From 4b464c6bddc27108dafc6c0c95b005aea3ec7011 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Sat, 3 Oct 2026 05:44:32 +0000
Subject: [PATCH] ci: restore CI with lint and test checks

CI was moved to .github/workflows_disabled. Restored as-is it could not
pass: pyproject.toml pins two private repositories by git URL
(omnibioai-iam-client v0.1.4 and omnibioai-usage-client v0.1.0), and the
workflow's GITHUB_TOKEN cannot read other private repositories, so the
install step failed and the test suite never ran.

The new .github/workflows/ci.yml installs the package with its dev extras
and runs ruff and pytest (with the 95% coverage gate in pyproject.toml)
on Python 3.11 for pushes and pull requests to main. A repository secret,
PRIVATE_DEPS_TOKEN, is used only to rewrite the URLs of those two
dependencies; the job fails early with an explicit error if it is unset.
Permissions are read-only, and the publish workflows are unchanged.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016nxi4bp7DP1ancERNUUfzj
---
 .github/workflows/ci.yml | 49 ++++++++++++++++++++++++++++++++++++++++
 1 file changed, 49 insertions(+)
 create mode 100644 .github/workflows/ci.yml

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 0000000..3acf023
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,49 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  test:
+    name: Lint & test (Python 3.11)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.11"
+          cache: pip
+          cache-dependency-path: pyproject.toml
+
+      # omnibioai-iam-client and omnibioai-usage-client are private repos
+      # pinned by git URL in pyproject.toml. GITHUB_TOKEN cannot read other
+      # private repositories, so a read-only token scoped to those two
+      # repositories (Contents: read) is supplied as PRIVATE_DEPS_TOKEN.
+      - name: Install dependencies
+        env:
+          PRIVATE_DEPS_TOKEN: ${{ secrets.PRIVATE_DEPS_TOKEN }}
+        run: |
+          if [ -z "$PRIVATE_DEPS_TOKEN" ]; then
+            echo "::error::Repository secret PRIVATE_DEPS_TOKEN is not set; it must grant read access to omnibioai-iam-client and omnibioai-usage-client."
+            exit 1
+          fi
+          for repo in omnibioai-iam-client omnibioai-usage-client; do
+            git config --global \
+              "url.https://x-access-token:${PRIVATE_DEPS_TOKEN}@github.com/OmniBioAI/${repo}.git.insteadOf" \
+              "https://github.com/OmniBioAI/${repo}.git"
+          done
+          python -m pip install --upgrade pip
+          python -m pip install -e ".[dev]"
+
+      - name: Lint
+        run: ruff check .
+
+      - name: Test (coverage gate from pyproject.toml)
+        run: pytest