Stirling-PDF/.github/workflows/ai-engine.yml

name: AI Engine CI

# Runs the engine quality gate (lint, type-check, format-check, tests). Called
# from build.yml on PRs and merge_group; also runs directly on push to main as
# a post-merge safety net. Freshness of the generated tool_models.py is checked
# by the shared check-generated-models workflow.
on:
  workflow_call:
  push:
    branches: [main]

permissions:
  contents: read

jobs:
  engine:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      pull-requests: write
    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
        with:
          egress-policy: audit

      - name: Checkout code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Install uv
        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
        with:
          enable-cache: true
          cache-dependency-glob: |
            engine/pyproject.toml
            engine/uv.lock
          cache-suffix: ai-engine

      - name: Install Task
        uses: go-task/setup-task@01a4adf9db2d14c1de7a560f09170b6e0df736aa # v2.1.0

      - name: Quality-check engine
        id: engine-check
        run: task engine:check
        continue-on-error: true

      - name: Comment on engine check failure
        # Only post a comment on PRs. github-script's PR helpers need an
        # issue/PR number, which doesn't exist on merge_group runs.
        if: steps.engine-check.outcome == 'failure' && github.event_name == 'pull_request'
        continue-on-error: true
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        with:
          script: |
            const marker = '<!-- engine-check -->';
            const body = [
              marker,
              '### Engine Check Failed',
              '',
              'There are issues with your Python code that will need to be fixed before they can be merged in.',
              '',
              'Run `task engine:fix` to auto-fix what can be fixed automatically, then run `task engine:check` to see what still needs fixing manually.',
            ].join('\n');
            const { data: comments } = await github.rest.issues.listComments({
              owner: context.repo.owner,
              repo: context.repo.repo,
              issue_number: context.issue.number,
            });
            const existing = comments.find(c => c.body.includes(marker));
            if (existing) {
              await github.rest.issues.updateComment({
                owner: context.repo.owner,
                repo: context.repo.repo,
                comment_id: existing.id,
                body,
              });
            } else {
              await github.rest.issues.createComment({
                owner: context.repo.owner,
                repo: context.repo.repo,
                issue_number: context.issue.number,
                body,
              });
            }

      - name: Fail if engine check failed
        if: steps.engine-check.outcome == 'failure'
        run: |
          echo "============================================"
          echo "  Engine Check Failed"
          echo "============================================"
          echo ""
          echo "There are issues with your Python code that"
          echo "will need to be fixed before they can be merged in."
          echo ""
          echo "Run 'task engine:fix' to auto-fix what can be"
          echo "fixed automatically, then run 'task engine:check'"
          echo "to see what still needs fixing manually."
          echo "============================================"
          exit 1

      - name: Build engine production image
        if: always()
        run: docker build --file engine/Dockerfile --tag stirling-pdf-engine:ci .

      - name: Build engine development image
        if: always()
        run: docker build --file engine/Dockerfile.dev --tag stirling-pdf-engine-dev:ci .

      - name: Remove engine check comment on success
        if: steps.engine-check.outcome == 'success' && github.event_name == 'pull_request'
        continue-on-error: true
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        with:
          script: |
            const marker = '<!-- engine-check -->';
            const { data: comments } = await github.rest.issues.listComments({
              owner: context.repo.owner,
              repo: context.repo.repo,
              issue_number: context.issue.number,
            });
            const existing = comments.find(c => c.body.includes(marker));
            if (existing) {
              await github.rest.issues.deleteComment({
                owner: context.repo.owner,
                repo: context.repo.repo,
                comment_id: existing.id,
              });
            }