name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

jobs:
  test:
    runs-on: ubuntu-latest
    # Explicit empty env: prevents accidental dependency on injected
    # secrets. Tests use MockProvider and require no API keys; if a
    # future test imports a provider that needs a key, it will fail
    # in CI and in any contributor fork the same way (no silent
    # divergence based on whether secrets are present).
    env: {}
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-python@v5
        with:
          python-version: "3.11"

      - uses: actions/cache@v4
        with:
          path: ~/.cache/pip
          key: ${{ runner.os }}-pip-${{ hashFiles('pyproject.toml') }}
          restore-keys: ${{ runner.os }}-pip-

      - run: pip install -e ".[dev]"

      - name: Lint
        run: ruff check agent_bench/ tests/

      - name: Type check
        run: mypy agent_bench/ --ignore-missing-imports

      - name: Run tests
        run: pytest tests/ -v --tb=short

  docker:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Build Docker image
        run: docker build -f docker/Dockerfile -t agent-bench:ci .

      - name: Smoke test
        run: |
          docker run --rm agent-bench:ci python -c \
            "from agent_bench import __version__; print(__version__)"