ci-cd.yml

name: Continuous Integration & Telemetry

on:
  push:
    branches: [ main ]
  pull_request:
    branches: [ main ]

permissions:
  contents: read

concurrency:
  group: sentinelai-ci-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  engine-test:
    name: Inference Monitoring Test Matrix
    runs-on: ubuntu-latest
    timeout-minutes: 15

    steps:
      - name: ⬇️ Checkout Repository
        uses: actions/checkout@v4

      - name: 🐍 Set up Python Environment
        uses: actions/setup-python@v5
        with:
          python-version: '3.11'
          cache: 'pip'

      - name: 📦 Install Package Dependencies
        run: |
          python -m pip install --upgrade pip
          pip install -r requirements-dev.txt

      - name: 🧪 Execute SentinelAI Test Suite
        env:
          PYTHONPATH: .
        run: |
          pytest --cov=. --cov-report=term-missing --cov-report=xml tests/ --junitxml=pytest-results.xml

      - name: Upload test evidence
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: sentinelai-test-evidence
          path: |
            coverage.xml
            pytest-results.xml
          if-no-files-found: warn


  ingestion-load-balancer:
    name: Ingestion load-balancer smoke test
    runs-on: ubuntu-latest
    timeout-minutes: 15

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Validate NGINX configuration
        run: |
          docker run --rm \
            -v "$PWD/nginx/ingestion-load-balancer.conf:/etc/nginx/nginx.conf:ro" \
            nginx:1.27.5-alpine nginx -t

      - name: Start three ingestion replicas behind NGINX
        env:
          EXPOSE_INSTANCE_ID: "true"
        run: |
          docker compose up --build --detach --scale ingestion-service=3 ingestion-load-balancer

      - name: Verify readiness through the public gateway
        run: |
          for attempt in $(seq 1 45); do
            if curl --fail --silent --show-error http://localhost:8080/ready > /dev/null; then
              exit 0
            fi
            sleep 2
          done
          echo "Gateway never became ready" >&2
          docker compose ps
          docker compose logs --no-color ingestion-service ingestion-load-balancer
          exit 1

      - name: Verify requests reach multiple replicas
        run: |
          for request in $(seq 1 18); do
            curl --fail --silent --show-error --dump-header - --output /dev/null \
              http://localhost:8080/health \
              | tr -d '\r' | awk -F': ' 'tolower($1) == "x-instance-id" {print $2}'
          done | sort -u > /tmp/ingestion-replicas.txt
          cat /tmp/ingestion-replicas.txt
          test "$(wc -l < /tmp/ingestion-replicas.txt)" -ge 2

      - name: Verify one backend loss does not take down readiness
        run: |
          docker ps --filter label=com.docker.compose.service=ingestion-service --format '{{.ID}}' \
            | head -n 1 | xargs --no-run-if-empty docker stop
          for attempt in $(seq 1 15); do
            if curl --fail --silent --show-error http://localhost:8080/ready > /dev/null; then
              exit 0
            fi
            sleep 1
          done
          echo "Gateway did not remain ready after one replica stopped" >&2
          exit 1

      - name: Stop Compose services
        if: always()
        run: docker compose down --volumes