ci.yml

# RGCS v3 hosted CI.
#
# Two-tier design (NR3-001 Policy A, docs/V2_BASELINE_AUDIT.md §3):
#   * portable  — ubuntu/windows/macos × Python 3.11/3.13. Runs every
#     test EXCEPT the single golden byte-equality test
#     (tests/regression/test_generator_determinism.py::test_generator_deterministic),
#     which compares byte-identical floating-point CSV output generated on
#     the pinned Linux reference environment and is not portable across
#     platforms/library versions. Only that exact node id is deselected;
#     tolerance-aware numerical equivalence tests run everywhere.
#   * reference — ubuntu + Python 3.11 with numpy/scipy pinned to the
#     golden generation versions; the closest hosted approximation of the
#     archived v2 build environment, plus the release-builder smoke.
#     D-V3-04: even this drifts at the last digit (libm/toolchain), so
#     byte-equality is scoped to the ARCHIVED environment (verified at v2
#     release, recorded by checksum); every job — reference included —
#     runs the portable tolerance-aware equivalence test
#     (test_generator_numerically_equivalent) instead, and deselects only
#     the exact byte-equality node id.
#
# No continue-on-error anywhere; JUnit XML is uploaded from every job.
name: ci

on:
  push:
    branches: [main, v4-dev, "program/**", rcw-public-workbench]
    tags: ["v*"]
  pull_request:

env:
  QT_QPA_PLATFORM: offscreen
  PYTHONIOENCODING: utf-8

jobs:
  portable:
    name: portable / ${{ matrix.os }} / py${{ matrix.python-version }}
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, windows-latest, macos-latest]
        python-version: ["3.11", "3.13"]
    runs-on: ${{ matrix.os }}
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0   # baseline scanner verifies authority commits
      - uses: actions/setup-python@v5
        with:
          python-version: ${{ matrix.python-version }}
      - name: Qt system libraries (Linux offscreen)
        if: runner.os == 'Linux'
        run: |
          sudo apt-get update
          sudo apt-get install -y --no-install-recommends \
            libegl1 libgl1 libxkbcommon0 libxkbcommon-x11-0 \
            libdbus-1-3 libfontconfig1
      - name: Install (declared dependencies from pyproject)
        run: |
          python -m pip install --upgrade pip
          python -m pip install -e ".[desktop,dev,workbook,workbench]"
          python -m pip install pypdf
          # v4 solver stack (tests/v4 in default testpaths; gmsh is an
          # external subprocess per DV4-006 — the pip wheel ships the
          # binary; pyopencl intentionally absent: accel tests
          # self-skip and NOTHING may report a silent fallback as GPU)
          python -m pip install "scikit-fem>=10" meshio matplotlib gmsh
      - name: Governance and schema lint
        run: |
          python experiments/schemas/validate.py
          python tools/generate_optical_comparison.py --check
      - name: Recursive Infrastructure Lab smoke
        run: |
          python tools/lab/build_static_hub.py
          python -m pytest -q tests/rgcs_lab tests/rgcs_coordinate
          rgcs-lab doctor
      - name: Portable test suite (NR3-001 byte test deselected, see header)
        run: >
          python -m pytest -q
          --deselect tests/regression/test_generator_determinism.py::test_generator_deterministic
          --junitxml=junit-${{ matrix.os }}-py${{ matrix.python-version }}.xml
      - name: Upload JUnit + logs
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: junit-portable-${{ matrix.os }}-py${{ matrix.python-version }}
          path: junit-*.xml
          if-no-files-found: warn

  reference:
    name: reference / ubuntu / py3.11 / pinned numpy
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0   # baseline scanner verifies authority commits
      - uses: actions/setup-python@v5
        with:
          python-version: "3.11"
      - name: Qt system libraries
        run: |
          sudo apt-get update
          sudo apt-get install -y --no-install-recommends \
            libegl1 libgl1 libxkbcommon0 libxkbcommon-x11-0 \
            libdbus-1-3 libfontconfig1
      - name: Install with pinned reference numpy
        # numpy pinned to the golden-CSV generation version
        # (docs/V2_BASELINE_AUDIT.md: Linux/Py3.11/numpy 2.4.4).
        run: |
          python -m pip install --upgrade pip
          python -m pip install -e ".[desktop,dev,workbook]"
          python -m pip install pypdf "numpy==2.4.4" "scipy==1.17.1"
          python -m pip install "scikit-fem>=10" meshio matplotlib gmsh
      - name: Governance and schema lint
        run: |
          python experiments/schemas/validate.py
          python tools/generate_optical_comparison.py --check
      - name: Full suite (byte-equality scoped to archived env, D-V3-04)
        run: >
          python -m pytest -q
          --deselect tests/regression/test_generator_determinism.py::test_generator_deterministic
          --junitxml=junit-reference.xml
      - name: Release builder smoke (source archive from HEAD)
        run: python tools/build_v3_release.py "$(git rev-parse HEAD)"
      - name: Upload JUnit + logs
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: junit-reference
          path: junit-*.xml
          if-no-files-found: warn

  v4-demo:
    # G25/G27: the one-command demo + proof bundle from a CLEAN
    # workspace on every OS, plus the adversarial QA audit. iGPU
    # hardware evidence is NOT collected here (no OpenCL devices on
    # hosted runners; DV4-007 forbids reporting fallback as GPU) —
    # the committed evidence/v4/agent07 artifacts carry the real-
    # hardware results.
    name: v4-demo / ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, windows-latest, macos-latest]
    runs-on: ${{ matrix.os }}
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0   # QA audit verifies frozen history vs old commits
      - uses: actions/setup-python@v5
        with:
          python-version: "3.12"
      - name: gmsh system libraries (Linux headless)
        if: runner.os == 'Linux'
        run: |
          sudo apt-get update
          sudo apt-get install -y --no-install-recommends \
            libglu1-mesa libxrender1 libxcursor1 libxft2 libxinerama1
      - name: Install v4 stack
        run: |
          python -m pip install --upgrade pip
          python -m pip install -e ".[dev]"
          python -m pip install "scikit-fem>=10" meshio matplotlib gmsh
      - name: Scripted demo (10 steps, clean workspace, exit 0)
        run: python tools/demo_v4.py --fast
      - name: Adversarial QA audit (fast tier)
        run: python tools/qa_audit_v4.py --fast
      - name: Upload demo record
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: v4-demo-record-${{ matrix.os }}
          path: |
            demo_out/demo_run_record.json
            tools/qa_audit_v4_results.json
          if-no-files-found: warn