ci.yml

name: CI

on:
  push:
    branches:
      - main
      - dev
      # Long-lived integration branches: pushes here previously ran no CI at all,
      # which let multi-day test regressions land unnoticed (they only surfaced
      # through PR #252's merge CI).
      - refactor/team-provisioning-round2-reapply
      - refactor/hosted-web-feature-boundaries
    paths:
      - 'src/**'
      - 'landing/**'
      - 'bin/**'
      - 'scripts/**'
      - 'agent-teams-controller/**'
      - 'mcp-server/**'
      - 'packages/**'
      - 'resources/runtime/**'
      - 'resources/terminal-platform/**'
      - '.runtime-download/**'
      - 'runtime.lock.json'
      - 'terminal-platform.lock.json'
      - 'vendor/terminal-platform/**'
      - 'test/**'
      - '.github/workflows/**'
      - '.github/dependabot.yml'
      - 'pnpm-workspace.yaml'
      - 'package.json'
      - 'pnpm-lock.yaml'
      - 'tsconfig*.json'
      - 'vite*.config.*'
      - 'vitest*.config.*'
      - 'tailwind.config.*'
      - 'eslint.config.*'
      - '*.js'
      - '*.cjs'
      - '*.mjs'
      - '*.ts'
      - '*.tsx'
  pull_request:
    paths:
      - 'src/**'
      - 'landing/**'
      - 'bin/**'
      - 'scripts/**'
      - 'agent-teams-controller/**'
      - 'mcp-server/**'
      - 'packages/**'
      - 'resources/runtime/**'
      - 'resources/terminal-platform/**'
      - '.runtime-download/**'
      - 'runtime.lock.json'
      - 'terminal-platform.lock.json'
      - 'vendor/terminal-platform/**'
      - 'test/**'
      - '.github/workflows/**'
      - '.github/dependabot.yml'
      - 'pnpm-workspace.yaml'
      - 'package.json'
      - 'pnpm-lock.yaml'
      - 'tsconfig*.json'
      - 'vite*.config.*'
      - 'vitest*.config.*'
      - 'tailwind.config.*'
      - 'eslint.config.*'
      - '*.js'
      - '*.cjs'
      - '*.mjs'
      - '*.ts'
      - '*.tsx'

jobs:
  validate:
    runs-on: ubuntu-latest

    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Guard runtime artifacts
        run: node ./scripts/ci/forbid-runtime-artifacts.cjs

      - name: Guard production source file size
        run: node ./scripts/ci/check-source-file-size.mjs

      - name: Guard Team Provisioning architecture
        run: node ./scripts/ci/check-team-provisioning-architecture.mjs

      - name: Verify runtime lock
        run: node ./scripts/ci/verify-runtime-lock.mjs

      - name: Setup pnpm
        uses: pnpm/action-setup@v6

      - name: Setup Node.js
        uses: actions/setup-node@v6
        with:
          node-version-file: .node-version
          cache: pnpm

      - name: Restore pnpm node-gyp executable bit
        run: |
          PNPM_STORE="$(pnpm store path)"
          PNPM_BIN_DIR="$(dirname "$(command -v pnpm)")"
          for path in "$PNPM_STORE" "${PNPM_HOME:-}" "$PNPM_BIN_DIR"; do
            if [ -d "$path" ]; then
              find "$path" -path '*/node-gyp/gyp/gyp_main.py' -exec chmod +x {} \; 2>/dev/null || true
            fi
          done

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Rebuild test SQLite native module for Node
        run: node ./scripts/ci/rebuild-better-sqlite3-node.cjs

      - name: Audit dependencies
        run: pnpm dlx pnpm@11.4.0 --pm-on-fail=ignore audit --audit-level high

      - name: Validate workspace truth gate
        env:
          NODE_OPTIONS: --max-old-space-size=8192
        run: pnpm validate:ci

  test:
    name: test (${{ matrix.shard }}/2)
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        shard: [1, 2]

    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Setup pnpm
        uses: pnpm/action-setup@v6

      - name: Setup Node.js
        uses: actions/setup-node@v6
        with:
          node-version-file: .node-version
          cache: pnpm

      - name: Restore pnpm node-gyp executable bit
        run: |
          PNPM_STORE="$(pnpm store path)"
          PNPM_BIN_DIR="$(dirname "$(command -v pnpm)")"
          for path in "$PNPM_STORE" "${PNPM_HOME:-}" "$PNPM_BIN_DIR"; do
            if [ -d "$path" ]; then
              find "$path" -path '*/node-gyp/gyp/gyp_main.py' -exec chmod +x {} \; 2>/dev/null || true
            fi
          done

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Rebuild test SQLite native module for Node
        run: node ./scripts/ci/rebuild-better-sqlite3-node.cjs

      - name: Test workspace packages
        if: matrix.shard == 1
        run: pnpm --filter agent-teams-controller test && pnpm --filter agent-teams-mcp test

      - name: Test root shard
        run: pnpm test:ci --shard=${{ matrix.shard }}/2

  lint:
    name: lint (${{ matrix.scope }})
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        include:
          - scope: main
            paths: src/main src/preload src/shared src/types
          - scope: renderer
            paths: src/renderer
          - scope: features
            paths: src/features

    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Setup pnpm
        uses: pnpm/action-setup@v6

      - name: Setup Node.js
        uses: actions/setup-node@v6
        with:
          node-version-file: .node-version
          cache: pnpm

      - name: Restore pnpm node-gyp executable bit
        run: |
          PNPM_STORE="$(pnpm store path)"
          PNPM_BIN_DIR="$(dirname "$(command -v pnpm)")"
          for path in "$PNPM_STORE" "${PNPM_HOME:-}" "$PNPM_BIN_DIR"; do
            if [ -d "$path" ]; then
              find "$path" -path '*/node-gyp/gyp/gyp_main.py' -exec chmod +x {} \; 2>/dev/null || true
            fi
          done

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Restore ESLint cache
        uses: actions/cache@v5
        with:
          path: .eslintcache-${{ matrix.scope }}
          key: eslint-v3-${{ runner.os }}-${{ matrix.scope }}-${{ hashFiles('.node-version', 'pnpm-lock.yaml', 'package.json', 'pnpm-workspace.yaml', 'eslint.config.*', 'tsconfig*.json', 'electron.vite.config.ts', 'src/**', 'test/**', 'packages/agent-graph/src/**', 'scripts/team-changes-real-data-smoke.ts', 'scripts/smoke/codex-runtime-install.ts', 'resources/pricing.json') }}

      - name: Lint source shard
        run: pnpm lint:ci:files ${{ matrix.paths }} --cache-location .eslintcache-${{ matrix.scope }}

      - name: Lint MCP package
        if: matrix.scope == 'main'
        run: pnpm lint:mcp

  task-change-ledger-windows:
    name: Task change ledger Windows smoke
    runs-on: windows-latest
    timeout-minutes: 15

    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Enable Windows long paths
        shell: pwsh
        run: git config --global core.longpaths true

      - name: Setup pnpm
        uses: pnpm/action-setup@v6

      - name: Setup Node.js
        uses: actions/setup-node@v6
        with:
          node-version-file: .node-version
          cache: pnpm

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Test Windows CLI shell fallback
        run: pnpm exec vitest run test/main/utils/childProcess.windows.test.ts

      - name: Test task change ledger
        run: pnpm test:task-change-ledger

      - name: Test OpenCode nvm-windows runtime resolution
        run: pnpm exec vitest run test/main/services/runtime/OpenCodeRuntimeNvmResolution.safe-e2e.test.ts