ci.yml

name: CI

on:
  merge_group:
  pull_request:
  push:
    branches:
      - main

concurrency:
  group: ci-${{ github.event.pull_request.number || github.sha }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

jobs:
  check:
    name: Check
    runs-on: ubuntu-24.04
    timeout-minutes: 10
    steps:
      - name: Checkout
        uses: actions/checkout@v6
        with:
          sparse-checkout: |
            /*
            !/.repos/
          sparse-checkout-cone-mode: false

      - name: Setup Vite+
        uses: voidzero-dev/setup-vp@v1
        with:
          node-version-file: package.json
          cache: true
          run-install: true

      - name: Setup Rust
        uses: dtolnay/rust-toolchain@stable
        with:
          components: rustfmt

      - name: Ensure Electron runtime is installed
        run: vp run --filter @t3tools/desktop ensure:electron

      - name: Check
        run: vp check

      - name: Codex usage auth guard
        run: node scripts/codex-usage-auth-guard.mjs

      - name: Typecheck
        run: vpr typecheck

      - name: Check resource monitor formatting
        run: cargo fmt --manifest-path native/resource-monitor/Cargo.toml -- --check

      - name: Build desktop pipeline
        run: vp run build:desktop

      - name: Verify preload bundle output
        run: |
          test -f apps/desktop/dist-electron/preload.cjs
          grep -nE "desktopBridge|getLocalEnvironmentBootstrap|PICK_FOLDER_CHANNEL|wsUrl" apps/desktop/dist-electron/preload.cjs
          grep -n "__clerk_internal_electron_passkeys" apps/desktop/dist-electron/preload.cjs

  desktop_linux_package_smoke:
    name: Desktop Linux Package Smoke
    if: github.event_name == 'pull_request'
    runs-on: ubuntu-24.04
    timeout-minutes: 45
    steps:
      - name: Checkout
        uses: actions/checkout@v6
        with:
          sparse-checkout: |
            /*
            !/.repos/
          sparse-checkout-cone-mode: false

      - name: Install launch smoke dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y xvfb imagemagick libgtk-3-0 libnss3 libasound2t64 libgbm1

      - name: Setup Vite+
        uses: voidzero-dev/setup-vp@v1
        with:
          node-version-file: package.json
          cache: true
          run-install: true

      - name: Setup Rust
        uses: dtolnay/rust-toolchain@stable

      - name: Ensure Electron runtime is installed
        run: vp run --filter @t3tools/desktop ensure:electron

      - name: Build Linux desktop artifact
        run: vp run dist:desktop:linux

      - name: Launch packaged Linux desktop app
        run: xvfb-run -a node scripts/desktop-launch-smoke.mjs --artifact "release/*.AppImage" --timeout-ms 180000

  desktop_launch_gate_changes:
    name: Desktop Launch Gate Changes
    if: github.event_name == 'pull_request'
    runs-on: ubuntu-24.04
    timeout-minutes: 5
    outputs:
      run_desktop_launch_smoke: ${{ steps.filter.outputs.run_desktop_launch_smoke }}
    steps:
      - name: Checkout
        uses: actions/checkout@v6
        with:
          fetch-depth: 0

      - name: Setup Node
        uses: actions/setup-node@v6
        with:
          node-version-file: package.json

      - id: filter
        name: Classify changed files
        shell: bash
        run: |
          set -euo pipefail
          changed_files="$RUNNER_TEMP/changed-files.txt"
          git diff --name-only "${{ github.event.pull_request.base.sha }}" "${{ github.sha }}" > "$changed_files"
          node scripts/desktop-ci-change-gate.ts --files "$changed_files"

  build_wsl_node_pty_for_windows_smoke:
    name: Build WSL node-pty for Windows Smoke
    needs: desktop_launch_gate_changes
    if: needs.desktop_launch_gate_changes.outputs.run_desktop_launch_smoke == 'true'
    runs-on: ubuntu-24.04
    timeout-minutes: 15
    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Setup Vite+
        uses: voidzero-dev/setup-vp@v1
        with:
          node-version-file: package.json
          cache: true
          run-install: true

      - name: Build node-pty linux-x64 prebuild
        shell: bash
        run: |
          set -euo pipefail
          pty_pkg="$(node -e "console.log(require.resolve('node-pty/package.json', { paths: ['$GITHUB_WORKSPACE/apps/server'] }))")"
          pty_dir="$(dirname "$pty_pkg")"
          ( cd "$pty_dir" && npx --yes node-gyp rebuild )
          mkdir -p wsl-prebuild
          cp "$pty_dir/build/Release/pty.node" wsl-prebuild/pty.node
          file wsl-prebuild/pty.node

      - name: Upload node-pty prebuild
        uses: actions/upload-artifact@v7
        with:
          name: ci-wsl-node-pty-x64
          path: wsl-prebuild/pty.node
          if-no-files-found: error

  desktop_windows_package_smoke:
    name: Desktop Windows Package Smoke
    needs: [desktop_launch_gate_changes, build_wsl_node_pty_for_windows_smoke]
    if: >-
      ${{
        always() &&
        needs.desktop_launch_gate_changes.outputs.run_desktop_launch_smoke == 'true' &&
        needs.build_wsl_node_pty_for_windows_smoke.result == 'success'
      }}
    runs-on: windows-latest
    timeout-minutes: 60
    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Setup Vite+
        uses: voidzero-dev/setup-vp@v1
        with:
          node-version-file: package.json
          cache: true
          run-install: true

      - name: Download WSL node-pty prebuild
        uses: actions/download-artifact@v7
        with:
          name: ci-wsl-node-pty-x64
          path: wsl-prebuild

      - name: Ensure Electron runtime is installed
        run: vp run --filter @t3tools/desktop ensure:electron

      - name: Build Windows desktop artifact
        shell: bash
        run: |
          set -euo pipefail
          vp run dist:desktop:artifact \
            --platform win \
            --target nsis \
            --arch x64 \
            --wsl-prebuild "$GITHUB_WORKSPACE/wsl-prebuild/pty.node" \
            --verbose

      - id: install
        name: Install Windows desktop artifact
        shell: pwsh
        run: |
          $ErrorActionPreference = "Stop"
          $installer = Get-ChildItem -Path release -Filter "*.exe" |
            Sort-Object Length -Descending |
            Select-Object -First 1
          if (-not $installer) {
            throw "No NSIS installer found in release."
          }

          $installDir = Join-Path $env:RUNNER_TEMP "t3code-install"
          if (Test-Path $installDir) {
            Remove-Item -Recurse -Force $installDir
          }
          New-Item -ItemType Directory -Force -Path $installDir | Out-Null

          $process = Start-Process `
            -FilePath $installer.FullName `
            -ArgumentList @("/S", "/D=$installDir") `
            -Wait `
            -PassThru
          if ($process.ExitCode -ne 0) {
            throw "NSIS installer exited with code $($process.ExitCode)."
          }

          $expectedExeNames = @("T3 Code (Alpha).exe", "T3 Code (Nightly).exe")
          $appExe = Get-ChildItem -Path $installDir -Filter "*.exe" -File |
            Where-Object { $expectedExeNames -contains $_.Name } |
            Select-Object -First 1
          if (-not $appExe) {
            $topLevelExecutables = Get-ChildItem -Path $installDir -Filter "*.exe" -File |
              Select-Object -ExpandProperty Name
            throw "No expected installed application executable found under $installDir. Expected one of: $($expectedExeNames -join ', '). Top-level executables: $($topLevelExecutables -join ', ')"
          }

          "app_exe=$($appExe.FullName)" >> $env:GITHUB_OUTPUT
          "install_dir=$installDir" >> $env:GITHUB_OUTPUT
          Write-Host "Installed desktop executable: $($appExe.FullName)"

      - name: Assert minimal unpacked desktop footprint
        shell: pwsh
        run: |
          $ErrorActionPreference = "Stop"
          $unpackedRoot = Join-Path "${{ steps.install.outputs.install_dir }}" "resources/app.asar.unpacked"
          node scripts/desktop-unpacked-footprint.mjs `
            --root "$unpackedRoot" `
            --max-files 300

      - name: Assert launch smoke reports missing unpacked runtime file
        shell: pwsh
        run: |
          $ErrorActionPreference = "Stop"

          $cleanInstallDir = "${{ steps.install.outputs.install_dir }}"
          $cleanAppExe = "${{ steps.install.outputs.app_exe }}"
          $brokenInstallDir = Join-Path $env:RUNNER_TEMP "t3code-broken-install"
          if (Test-Path $brokenInstallDir) {
            Remove-Item -Recurse -Force $brokenInstallDir
          }
          New-Item -ItemType Directory -Force -Path $brokenInstallDir | Out-Null
          Copy-Item -Recurse -Force (Join-Path $cleanInstallDir "*") $brokenInstallDir

          $brokenAppExe = Join-Path $brokenInstallDir (Split-Path -Leaf $cleanAppExe)
          $removedRuntimeFile = Join-Path $brokenInstallDir "resources/app.asar.unpacked/apps/server/dist/bin.mjs"
          if (-not (Test-Path $removedRuntimeFile)) {
            throw "Negative launch-smoke fixture could not find packaged runtime file to remove: $removedRuntimeFile"
          }
          Remove-Item -Force $removedRuntimeFile

          $output = & node scripts/desktop-launch-smoke.mjs --command "$brokenAppExe" --timeout-ms 45000 --stability-ms 1000 2>&1
          $exitCode = $LASTEXITCODE
          $outputText = $output | Out-String
          $output | ForEach-Object { Write-Host $_ }

          if ($exitCode -eq 0) {
            throw "Launch smoke passed against a packaged artifact with a required unpacked runtime file removed; the gate is not trustworthy."
          }
          if ($outputText -notmatch "(?i)(installation is incomplete|apps/server/dist/bin\.mjs)") {
            throw "Launch smoke failed against the broken packaged artifact, but did not report the expected incomplete-installation diagnostic."
          }

          Write-Host "Launch smoke rejected the deliberately broken packaged artifact with exit code $exitCode."
          exit 0

      - name: Launch installed Windows desktop app
        shell: pwsh
        run: node scripts/desktop-launch-smoke.mjs --command "${{ steps.install.outputs.app_exe }}" --timeout-ms 90000

  test:
    name: Test
    runs-on: ubuntu-24.04
    # The preserved fork coordinator suite deliberately covers real 20-42 second
    # timeout races and already required this allowance before the upstream sync.
    timeout-minutes: 60
    steps:
      - name: Checkout
        uses: actions/checkout@v6
        with:
          sparse-checkout: |
            /*
            !/.repos/
          sparse-checkout-cone-mode: false

      - name: Setup Vite+
        uses: voidzero-dev/setup-vp@v1
        with:
          node-version-file: package.json
          cache: true
          run-install: true

      - name: Setup Rust
        uses: dtolnay/rust-toolchain@stable

      - name: Ensure Electron runtime is installed
        run: vp run --filter @t3tools/desktop ensure:electron

      - name: Test
        env:
          T3CODE_TRANSFER_BUDGET_REPORT_PATH: ${{ runner.temp }}/t3code-transfer-budget.md
          T3CODE_TRANSFER_BUDGET_RESULT_PATH: ${{ runner.temp }}/thread-transfer-result.json
        run: vp run test

      - name: Publish transfer budget report
        if: always()
        run: |
          if test -f "${{ runner.temp }}/t3code-transfer-budget.md"; then
            tee -a "$GITHUB_STEP_SUMMARY" < "${{ runner.temp }}/t3code-transfer-budget.md"
          else
            echo "Transfer budget report was not produced." >> "$GITHUB_STEP_SUMMARY"
          fi

      - name: Upload thread transfer result
        if: always()
        uses: actions/upload-artifact@v7
        with:
          name: thread-transfer-results
          path: ${{ runner.temp }}/thread-transfer-result.json
          if-no-files-found: ignore
          retention-days: 30

      - name: Test resource monitor
        run: cargo test --locked --manifest-path native/resource-monitor/Cargo.toml

  mobile_native_static_analysis:
    name: Mobile Native Static Analysis
    runs-on: macos-latest
    timeout-minutes: 10
    steps:
      - name: Checkout
        uses: actions/checkout@v6
        with:
          sparse-checkout: |
            /*
            !/.repos/
          sparse-checkout-cone-mode: false

      - name: Setup Vite+
        uses: voidzero-dev/setup-vp@v1
        with:
          node-version-file: package.json
          cache: true
          run-install: |
            args:
              - --filter=@t3tools/scripts...
              - --filter=t3...

      - name: Install mobile native static analysis tools
        run: brew bundle install --file apps/mobile/Brewfile

      - name: Lint mobile native sources
        run: vp run lint:mobile

  release_smoke:
    name: Release Smoke
    runs-on: ubuntu-24.04
    timeout-minutes: 15
    steps:
      - name: Checkout
        uses: actions/checkout@v6
        with:
          fetch-depth: 0
          sparse-checkout: |
            /*
            !/.repos/
          sparse-checkout-cone-mode: false

      - name: Setup Vite+
        uses: voidzero-dev/setup-vp@v1
        with:
          node-version-file: package.json
          cache: true
          run-install: |
            args:
              - --filter=@t3tools/scripts...

      - name: Exercise release-only workflow steps
        run: node scripts/release-smoke.ts