name: ci

on:
  push:
    branches: [main]
  pull_request:

jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-python@v5
        with:
          python-version: "3.11"

      # requirements.txt matches pyproject's git-pinned unplug-ai - same deps the HF Space installs.
      # pytest/ruff pinned to the pyproject dev-group floors so CI matches `make lint`/`make test`.
      - name: Install
        run: pip install -r requirements.txt "pytest>=9.0.2" "ruff>=0.15.4"

      - name: Lint
        run: ruff check src/ tests/ app.py modal_app.py

      - name: Test
        run: PYTHONPATH=src pytest tests/ -v

      # Real gate: eval_shields.py exits non-zero on an FPR/recall regression (ML-independent floors,
      # so it's stable even when unplug-tiny can't download in CI).
      - name: Shield eval regression
        run: PYTHONPATH=src python benchmarks/eval_shields.py