name: arena-environments

on:
  push:
    branches: [main]
  pull_request:
  workflow_dispatch:

jobs:
  validate:
    runs-on: ubuntu-latest
    strategy:
      matrix:
        python: ["3.11", "3.12"]
    steps:
      - uses: actions/checkout@v4
      - uses: astral-sh/setup-uv@v6
        with:
          version: "0.12.5"
          enable-cache: false
      - uses: actions/setup-python@v5
        with:
          python-version: ${{ matrix.python }}
      # Asks git, not the disk. `find` was checking the working tree, where a lock file is a
      # normal by-product of `uv sync` — so the step passed in CI's clean checkout and failed
      # on every developer machine that had ever run an eval. The policy is about what is
      # TRACKED: an environment is a library and must not pin its consumers' resolution.
      - name: Enforce library lock policy
        run: |
          tracked="$(git ls-files 'environments/*/uv.lock')"
          test -z "$tracked" || { echo "tracked lock files: $tracked"; exit 1; }
      # An environment is `environments/*/pyproject.toml` and nothing else — the same
      # denominator probe.py's discover() uses. A half-created scaffold directory with no
      # manifest is invisible to both, so the two can never disagree about what exists.
      - name: Refuse an empty environment scan
        run: |
          set -euo pipefail
          count=$(find environments -mindepth 2 -maxdepth 2 -name pyproject.toml | wc -l)
          echo "discovered $count environment manifests"
          test "$count" -gt 0
      - name: Run the floor and ceiling probe for every discovered environment
        run: uv run --with regex python probe.py
      - name: Run root probe integration test
        run: uv run --with regex python -m unittest discover -s tests -v
      - name: Install Redaction Pressure v0.2
        run: uv sync --project environments/redaction_pressure --python ${{ matrix.python }}
      - name: Run Redaction Pressure tests
        run: >-
          uv run --project environments/redaction_pressure
          python -m unittest discover -s environments/redaction_pressure/tests -v
      - name: Build all environment distributions
        run: |
          set -euo pipefail
          for manifest in environments/*/pyproject.toml; do
            environment=$(basename "$(dirname "$manifest")")
            uv build "environments/$environment" --out-dir "dist/$environment"
          done
      - name: Verify documented Redaction Pressure entrypoint
        run: uv run --project environments/redaction_pressure eval --help >/dev/null