ci.yml

name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
  workflow_dispatch:

jobs:
  invariants:
    name: Repo Invariants
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: 20
      # No npm install needed — the script is pure node stdlib.
      - run: node scripts/check-repo-invariants.mjs

  docs-coverage:
    name: Docs Coverage
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: 20
      # Pure node stdlib — no install needed.
      # --check enforces per-category floors calibrated to current state;
      # PRs that improve docs may also raise the floors.
      - run: node scripts/docs-coverage.mjs --check
      - name: Upload coverage report
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: docs-coverage
          path: |
            .instar/docs-coverage.md
            .instar/docs-coverage.json

  cartographer-freshness:
    name: Cartographer Freshness
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: 20
      # Pure node stdlib + git — no install needed (cartographer-doc-freshness
      # spec #2 Tier-3 ratchet). Floors ship loose (ratio>=0); cartographer state
      # is gitignored so a fresh checkout is a vacuous structural pass — the
      # ratchet's teeth engage on machines that have authored the doc-tree.
      - run: node scripts/cartographer-freshness.mjs --check
      - name: Upload freshness report
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: cartographer-freshness
          path: |
            .instar/cartographer-freshness.json

  standards-coverage:
    name: Standards Enforcement Coverage
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: 20
      # Pure node stdlib — no install/build needed (cartographer-conformance-audit
      # spec #3 Tier-3 ratchet). For each constitutional standard in
      # docs/STANDARDS-REGISTRY.md, verify the structural guard its prose names
      # exists on disk. Floor on the enforced ratio ships loose (ratio>=0, ratcheted
      # up as gaps close) + a hard ZERO ceiling on dangling refs (a standard must
      # never cite a guard that doesn't exist — a broken guarantee).
      - run: node scripts/standards-coverage.mjs --check
      - name: Upload coverage report
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: standards-coverage
          path: |
            .instar/standards-coverage.json

  lint:
    name: Type Check
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: 20
          cache: npm
      - run: npm ci
      - run: npm run lint

  unit:
    name: Unit Tests (node ${{ matrix.node-version }}, shard ${{ matrix.shard }}/4)
    runs-on: ubuntu-latest
    strategy:
      # Don't cancel other shards if one fails — we want the full picture.
      fail-fast: false
      matrix:
        node-version: [20, 22]
        shard: [1, 2, 3, 4]
    steps:
      - uses: actions/checkout@v4
        with:
          # lint-template-sha-history walks `git log -- src/templates/scripts/
          # telegram-reply.sh` to assert every historical SHIPPED content is
          # in the migrator's prior-shipped set. A shallow clone (default
          # depth=1) defeats that — and silently rubber-stamps the assertion.
          fetch-depth: 0
      - uses: actions/setup-node@v4
        with:
          node-version: ${{ matrix.node-version }}
          cache: npm
      - name: Install tmux
        run: sudo apt-get update && sudo apt-get install -y tmux
      - run: npm ci
      # vitest shard syntax: --shard=<index>/<total>. Each runner executes a
      # deterministic disjoint slice of the test files; union is the full suite.
      # fileParallelism stays off within each shard to preserve isolation.
      - run: npm run test:push -- --shard=${{ matrix.shard }}/4
      - name: Working-tree integrity check
        run: |
          if [ -n "$(git status --porcelain)" ]; then
            echo "::error::Test suite mutated the working tree. SafeGitExecutor / SafeFsExecutor likely bypassed."
            git status --porcelain
            git diff
            exit 1
          fi

  integration:
    name: Integration Tests
    runs-on: ubuntu-latest
    needs: unit
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: 20
          cache: npm
      - name: Install tmux
        run: sudo apt-get update && sudo apt-get install -y tmux
      - run: npm ci
      - run: npm run test:integration
      - name: Working-tree integrity check
        run: |
          if [ -n "$(git status --porcelain)" ]; then
            echo "::error::Integration tests mutated the working tree. SafeGitExecutor / SafeFsExecutor likely bypassed."
            git status --porcelain
            git diff
            exit 1
          fi

  e2e:
    name: E2E Tests
    runs-on: ubuntu-latest
    needs: unit
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: 20
          cache: npm
      - name: Install tmux
        run: sudo apt-get update && sudo apt-get install -y tmux
      - run: npm ci
      - run: npm run test:e2e
      - name: Working-tree integrity check
        run: |
          if [ -n "$(git status --porcelain)" ]; then
            echo "::error::E2E tests mutated the working tree. SafeGitExecutor / SafeFsExecutor likely bypassed."
            git status --porcelain
            git diff
            exit 1
          fi

  contract:
    name: Contract Tests (Live API)
    runs-on: ubuntu-latest
    needs: unit
    # Only run when adapter source files or contract tests change
    if: >
      github.event_name == 'push' ||
      contains(github.event.pull_request.changed_files_names || '', 'src/messaging/')
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: 20
          cache: npm
      - run: npm ci
      - name: Run contract tests
        env:
          SLACK_CONTRACT_BOT_TOKEN: ${{ secrets.SLACK_CONTRACT_BOT_TOKEN }}
        run: |
          if [ -z "$SLACK_CONTRACT_BOT_TOKEN" ]; then
            echo "⚠️  SLACK_CONTRACT_BOT_TOKEN not configured — skipping contract tests"
            echo "To enable: add SLACK_CONTRACT_BOT_TOKEN to repository secrets"
            exit 0
          fi
          npx vitest run --config vitest.contract.config.ts

  build:
    name: Build
    runs-on: ubuntu-latest
    needs: [lint, unit]
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: 20
          cache: npm
      - run: npm ci
      - run: npm run build