ci.yml

name: PR CI
run-name: "trusted-ci:${{ inputs.target_sha }}"

on:
  workflow_dispatch:
    inputs:
      target_sha:
        description: "Exact commit SHA tested by the trusted main workflow"
        required: true
        type: string

concurrency:
  group: trusted-pr-ci-${{ inputs.target_sha }}
  cancel-in-progress: true

permissions:
  contents: read

jobs:
  unit-tests:
    name: PR Test Suite
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - name: Validate exact target SHA
        env:
          TARGET_SHA: ${{ inputs.target_sha }}
        run: |
          set -euo pipefail
          [[ "$TARGET_SHA" =~ ^[0-9a-f]{40}$ ]]

      - name: Checkout exact target with no persisted credential
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
        with:
          ref: ${{ inputs.target_sha }}
          persist-credentials: false
          fetch-depth: 0

      - name: Assert exact checkout
        env:
          TARGET_SHA: ${{ inputs.target_sha }}
        run: test "$(git rev-parse HEAD)" = "$TARGET_SHA"

      - name: Set up Python
        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065
        with:
          python-version: "3.11"

      - name: Install Python dependencies
        run: |
          python -m pip install --upgrade pip
          pip install -r requirements.txt
          pip install pytest==9.0.3

      - name: Set up Node.js
        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020
        with:
          node-version: "22"

      - name: Set up Hugo
        uses: peaceiris/actions-hugo@dc99976453b04b1029527154fc04fef80a4a49cf
        with:
          hugo-version: "0.153.4"
          extended: true

      - name: Install locked frontend dependencies
        run: npm ci --ignore-scripts

      - name: Install Chromium for graph UI smoke tests
        run: python3 -m playwright install --with-deps chromium

      - name: Run stable unit test suite
        env:
          PYTHONPATH: ${{ github.workspace }}
        run: |
          python3 -m unittest \
            tests.test_ai_filter_fallback \
            tests.test_anthropic_response_parsing \
            tests.test_generate_content_guards \
            tests.test_generator_guard_repair \
            tests.test_markdown_normalizer \
            tests.test_runtime_profiles \
            tests.test_search_fallback \
            tests.test_tag_graph_runtime
          python3 -m pytest -q \
            tests/test_content_freshness.py \
            tests/test_workflow_security.py \
            tests/test_cicd_closed_loop.py \
            tests/test_protected_branch_merge.py \
            tests/test_artifact_guard.py \
            tests/test_git_cas_writer.py \
            tests/test_release_guard.py \
            tests/test_release_marker.py \
            tests/test_production_smoke.py \
            tests/test_production_monitor.py \
            tests/test_github_hardening.py \
            tests/test_refresh_transition_guard.py \
            tests/test_lineage_core.py \
            tests/test_lineage_assets.py \
            tests/test_lineage_cli.py \
            tests/test_local_tooling_contract.py \
            tests/test_processor_import_boundary.py \
            tests/test_trends_delivery_contract.py \
            tests/test_trends_page.py \
            tests/test_stack_trends.py \
            tests/test_stack_trends_monitoring.py \
            tests/test_graph_deploy_contract.py \
            tests/test_site_header_contract.py \
            tests/test_tag_graph_v2.py \
            tests/test_taxonomy_normalizer.py \
            tests/test_tagger_taxonomy_normalization.py \
            tests/test_scenario_analyzer_taxonomy.py \
            tests/test_historical_repair.py \
            tests/test_historical_provenance_priority.py \
            tests/test_historical_repair_check.py \
            tests/test_historical_rehydration.py \
            tests/test_historical_publication.py \
            tests/test_historical_taxonomy.py \
            tests/test_historical_source_fetch.py \
            tests/test_historical_capture_job.py \
            tests/test_historical_rehydration_apply.py \
            tests/test_apply_historical_rehydration_cli.py \
            tests/test_content_quality_terminal_archives.py \
            tests/test_historical_ci_configuration.py \
            tests/test_historical_repair_integration.py \
            tests/test_historical_post_structure_repair.py \
            tests/test_historical_integrity_recovery.py \
            tests/test_historical_editorial_cleanup.py \
            tests/test_historical_git_recovery.py \
            tests/test_content_quality_manifest.py \
            tests/test_crawler_dedupe_quality.py \
            tests/test_blogs_podcasts_crawler.py \
            tests/test_source_contract.py \
            tests/test_juejin_full_article.py \
            tests/test_evidence_pipeline.py \
            tests/test_pipeline_cli.py \
            tests/test_pipeline_safety.py \
            tests/test_static_search_configuration.py \
            tests/test_pagefind_catalog.py \
            tests/test_template_hardening.py \
            tests/test_secret_safe_logging.py \
            tests/test_v1_release_contract.py

      - name: Verify committed lineage fixed point
        env:
          PYTHONPATH: ${{ github.workspace }}
        run: |
          python3 scripts/build_lineage.py --apply-post-metadata
          python3 scripts/verify_lineage.py --verify-hashes
          git diff --exit-code -- \
            blog/content/posts \
            data/lineage \
            blog/static/data/lineage
          test -z "$(git status --porcelain --untracked-files=all -- \
            blog/content/posts \
            data/lineage \
            blog/static/data/lineage)"

      - name: Verify committed Post quality manifest
        env:
          PYTHONPATH: ${{ github.workspace }}
        run: |
          python3 scripts/build_content_quality_manifest.py \
            --content-root blog/content \
            --output blog/data/content_quality.json \
            --fail-on-quarantine \
            --fail-on-structural-warning \
            --fail-on-unverified-provenance
          git diff --exit-code -- blog/data/content_quality.json

      - name: Verify historical repair fixed point
        env:
          PYTHONPATH: ${{ github.workspace }}
        run: python3 scripts/repair_historical_content.py --check

      - name: Build committed STACK trend assets
        env:
          PYTHONPATH: ${{ github.workspace }}
        run: python3 scripts/build_stack_trends.py

      - name: Verify committed STACK trend assets
        env:
          PYTHONPATH: ${{ github.workspace }}
        run: |
          python3 scripts/verify_stack_trends.py \
            --root blog/static/data/stack-trends \
            --verify-hashes
          git add --intent-to-add blog/static/data/stack-trends
          git diff --exit-code -- blog/static/data/stack-trends

      - name: Run browser-runtime unit tests
        run: node --test tests/js/*.mjs tests/js/graph-runtime.test.js

      - name: Run real graph workbench browser smoke
        env:
          PYTHONPATH: ${{ github.workspace }}
        run: python3 scripts/verify_graph.py

      - name: Build Hugo and Pagefind delivery
        env:
          PYTHONPATH: ${{ github.workspace }}
        run: |
          npm run build:css
          git diff --exit-code -- blog/static/css/tailwind.css
          cd blog
          hugo --baseURL "https://ai-stack.site/" --minify --cleanDestinationDir
          cd ..
          ./node_modules/.bin/pagefind --site blog/public
          python3 -m ai_stack.pagefind_catalog --public-root blog/public
          test -s blog/public/pagefind/pagefind.js
          test -s blog/public/pagefind/catalog.json
          test -s blog/public/pagefind/catalog.manifest.json

      - name: Verify exact production site artifact in Chromium
        env:
          AI_STACK_PUBLIC_DIR: ${{ github.workspace }}/blog/public
          PYTHONPATH: ${{ github.workspace }}
        run: |
          python3 -m pytest -q tests/e2e/test_static_site.py
          python3 scripts/verify_graph.py --public-dir blog/public