run: uv sync --group dev

      - name: Run tests
        run: uv run pytest tests/ -v --tb=short --junitxml=test-results.xml

      - name: Upload test results
        if: always()
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: test-results-${{ matrix.os }}-py${{ matrix.python-version }}
          path: test-results.xml

  coverage:
    runs-on: ubuntu-latest
    needs: test
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Install uv
        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0
        with:
          version: ">=0.9.0"
          enable-cache: false  # test matrix saves this cache key

      - name: Set up Python
        run: uv python install 3.13

      - name: Install dependencies
        run: uv sync --group dev

      - name: Run tests with coverage
        run: uv run pytest tests/ --cov=agentops --cov-report=xml --cov-report=term-missing

      - name: Upload coverage
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: coverage-report
          path: coverage.xml

  # Publish dev build to TestPyPI on every push to develop (not PRs)
  publish-dev:
    if: github.event_name == 'push' && github.ref == 'refs/heads/develop'
    needs: [lint, test]
    runs-on: ubuntu-latest
    environment: staging
    outputs:
      version: ${{ steps.package-version.outputs.version }}
    permissions:
      id-token: write  # Required for PyPI Trusted Publishing (OIDC)
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0 # Full history for setuptools-scm

      - name: Install uv
        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0
        with:
          version: ">=0.9.0"
          enable-cache: false  # test matrix saves this cache key

      - name: Set up Python
        run: uv python install 3.12

      - name: Install dependencies
        run: uv sync --group dev

      - name: Build package
        run: uv build

      - name: Determine built version
        id: package-version
        run: |
          VERSION=$(uv run python - <<'PY'
          from email.parser import BytesParser
          from pathlib import Path
          from zipfile import ZipFile

          wheels = sorted(Path("dist").glob("*.whl"))
          if len(wheels) != 1:
              raise SystemExit(
                  f"Expected exactly one wheel in dist/, found {len(wheels)}."
              )
          with ZipFile(wheels[0]) as archive:
              metadata_files = [
                  name
                  for name in archive.namelist()
                  if name.endswith(".dist-info/METADATA")
              ]
              if len(metadata_files) != 1:
                  raise SystemExit(
                      "Expected exactly one .dist-info/METADATA file in "
                      f"{wheels[0].name}, found {len(metadata_files)}."
                  )
              metadata = BytesParser().parsebytes(archive.read(metadata_files[0]))
          version = metadata.get("Version")
          if not version:
              raise SystemExit(f"No Version field found in {wheels[0].name}.")
          print(version)
          PY
          )
          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
          echo "Built package version: $VERSION"

      - name: Show version
        run: |
          ls -la dist/
          echo "Dev version: ${{ steps.package-version.outputs.version }}"

      - name: Publish to TestPyPI
        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2
        with:
          repository-url: https://test.pypi.org/legacy/
          verbose: true
          skip-existing: true

  # Verify the dev build installs correctly
  verify-dev:
    if: github.event_name == 'push' && github.ref == 'refs/heads/develop'
    needs: publish-dev
    runs-on: ubuntu-latest
    steps:
      - name: Set up Python
        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: "3.12"

      - name: Install from TestPyPI
        env:
          PACKAGE_VERSION: ${{ needs.publish-dev.outputs.version }}
        run: |
          if [ -z "$PACKAGE_VERSION" ]; then
            echo "::error::publish-dev did not expose the built package version."
            exit 1
          fi
          # TestPyPI serves its simple index through a CDN, so a freshly
          # uploaded release is not immediately resolvable even after the
          # upload returns 200 OK. Allow ~6 minutes for it to propagate.
          ATTEMPTS=12
          for i in $(seq 1 "$ATTEMPTS"); do
            echo "Attempt $i/$ATTEMPTS: installing agentops-accelerator==$PACKAGE_VERSION"
            if pip install --no-cache-dir \
              "agentops-accelerator==$PACKAGE_VERSION" \
              --index-url https://test.pypi.org/simple/ \
              --extra-index-url https://pypi.org/simple/; then
              exit 0
            fi
            if [ "$i" -lt "$ATTEMPTS" ]; then
              echo "Not available yet, waiting 30s..."
              sleep 30
            fi
          done
          echo "::error::agentops-accelerator==$PACKAGE_VERSION was not available from TestPyPI after $ATTEMPTS attempts (~6 min)."
          exit 1

      - name: Smoke test
        run: |
          agentops --version
          agentops --help

      - name: Summary
        env:
          PACKAGE_VERSION: ${{ needs.publish-dev.outputs.version }}
        run: |
          echo "## ✅ Dev build published and verified" >> "$GITHUB_STEP_SUMMARY"
          echo "" >> "$GITHUB_STEP_SUMMARY"
          echo "- Version: \`$PACKAGE_VERSION\`" >> "$GITHUB_STEP_SUMMARY"
          echo "- TestPyPI: https://test.pypi.org/project/agentops-accelerator/$PACKAGE_VERSION/" >> "$GITHUB_STEP_SUMMARY"
          echo "" >> "$GITHUB_STEP_SUMMARY"
          echo "Install: \`pip install agentops-accelerator==$PACKAGE_VERSION --index-url https://test.pypi.org/simple/ --extra-index-url https://pypi.org/simple/\`" >> "$GITHUB_STEP_SUMMARY"

  # Validate that the VSIX extension packages correctly
  build-vsix:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      # CI uses the committed package.json version as-is (no publish, dry-run only).
      # The version in package.json is synced by cut-release.yml when a release branch is created.

      - name: Set up Node.js
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: "22"

      - name: Install vsce
        run: npm install -g @vscode/vsce

      - name: Copy root assets for VSIX
        run: |
          cp CHANGELOG.md plugins/agentops/CHANGELOG.md
          cp icon.png plugins/agentops/icon.png

      - name: Package VSIX (dry run)
        working-directory: plugins/agentops
        run: vsce package -o agentops-skills.vsix

      - name: Show VSIX info
        run: |
          ls -la plugins/agentops/*.vsix
          echo "✅ VSIX packaging validated"

      - name: Upload VSIX artifact
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: vsix
          path: plugins/agentops/*.vsix