coderadius/.github/workflows/ci.yml at main · coderadius-ai/coderadius · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
name: CI

on:
  push:
    branches: [ main ]
  pull_request:
    branches: [ main ]

jobs:
  typecheck:
    runs-on: ubuntu-latest

    permissions:
      contents: read

    steps:
      - uses: actions/checkout@v7

      - uses: oven-sh/setup-bun@v2
        with:
          bun-version: latest

      - uses: actions/setup-node@v6
        with:
          node-version: 22

      - name: Install dependencies
        run: bun install

      - name: Typecheck
        run: bun run build

  test:
    runs-on: ubuntu-latest

    permissions:
      contents: read
      pull-requests: write

    steps:
      - uses: actions/checkout@v7

      - uses: oven-sh/setup-bun@v2
        with:
          bun-version: latest

      - uses: actions/setup-node@v6
        with:
          node-version: 22

      - name: Install dependencies
        run: bun install

      # No secrets required: unit tests are pure logic and any LLM-adjacent
      # suites run in replay mode against the committed cache.
      - name: Run unit tests with coverage
        run: bun vitest run tests/unit --coverage --coverage.reporter=json-summary --coverage.reporter=json --coverage.reporter=text

      - name: Verify coverage output
        if: always()
        run: ls -la coverage/ || echo "⚠️ No coverage directory found"

      # Fork PRs run with a read-only GITHUB_TOKEN, so the PR-comment step is
      # skipped for them; the tests above still run and gate the job.
      - name: Report Coverage
        if: >-
          always() &&
          hashFiles('coverage/coverage-summary.json') != '' &&
          (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository)
        uses: davelosert/vitest-coverage-report-action@v2
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}

  pattern-evals:
    name: Pattern evals (deterministic)
    runs-on: ubuntu-latest

    permissions:
      contents: read

    steps:
      - uses: actions/checkout@v7

      - uses: oven-sh/setup-bun@v2
        with:
          bun-version: latest

      - uses: actions/setup-node@v6
        with:
          node-version: 22

      - name: Install dependencies
        run: bun install

      # Anonymised multi-file fixtures exercising the full static pipeline.
      # Scoped to the deterministic patterns (zero LLM calls, no database):
      # `grep -L` selects the test files that do NOT wire the LLM replay
      # cache, so newly added deterministic patterns are picked up
      # automatically while replay-variant patterns stay out of this job.
      # Replay mode is pinned defensively: if a replay-wired test slips into
      # the selection it fails loudly on a cache miss instead of attempting
      # a live LLM call (fork PRs have no API keys).
      # Retried once: tree-sitter's native finalizers can abort a worker
      # process during teardown (Napi::Error / "Channel closed") after every
      # test has already passed. A deterministic test failure fails both
      # attempts, so real regressions still turn the job red.
      - name: Run pattern eval tests (deterministic subset)
        run: |
          FILES=$(grep -L "helpers/with-replay" tests/eval/patterns/*/*.eval.test.ts)
          bun vitest run --config vitest.eval.config.ts $FILES || \
            bun vitest run --config vitest.eval.config.ts $FILES
        env:
          EVAL_LLM_MODE: replay

  welding-invariants:
    name: Welding invariants (Memgraph)
    runs-on: ubuntu-latest

    services:
      memgraph:
        image: memgraph/memgraph-mage:latest
        ports:
          - 7687:7687
        options: >-
          --health-cmd "echo 'RETURN 1;' | mgconsole --host localhost --port 7687"
          --health-interval 10s
          --health-timeout 5s
          --health-retries 12

    env:
      MEMGRAPH_URI: bolt://localhost:7687
      MEMGRAPH_USER: ''
      MEMGRAPH_PASSWORD: ''

    steps:
      - uses: actions/checkout@v7

      - uses: oven-sh/setup-bun@v2
        with:
          bun-version: latest

      - uses: actions/setup-node@v6
        with:
          node-version: 22

      - name: Install dependencies
        run: bun install

      - name: Wait for Memgraph
        run: |
          for i in $(seq 1 30); do
            if (echo > /dev/tcp/127.0.0.1/7687) >/dev/null 2>&1; then exit 0; fi
            sleep 2
          done
          echo "Memgraph not reachable" && exit 1

      - name: Run welding-invariants integration test
        run: bun vitest run tests/integration/welding-invariants.test.ts --config vitest.integration.config.ts