name: Eval gate

on:
  pull_request:
    paths:
      - "app/**"
      - "ingest/**"
      - "eval/**"
      - "pyproject.toml"
      - ".github/workflows/eval.yml"
  workflow_dispatch:

jobs:
  retrieval-metrics:
    runs-on: ubuntu-latest
    timeout-minutes: 12
    env:
      EVAL_CI_GATE: "1"
      # Retrieval is the only thing scored in CI — no LLM keys needed, no rate
      # limits, fully deterministic. Generation is graded offline pre-release.
      LLM_PROVIDER: gemini
      GEMINI_API_KEY: ""
    steps:
      - uses: actions/checkout@v4
        with:
          lfs: true

      - uses: actions/setup-python@v5
        with:
          python-version: "3.11"
          cache: pip

      - name: Install deps
        run: |
          pip install --upgrade pip
          pip install \
            "httpx>=0.27" "lancedb>=0.13" "fastembed>=0.4" "flashrank>=0.2" \
            "rank-bm25>=0.2" "fastapi>=0.111" "uvicorn[standard]>=0.30" \
            "python-dotenv>=1.0" "sse-starlette>=2.1" "slowapi>=0.1.9" \
            "google-genai>=0.3" "groq>=0.11" "openai>=1.40" "anthropic>=0.34" \
            "tiktoken>=0.7" pylance

      - name: Verify LanceDB index is present
        run: |
          test -d data/lancedb || (echo "data/lancedb missing — LFS pull failed" && exit 1)
          du -sh data/lancedb

      - name: Run retrieval eval (CI gate: Recall@5 ≥ 0.85, OOC refusal ≥ 0.90)
        run: |
          python -m eval.run_full --out eval/baselines/ci-latest.json

      - name: Upload eval artifact
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: eval-results
          path: eval/baselines/ci-latest.json