ci.yml

name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

permissions:
  contents: read

concurrency:
  group: ci-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  static-checks:
    name: Static checks
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: "22"

      - name: Check shell syntax
        shell: bash
        run: |
          while IFS= read -r file; do
            bash -n "$file"
          done < <(
            find macos -type f \( -name '*.sh' -o -name '*.command' \) \
              ! -path '*/release/*' -print
          )

      - name: Check Node.js syntax
        shell: bash
        run: |
          while IFS= read -r file; do
            node --check "$file" >/dev/null
          done < <(
            find macos windows -type f \( -name '*.mjs' -o -name '*.js' \) -print
          )

      - name: Check Windows PowerShell source encoding
        shell: bash
        run: |
          node <<'NODE'
          const fs = require("node:fs");
          const path = require("node:path");

          function visit(directory) {
            for (const entry of fs.readdirSync(directory, { withFileTypes: true })) {
              const file = path.join(directory, entry.name);
              if (entry.isDirectory()) visit(file);
              if (!entry.isFile() || path.extname(file) !== ".ps1") continue;
              const bytes = fs.readFileSync(file);
              const hasBom = bytes.subarray(0, 3).equals(Buffer.from([0xef, 0xbb, 0xbf]));
              const content = hasBom ? bytes.subarray(3) : bytes;
              if (content.some((byte) => byte >= 0x80) && !hasBom) {
                throw new Error(`${file}: non-ASCII PowerShell 5.1 source requires a UTF-8 BOM`);
              }
            }
          }

          visit("windows");
          NODE

      - name: Check runtime safety assertions
        shell: bash
        run: |
          if grep -R -n -E 'dream-skin-skin|DREAM_SKIN_SKIN|1\.0\.0-rc2' \
            macos/scripts macos/assets >/dev/null; then
            printf 'Legacy release-candidate identifiers remain in runtime files.\n' >&2
            exit 1
          fi
          if grep -R -n -E '(writeFile|rename|copyFile|rm).*app\.asar' \
            macos/scripts >/dev/null; then
            printf 'A runtime script appears to mutate app.asar.\n' >&2
            exit 1
          fi
          if grep -n -E '/usr/bin/python3|(^|[[:space:]])eval([[:space:]]|$)' \
            macos/scripts/common-macos.sh >/dev/null; then
            printf 'The macOS runtime must parse state without python3 or eval.\n' >&2
            exit 1
          fi

      - name: Check version consistency
        shell: bash
        run: |
          expected="$(tr -d '\r\n' < macos/VERSION)"
          common="$(sed -n 's/^SKIN_VERSION="\([^"]*\)"$/\1/p' macos/scripts/common-macos.sh)"
          macos_injector="$(sed -n 's/^const SKIN_VERSION = "\([^"]*\)";$/\1/p' macos/scripts/injector.mjs)"
          windows_injector="$(sed -n 's/^const SKIN_VERSION = "\([^"]*\)";$/\1/p' windows/scripts/injector.mjs)"
          test -n "$expected"
          test "$common" = "$expected"
          test "$macos_injector" = "$expected"
          test "$windows_injector" = "$expected"

      - name: Run portable Node.js regressions
        shell: bash
        run: |
          node --test macos/tests/*.test.mjs
          node --test windows/tests/*.test.mjs
          node macos/scripts/injector.mjs --check-payload >/dev/null
          node windows/scripts/injector.mjs --check-payload >/dev/null

  windows-tests:
    name: Windows (${{ matrix.name }})
    runs-on: windows-latest
    strategy:
      fail-fast: false
      matrix:
        include:
          - name: Windows PowerShell 5.1
            executable: powershell.exe
          - name: PowerShell 7
            executable: pwsh.exe
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: "22"

      - name: Run Windows regression suite
        shell: cmd
        run: ${{ matrix.executable }} -NoLogo -NoProfile -ExecutionPolicy Bypass -File .\windows\tests\run-tests.ps1

  macos-tests:
    name: macOS repository regressions
    runs-on: macos-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: "22"

      - name: Locate runner Node.js
        id: node
        shell: bash
        run: echo "path=$(command -v node)" >> "$GITHUB_OUTPUT"

      - name: Run macOS regressions without installed-app checks
        shell: bash
        env:
          NODE: ${{ steps.node.outputs.path }}
          CODEX_DREAM_SKIN_SKIP_SIGNED_RUNTIME_TESTS: "1"
          CODEX_DREAM_SKIN_SKIP_DOCTOR: "1"
        run: ./macos/tests/run-tests.sh