ci-rosetta-cli.yml

name: CI Rosetta CLI

# Pre-merge gate: build + tests for the rosetta-cli package on every PR that
# touches it. Complements publish-rosetta-cli.yml, which only runs on push to
# main (publish time) and is not a pre-merge gate. Mirrors that workflow's
# test/build steps so a green CI here means the publish job will pass.
on:
  pull_request:
    paths:
      - 'src/rosetta-cli/**'
      - 'requirements.txt'
  workflow_dispatch:

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  build-test:
    runs-on: ubuntu-latest

    permissions:
      contents: read

    steps:
    - name: Checkout code
      uses: actions/checkout@v5

    - name: Set up Python
      uses: actions/setup-python@v6
      with:
        python-version: '3.12'
        cache: 'pip'
        cache-dependency-path: requirements.txt

    - name: Install dependencies
      run: |
        python -m pip install --upgrade pip
        pip install -r requirements.txt

    # mypy.ini lists src/rosetta-cli in files=, but the only other mypy entrypoint
    # (src/validate-types.sh, run from ci-rosetta-mcp.yml) is path-filtered to
    # src/rosetta-mcp-server/**. mypy is invoked directly rather than through that
    # script to keep this gate scoped to this job's own paths: the script checks
    # the whole files= set, so a rosetta-cli PR would also gate on the MCP server.
    - name: Run type validation
      run: |
        python -m mypy --config-file mypy.ini src/rosetta-cli

    - name: Run CLI tests
      run: |
        pytest src/rosetta-cli/tests -v

    - name: Build package
      working-directory: ./src/rosetta-cli
      run: |
        python -m build

    - name: Check package
      working-directory: ./src/rosetta-cli
      run: |
        twine check dist/*