ci: GitHub Actions CI/CD (lint, types, tests, multimodal + token/usage, secret scan)

[Abhinavexist]

Adds CI/CD for the SDK.

ci.yml — runs on push to main and every PR

• Lint — ruff check (src/tests/scripts)
• Types — mypy --strict
• Unit tests — pytest across a Python 3.9–3.13 matrix
• Secret/token scan — gitleaks over the working tree (fails on any leaked key/token; verified clean locally)

qa-live.yml — end-to-end against the real Interfaze API

Gated: workflow_dispatch + weekly schedule, using the INTERFAZE_API_KEY repo secret (never on PRs — secrets aren't available to forks and it hits the live API). Runs scripts/qa_live.py, which covers text, structured output, json_object fence, tools, streaming/reasoning, precontext, guardrails, every task, the full multimodal input matrix (image / pdf / audio / video, URL and base64), and now token/usage.

Coverage this PR adds (so CI genuinely exercises the asks)

• Multimodalities: unit tests for the video and base64-image input builders (image/file/audio already covered); the live matrix covers real image/pdf/audio/video URL+base64.
• Token checks: a mocked unit test asserting usage (prompt_tokens/completion_tokens/total_tokens) is surfaced, plus a live token usage assertion in qa_live.py. And gitleaks guards against leaked auth tokens.

Unit suite: 27 passing; ruff + mypy --strict clean.

Notes / follow-ups

• ruff format --check is intentionally not gated yet — main has pre-existing format drift (6 files); the in-flight fix PRs (fix: tolerate raw tool-call entries in precontext (#1) #7–feat: ChatInterfaze — in-repo LangChain chat model (#5) #12, fix: OpenAI 1:1 spec-compat reconciliation (interfaze#218) #16) carry ruff format on the files they touch, so main normalizes as those land. Add ruff format --check to ci.yml once it's clean.
• Matrix is 3.9–3.13; requires-python says >=3.8 (EOL) and the langchain extra needs 3.10+ (its marker skips it on 3.9). Worth bumping the floor to >=3.9.
• qa-live needs the INTERFAZE_API_KEY secret set on the repo.
• Uses astral-sh/setup-uv@v6; pins gitleaks v8.21.2.

[Khurdhula-Harshavardhan]

please help resolve the following.

[Khurdhula-Harshavardhan]

please help resolve the following.

[Abhinavexist]

Bumped requires-python to >=3.9 in cfe48f0 (openai 2.x dropped 3.8). Note the CI matrix is 3.10–3.13 (the langchain extra is gated >=3.10), so 3.9 core support is declared but not CI-exercised — say the word if you'd like a core-only 3.9 leg.

[Abhinavexist]

Update: added a core-only py3.9 leg in 0b53faa, so >=3.9 is now actually CI-exercised (not just declared). It installs --extra dev (langchain-openai is marker-gated >=3.10, so it's skipped and its tests no-op); mypy stays on the 3.12 leg with --all-extras.

Locally exercised 3.9 first across the risky surfaces before wiring it up:

• fix: OpenAI compliance audit — .stream() events, streamed usage, request-id, parse/raw-response #20 event-stream: 47 passed
• feat: ChatInterfaze — in-repo LangChain chat model (#5) #12 langchain-skip: 38 passed, 1 skipped (langchain-openai correctly excluded by the >=3.10 marker)
• test: production-harden the suite (error contract, tasks, async, real URLs, coverage gate) #18 hardened suite: 133 passed, 97.31% coverage