ci.yml

name: hive-ci

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

env:
  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"

jobs:
  # x86_64 + CPU only. Runs everywhere, no external deps.
  cpu:
    name: x86_64 / Python ${{ matrix.python }} / CPU
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        python: ["3.10", "3.11", "3.12"]
    steps:
      - uses: actions/checkout@v4
      - name: Install
        run: |
          python -m pip install --upgrade pip
          # Install hive only — sibling packages (busyBee-cpu, honey-comb) are
          # NOT present in the checkout. Tests gracefully skip when absent.
          pip install -e .[dev,monitor,observability]
      - name: Test
        env:
          HIVE_NO_NVML: "1"
        run: pytest -v
      - name: Benchmark (smoke)
        env:
          HIVE_NO_NVML: "1"
        run: |
          python scripts/hive_benchmark.py \
              --transcript-turns 50 --brain-writes 500 \
              --honey-comb-mode auto --inference-backend echo \
              --quiet
      - name: Lint
        run: |
          python -m ruff check hive/ tests/
          python -m mypy hive/ --ignore-missing-imports
      - name: Validate CITATION.cff
        run: |
          if [ ! -f .github/citation.cff ]; then
            echo "Error: .github/citation.cff not found"
            exit 1
          fi
          pip install cffconvert
          cffconvert --validate -i .github/citation.cff
      - name: Security scan (hive only)
        run: |
          pip install bandit
          python -m bandit -r hive/ -ll -q
          python scripts/hive_pentest.py --module hive

  # Full-stack pentest: hive + busybee-cpu + honey-comb
  pentest:
    name: Pentest / full stack
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Clone sibling packages
        run: |
          git clone --depth 1 https://github.com/DJLougen/busyBee-cpu.git /tmp/busyBee-cpu
          git clone --depth 1 https://github.com/DJLougen/honey-comb.git /tmp/honey-comb
      - name: Install
        run: |
          python -m pip install --upgrade pip
          pip install -e /tmp/busyBee-cpu /tmp/honey-comb -e ".[dev]"
      - name: Modular pentest
        env:
          HIVE_NO_NVML: "1"
        run: |
          python scripts/hive_pentest.py --fail-on-skip

  # x86_64 + CUDA. Requires self-hosted runner with GPU label.
  # Disabled until self-hosted runner is registered.
  gpu:
    name: x86_64 / Python 3.12 / CUDA
    if: false  # Re-enable when self-hosted GPU runner is available
    runs-on: [self-hosted, gpu, cuda]
    steps:
      - uses: actions/checkout@v4
      - name: Install
        run: |
          python -m pip install --upgrade pip
          pip install -e .[dev,monitor,observability]
      - name: Test
        run: pytest -v
      - name: Benchmark
        run: |
          python scripts/hive_benchmark.py \
              --transcript-turns 200 --brain-writes 5000 \
              --honey-comb-mode auto --inference-backend echo \
              --runs 3 --output bench-gpu.json --quiet
      - name: Upload
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: bench-gpu
          path: bench-gpu.json

  # aarch64 + CUDA. Jetson / Grace.
  # Disabled until self-hosted runner is registered.
  jetson:
    name: aarch64 / Python 3.12 / Jetson
    if: false  # Re-enable when self-hosted Jetson runner is available
    runs-on: [self-hosted, jetson]
    steps:
      - uses: actions/checkout@v4
      - name: Install
        run: |
          python -m pip install --upgrade pip
          pip install --extra-index-url https://pypi.nvidia.com -e .[dev,monitor,observability]
      - name: Test
        env:
          HIVE_NO_NVML: "0"
        run: pytest -v
      - name: Benchmark
        run: |
          python scripts/hive_benchmark.py \
              --transcript-turns 100 --brain-writes 1000 \
              --honey-comb-mode fast --inference-backend echo \
              --output bench-jetson.json --quiet
      - name: Upload
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: bench-jetson
          path: bench-jetson.json

  # Build Rust wheels for major platforms.
  # Only runs on tags or manual dispatch to avoid burning minutes on every PR.
  rust-wheels:
    name: Build hive-cpp wheels
    runs-on: ${{ matrix.os }}
    if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v')
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: ubuntu-latest
            target: x86_64-unknown-linux-gnu
          - os: ubuntu-latest
            target: aarch64-unknown-linux-gnu
          - os: macos-latest
            target: x86_64-apple-darwin
          - os: macos-latest
            target: aarch64-apple-darwin
          - os: windows-latest
            target: x86_64-pc-windows-msvc
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: "3.12"
      - name: Install Rust
        uses: dtolnay/rust-toolchain@stable
        with:
          targets: ${{ matrix.target }}
      - name: Install maturin
        run: pip install maturin
      - name: Build wheel
        working-directory: hive-cpp
        run: |
          maturin build --release --target ${{ matrix.target }} --out ../dist
      - name: Upload wheel
        uses: actions/upload-artifact@v4
        with:
          name: hive-cpp-wheels-${{ matrix.target }}
          path: dist/*.whl