name: ai-steward-eval-gate

on:
  pull_request:
    paths:
      - 'backend/app/services/adaptive_rag_service.py'
      - 'backend/app/services/project_knowledge_graph.py'
      - 'backend/app/api/rag.py'
      - 'backend/app/api/knowledge_graph.py'
      - 'backend/evals/**'
      - 'scripts/ai_steward_eval.py'
      - 'scripts/rag_followup_smoke.sh'
  push:
    branches: [ main, master ]
    paths:
      - 'backend/evals/**'
      - 'scripts/ai_steward_eval.py'
      - 'scripts/rag_followup_smoke.sh'
      - '.github/workflows/ai-steward-eval-gate.yml'

jobs:
  golden-lint:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: '3.11'
      - name: Lint golden dataset
        run: |
          python scripts/ai_steward_eval.py --lint-only --input backend/evals/golden_qa_v1.jsonl

  eval-prereq:
    runs-on: ubuntu-latest
    needs: golden-lint
    steps:
      - name: Check gate configuration
        run: |
          if [ -z "${{ secrets.EVAL_API_TOKEN }}" ] || [ -z "${{ vars.EVAL_API_URL }}" ]; then
            echo "::error::Missing EVAL_API_TOKEN secret or EVAL_API_URL variable. Eval gate must be configured."
            exit 1
          fi

  eval-gate:
    runs-on: ubuntu-latest
    needs: eval-prereq
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: '3.11'
      - name: Install deps
        run: |
          python -m pip install --upgrade pip
          python -m pip install httpx
      - name: Run eval gate
        env:
          EVAL_API_TOKEN: ${{ secrets.EVAL_API_TOKEN }}
          EVAL_API_URL: ${{ vars.EVAL_API_URL }}
        run: |
          python scripts/ai_steward_eval.py \
            --input backend/evals/golden_qa_v1.jsonl \
            --api-url "$EVAL_API_URL" \
            --token "$EVAL_API_TOKEN" \
            --output-dir backend/evals/reports \
            --fail-on-threshold \
            --threshold-accuracy 0.80 \
            --threshold-hallucination 0.12 \
            --threshold-followup 0.75 \
            --threshold-query-type 0.80
      - name: Run followup smoke gate
        env:
          EVAL_API_TOKEN: ${{ secrets.EVAL_API_TOKEN }}
          EVAL_API_URL: ${{ vars.EVAL_API_URL }}
        run: |
          BASE_URL="${EVAL_API_URL%/rag/ask}"
          SMOKE_BASE_URL="$BASE_URL" SMOKE_TOKEN="$EVAL_API_TOKEN" bash scripts/rag_followup_smoke.sh
      - name: Upload eval report
        uses: actions/upload-artifact@v4
        with:
          name: ai-steward-eval-report
          path: backend/evals/reports/*.json