live-tests.yml

name: Live API Tests

# Two-tier live smoke (#48):
#
#   1. Keyless demo smoke — hits the public /v1/demo/* endpoints with NO
#      secret. Runs unconditionally on every push/PR, so route health and
#      envelope-shape coverage can never silently skip (this tier caught
#      the 442->436 catalog change keyless).
#   2. Keyed live tests — auth path + gated endpoints, only when the
#      OILPRICEAPI_TEST_KEY secret is available (skips loudly on forks).

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
  workflow_dispatch: {}

jobs:
  live-tests:
    name: Live API tests
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v7

      - name: Set up Python
        uses: actions/setup-python@v7
        with:
          python-version: "3.12"

      - name: Install dependencies
        run: |
          python -m pip install --upgrade pip
          pip install -e '.[dev]'

      # Tier 1: always runs — no secret, no gate, cannot silently skip.
      - name: Keyless demo smoke (always runs)
        run: pytest tests/integration/test_demo_contract.py -m live --no-cov -v

      # Tier 2: full live suite, gated on the repo secret (forks skip loudly).
      - name: Keyed live tests
        env:
          OILPRICEAPI_TEST_KEY: ${{ secrets.OILPRICEAPI_TEST_KEY }}
        run: |
          if [ -z "$OILPRICEAPI_TEST_KEY" ]; then
            echo "::warning::OILPRICEAPI_TEST_KEY not available (fork?); keyed live tests skipped. Keyless demo smoke above still ran."
            exit 0
          fi
          pytest tests/integration -m live --no-cov -v

      - name: Run canonical success snippets against production
        env:
          OILPRICEAPI_KEY: ${{ secrets.OILPRICEAPI_TEST_KEY }}
        run: |
          if [ -z "$OILPRICEAPI_KEY" ]; then
            echo "::warning::OILPRICEAPI_TEST_KEY not available; canonical snippet smoke skipped."
            exit 0
          fi
          python examples/snippets/latest_price.py
          python examples/snippets/history.py