ci: replace starter workflow with real gates (#75)

.github/workflows/ci.yml

@@ -1,6 +1,6 @@
-# This workflow will install Python dependencies, run tests and lint with a single version of Python
-# For more information see: https://docs.github.com/en/actions/automating-builds-and-tests/building-and-testing-python
-
+# CI gates for raglogs. Enforces what the project actually cares about:
+# ruff lint, unit tests with a src/core coverage floor, and integration tests
+# against a real Postgres+pgvector service — across the supported Python range.
 name: CI
 
 on:
@@ -11,54 +11,87 @@ on:
     paths-ignore:
       - "**/*.md"
       - "CODEOWNERS"
-      - "Makefile"
   pull_request:
     branches: [ "main" ]
     paths-ignore:
       - "**/*.md"
       - "CODEOWNERS"
-      - "Makefile"
 
 permissions:
   contents: read
 
 jobs:
-  build:
+  test:
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ["3.10", "3.12"]
+    services:
+      postgres:
+        image: pgvector/pgvector:pg16
+        env:
+          POSTGRES_USER: postgres
+          POSTGRES_PASSWORD: postgres
+          POSTGRES_DB: raglogs
+        ports:
+          - 5432:5432
+        options: >-
+          --health-cmd "pg_isready -U postgres"
+          --health-interval 10s
+          --health-timeout 5s
+          --health-retries 5
+    env:
+      DB_URL: postgresql+psycopg://postgres:postgres@localhost:5432/raglogs
+    steps:
+      - uses: actions/checkout@v7
+      - name: Set up Python ${{ matrix.python-version }}
+        uses: actions/setup-python@v7
+        with:
+          python-version: ${{ matrix.python-version }}
+      - name: Install dependencies
+        run: |
+          python -m pip install --upgrade pip
+          pip install -e ".[dev]"
+      - name: Lint (ruff)
+        run: make lint
+      - name: Unit tests (with src/core coverage floor)
+        # Floor starts at the current level (~87%); ratchet upward over time,
+        # never set an aspirational number that turns main red.
+        run: pytest tests/unit/ --cov=src/core --cov-report=term-missing --cov-fail-under=85
+      - name: Integration tests (real Postgres + pgvector)
+        run: make test-int
 
+  openapi:
     runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - name: Set up Python
+        uses: actions/setup-python@v7
+        with:
+          python-version: "3.12"
+      - name: Install dependencies
+        run: |
+          python -m pip install --upgrade pip
+          pip install -e ".[dev]"
+      - name: Export OpenAPI
+        run: PYTHONPATH=. python scripts/export_openapi.py
+      - name: Upload OpenAPI artifact
+        uses: actions/upload-artifact@v7
+        with:
+          name: openapi.json
+          path: clients/openapi.json
 
+  docker:
+    runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v7
-    - name: Set up Python 3.10
-      uses: actions/setup-python@v7
-      with:
-        python-version: "3.10"
-    - name: Install dependencies
-      run: |
-        python -m pip install --upgrade pip
-        pip install flake8 pytest
-        if [ -f requirements.txt ]; then pip install -r requirements.txt; fi
-    - name: Lint with flake8
-      run: |
-        # stop the build if there are Python syntax errors or undefined names
-        flake8 . --count --select=E9,F63,F7,F82 --show-source --statistics
-        # exit-zero treats all errors as warnings. The GitHub editor is 127 chars wide
-        flake8 . --count --exit-zero --max-complexity=10 --max-line-length=127 --statistics
-    - name: Test with pytest
-      run: |
-        pytest
-    - name: Export OpenAPI
-      run: |
-        PYTHONPATH=. python scripts/export_openapi.py
-    - name: Upload OpenAPI artifact
-      uses: actions/upload-artifact@v7
-      with:
-        name: openapi.json
-        path: clients/openapi.json
+      - uses: actions/checkout@v7
+      - name: Docker build smoke test
+        run: docker build -t raglogs:ci .
 
   publish-openapi-release:
     if: startsWith(github.ref, 'refs/tags/')
-    needs: build
+    needs: openapi
     runs-on: ubuntu-latest
     permissions:
       contents: write

CONTRIBUTING.md

@@ -12,7 +12,7 @@ This document covers how to get set up, what the codebase expects, and how to su
 git clone https://github.com/leo-aa88/raglogs
 cd raglogs
 python -m venv .venv && source .venv/bin/activate
-pip install -r requirements.txt && pip install -e .
+pip install -e ".[dev]"
 cp .env.example .env
 # Edit .env — set DB_URL at minimum
 docker compose up postgres -d

Dockerfile

@@ -7,10 +7,11 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
     libpq-dev \
     && rm -rf /var/lib/apt/lists/*
 
-COPY pyproject.toml .
-RUN pip install --no-cache-dir -e ".[dev]"
-
+# Copy the whole project before installing: the hatchling build backend reads
+# README.md (readme=) and src/ (packages=["src"]) to generate metadata, so an
+# editable install can't run against pyproject.toml alone.
 COPY . .
+RUN pip install --no-cache-dir -e ".[dev]"
 
 EXPOSE 8000
 

Makefile

@@ -48,9 +48,6 @@ help:
 
 # ── Setup ─────────────────────────────────────────────────────────────────────
 
-install-requirements:
-	$(PIP) install -r requirements.txt
-
 install-dev:
 	$(PIP) install -e ".[dev]"
 

README.md

@@ -1305,8 +1305,8 @@ injects the header, or keep auth off on loopback). `/health` stays public.
 ## Development
 
 ```bash
-# Install everything
-pip install -r requirements.txt && pip install -e .
+# Install everything (runtime + dev tooling)
+pip install -e ".[dev]"
 
 # Unit tests (no DB needed)
 make test-unit

pyproject.toml

@@ -49,6 +49,7 @@ dev = [
     "pytest-cov>=5.0.0",
     "anyio>=4.0.0",
     "moto[logs]>=5.0.0",
+    "ruff>=0.6.0",
 ]
 
 [project.scripts]

tests/integration/test_cloudwatch_ingest.py

@@ -29,6 +29,9 @@ def db_session():
     with engine.connect() as conn:
         conn.execute(text("CREATE EXTENSION IF NOT EXISTS vector"))
         conn.commit()
+    # Clean slate so tests stay isolated when they share one database
+    # (e.g. a single Postgres service across the whole CI run).
+    Base.metadata.drop_all(engine)
     Base.metadata.create_all(engine)
 
     with get_db() as db:
@@ -50,19 +53,22 @@ def test_cloudwatch_ingest_then_explain(db_session):
         client.create_log_stream(logGroupName="/aws/lambda/my-service", logStreamName="stream-1")
 
         now_ms = int(datetime.now(tz=timezone.utc).timestamp() * 1000)
+        # Distinct messages per event: identical content would be collapsed by
+        # the ingest content-dedup (see test_ingest_dedup), leaving one row and
+        # defeating this test's point — that all five persist with a timestamp.
         client.put_log_events(
             logGroupName="/aws/lambda/my-service",
             logStreamName="stream-1",
             logEvents=[
                 {
-                    "timestamp": now_ms,
+                    "timestamp": now_ms + i * 1000,
                     "message": (
                         '{"level": "error", "message": '
-                        '"Stripe webhook signature verification failed", '
+                        f'"Stripe webhook signature verification failed (attempt {i})", '
                         '"service": "billing-worker"}'
                     ),
                 }
-                for _ in range(5)
+                for i in range(5)
             ],
         )
 

tests/integration/test_full_flow.py

@@ -29,6 +29,9 @@ def db_session():
     with engine.connect() as conn:
         conn.execute(text("CREATE EXTENSION IF NOT EXISTS vector"))
         conn.commit()
+    # Clean slate so tests stay isolated when they share one database
+    # (e.g. a single Postgres service across the whole CI run).
+    Base.metadata.drop_all(engine)
     Base.metadata.create_all(engine)
 
     with get_db() as db:

tests/integration/test_ingest_dedup.py

@@ -27,6 +27,9 @@ def db_session():
     with engine.connect() as conn:
         conn.execute(text("CREATE EXTENSION IF NOT EXISTS vector"))
         conn.commit()
+    # Clean slate so tests stay isolated when they share one database
+    # (e.g. a single Postgres service across the whole CI run).
+    Base.metadata.drop_all(engine)
     Base.metadata.create_all(engine)
 
     with get_db() as db:

tests/integration/test_trigger_search.py

@@ -62,6 +62,9 @@ def db_session():
     with engine.connect() as conn:
         conn.execute(text("CREATE EXTENSION IF NOT EXISTS vector"))
         conn.commit()
+    # Clean slate so tests stay isolated when they share one database
+    # (e.g. a single Postgres service across the whole CI run).
+    Base.metadata.drop_all(engine)
     Base.metadata.create_all(engine)
 
     with get_db() as db: