pr.yml

name: PR

on:
  pull_request:
    # opened and synchronize already run for a draft. ready_for_review would
    # start the same jobs a second time when the pull request leaves draft.
    types: [opened, synchronize, reopened]

concurrency:
  group: pr-${{ github.event.number }}
  cancel-in-progress: true

permissions: {}

env:
  OLLAMA_MODEL_ID: tinyllama
  OLLAMA_DATA_PATH: ./.ollama_data

jobs:
  check:
    name: Check Triggers
    runs-on: ubuntu-slim
    permissions:
      contents: read
      pull-requests: read
    outputs:
      workflows: ${{ steps.diff.outputs.workflows }}
      unit: ${{ steps.diff.outputs.unit }}
      container: ${{ steps.diff.outputs.container }}
      image: ${{ steps.diff.outputs.image }}
      analysis: ${{ steps.diff.outputs.analysis }}
    steps:
      - uses: actions/checkout@v7
        with:
          lfs: true
      - id: diff
        uses: bcgov/actions/diff-triggers@122a9b1c6c082b1b1f18c300020fbdc417b6b0b2 # v0.10.0
        with:
          filters: |
            workflows:
              - .github/workflows/**
            unit:
              - app/**
              - tests/**
              - compose.yml
              - .github/workflows/**
            container:
              - app/**
              - tests/**
              - compose.yml
              - '!app/data/sources.yaml'
            image:
              - app/**
              - tests/**
            analysis:
              - app/**
              - tests/**
              - compose.yml
              - .github/**
              - '!app/data/**'
              - '!app/public/**'

  actionlint:
    name: Lint Workflows
    needs: check
    if: needs.check.outputs.workflows == 'true'
    runs-on: ubuntu-latest
    permissions:
      contents: read
      pull-requests: read
    timeout-minutes: 2
    steps:
      - uses: actions/checkout@v7
        with:
          persist-credentials: false
      - name: Validate PR & Lint Workflows
        uses: bcgov/actions/pr-validate@122a9b1c6c082b1b1f18c300020fbdc417b6b0b2 # v0.10.0

  prepare-tests:
    name: Prepare Test Cache
    needs: check
    if: needs.check.outputs.container == 'true'
    runs-on: ubuntu-26.04
    permissions:
      contents: read
    steps:
      - name: Checkout
        uses: actions/checkout@v7
        with:
          lfs: true

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v4

      - name: Warm Cache (All Test Targets)
        uses: docker/bake-action@v7
        with:
          source: .
          files: compose.yml
          targets: dev
          set: |
            *.cache-from=type=gha
            *.cache-from=type=registry,ref=ghcr.io/miniontech/vexilon/agnav:buildcache
            *.cache-to=type=gha,mode=max

  test-unit:
    name: Unit Tests
    needs: check
    if: needs.check.outputs.unit == 'true'
    runs-on: ubuntu-26.04
    permissions:
      contents: read
    timeout-minutes: 5
    steps:
      - name: Checkout
        uses: actions/checkout@v7

      - name: Set up uv
        uses: astral-sh/setup-uv@v10.3.0
        with:
          enable-cache: true
          cache-dependency-glob: "app/uv.lock"

      - name: Set up Python
        uses: actions/setup-python@v7
        with:
          python-version: "3.14"

      - name: Install Dependencies
        run: |
          cd app
          uv sync --frozen

      - name: Run Deployment Integrity Checks
        run: |
          cd app
          uv run pytest ../tests/deploy_integrity/ -v

      - name: Run Local Unit & Streaming Tests
        env:
          VERIFY_ENABLED: "true"
        run: |
          mkdir -p reports
          cd app
          uv run python -m pytest tests/test_*.py -v \
            --junitxml=../reports/junit.xml \
            --cov=indexing --cov=main --cov-report=xml:../reports/coverage.xml

      - name: Upload Coverage
        uses: actions/upload-artifact@v7
        with:
          name: coverage-report
          path: reports/

  validate-cache:
    name: Validate FAISS Cache
    needs: [test-unit, prepare-tests]
    runs-on: ubuntu-26.04
    permissions:
      contents: read
    steps:
      - name: Checkout
        uses: actions/checkout@v7
        with:
          lfs: true

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v4

      - name: Build and Cache (Validator)
        uses: docker/bake-action@v7
        with:
          load: true
          source: .
          files: compose.yml
          targets: dev
          set: |
            *.cache-from=type=gha
            *.cache-from=type=registry,ref=ghcr.io/miniontech/vexilon/agnav:buildcache

      - name: Validate Cache Manifest
        run: docker compose up test-cache

  test-integration-model:
    name: Integration Tests (Model)
    needs: [test-unit, prepare-tests]
    runs-on: ubuntu-26.04
    permissions:
      contents: read
    timeout-minutes: 10
    steps:
      - name: Checkout
        uses: actions/checkout@v7

      - name: Cache Ollama Models
        uses: actions/cache@v6
        with:
          path: ./.ollama_data
          key: ollama-models-${{ env.OLLAMA_MODEL_ID }}

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v4

      - name: Build and Cache (Integration)
        uses: docker/bake-action@v7
        with:
          load: true
          source: .
          files: compose.yml
          targets: dev
          set: |
            *.cache-from=type=gha
            *.cache-from=type=registry,ref=ghcr.io/miniontech/vexilon/agnav:buildcache

      - name: Run Integration Tests
        run: docker compose up test-integration-model

      - name: Dump Logs on Failure
        if: failure()
        run: docker compose logs

      - name: Cleanup
        if: always()
        run: docker compose down -v || true

  test-integration-app:
    name: Integration Tests (App)
    needs: [test-unit, prepare-tests]
    runs-on: ubuntu-26.04
    permissions:
      contents: read
    timeout-minutes: 15
    steps:
      - name: Checkout
        uses: actions/checkout@v7

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v4

      - name: Build and Cache (Functional Tests)
        uses: docker/bake-action@v7
        with:
          load: true
          source: .
          files: compose.yml
          targets: dev
          set: |
            *.cache-from=type=gha
            *.cache-from=type=registry,ref=ghcr.io/miniontech/vexilon/agnav:buildcache

      - name: Run Integration Tests (App)
        run: docker compose up test-integration-app

      - name: Dump Logs on Failure
        if: failure()
        run: docker compose logs

      - name: Cleanup
        if: always()
        run: docker compose down -v || true

  test-ui-e2e:
    name: UI E2E Tests (Playwright)
    needs: [test-unit, prepare-tests]
    runs-on: ubuntu-26.04
    permissions:
      contents: read
    timeout-minutes: 15
    steps:
      - name: Checkout
        uses: actions/checkout@v7

      - name: Cache Ollama Models
        uses: actions/cache@v6
        with:
          path: ./.ollama_data
          key: ollama-models-${{ env.OLLAMA_MODEL_ID }}

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v4

      - name: Build and Cache (UI E2E)
        uses: docker/bake-action@v7
        with:
          load: true
          source: .
          files: compose.yml
          targets: dev
          set: |
            *.cache-from=type=gha
            *.cache-from=type=registry,ref=ghcr.io/miniontech/vexilon/agnav:buildcache

      - name: Run UI E2E Tests
        run: docker compose up --abort-on-container-exit --exit-code-from test-ui-e2e test-ui-e2e

      - name: Dump Logs on Failure
        if: failure()
        run: docker compose logs

      - name: Cleanup
        if: always()
        run: docker compose down -v || true

  test-e2e:
    name: End-to-End Tests
    needs: [test-unit, prepare-tests]
    runs-on: ubuntu-26.04
    permissions:
      contents: read
    timeout-minutes: 15
    steps:
      - name: Checkout
        uses: actions/checkout@v7

      - name: Cache Ollama Models
        uses: actions/cache@v6
        with:
          path: ./.ollama_data
          key: ollama-models-${{ env.OLLAMA_MODEL_ID }}

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v4

      - name: Build and Cache (E2E)
        uses: docker/bake-action@v7
        with:
          load: true
          source: .
          files: compose.yml
          targets: dev
          set: |
            *.cache-from=type=gha
            *.cache-from=type=registry,ref=ghcr.io/miniontech/vexilon/agnav:buildcache

      - name: Run E2E Tests
        run: docker compose up test-everything

      - name: Dump Logs on Failure
        if: failure()
        run: docker compose logs

      - name: Cleanup
        if: always()
        run: docker compose down -v || true

  build:
    name: Build & Push to GHCR
    needs: [check, test-unit]
    if: needs.check.outputs.image == 'true' && needs.test-unit.result == 'success'
    runs-on: ubuntu-26.04
    timeout-minutes: 20
    permissions:
      attestations: write
      contents: read
      id-token: write
      packages: write
    steps:
      - name: Build and Push
        id: builder
        uses: bcgov/actions/builder@122a9b1c6c082b1b1f18c300020fbdc417b6b0b2 # v0.10.0
        with:
          package: agnav
          build_context: app
          build_file: app/Containerfile

  analysis:
    name: Analysis
    needs: check
    if: needs.check.outputs.analysis == 'true'
    permissions:
      contents: read
      security-events: write
    uses: ./.github/workflows/reusable-analysis.yml

  # ==========================================================================
  # WARNING: This job acts as the required merge gate for this workflow.
  # If you add a new job to this workflow, you MUST add its ID to the 'needs'
  # array below, otherwise its failure or cancellation will not block the PR!
  # ==========================================================================
  results:
    name: PR Results
    needs: [check, actionlint, prepare-tests, test-unit, analysis, build, test-integration-model, test-integration-app, test-ui-e2e, test-e2e, validate-cache]
    if: always()
    runs-on: ubuntu-slim
    timeout-minutes: 1
    steps:
      - uses: bcgov/actions/workflow-results@122a9b1c6c082b1b1f18c300020fbdc417b6b0b2 # v0.10.0
        with:
          needs: ${{ toJson(needs) }}