ci.yml

name: CI

on:
  pull_request:
    branches: ["main"]
  push:
    branches: ["main"]
  workflow_call:

permissions:
  contents: read

concurrency:
  group: ci-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  go-test:
    name: Go Tests
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup Go
        uses: actions/setup-go@v5
        with:
          go-version-file: go.mod
          cache: true

      - name: "Run Go tests (Phase 51 QUAL-07: -race -shuffle=on, tests/e2e 排除)"
        run: |
          set -euo pipefail
          go test $(go list ./... | grep -v '/tests/e2e$') -race -shuffle=on -count=1
          go test ./tests/e2e/... -count=1

  web-build:
    name: Web Build
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: web/admin
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Enable corepack
        run: corepack enable

      - name: Setup pnpm
        uses: pnpm/action-setup@v4
        with:
          package_json_file: web/admin/package.json

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: 24
          cache: pnpm
          cache-dependency-path: web/admin/pnpm-lock.yaml

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Build web app
        run: pnpm build

  perf-benchmark:
    name: Performance Benchmark (synthetic 10k, local baseline)
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Install hyperfine + ripgrep + jq
        run: |
          sudo apt-get update
          sudo apt-get install -y --no-install-recommends hyperfine ripgrep jq

      - name: Generate synthetic tree
        run: bash scripts/gen-bench-tree.sh --count=10000 --output=/tmp/bench-tree --seed=42

      - name: Run benchmark (CI baseline only)
        run: bash scripts/perf-benchmark.sh --ci-mode --runs=10 --warmup=1

      - name: Upload bench artifact
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: perf-bench-${{ github.sha }}
          path: .planning/phases/35-e2e/benchmarks/
          if-no-files-found: warn
          retention-days: 30

  image-size-regression:
    name: Image Size Regression (BASE-04 ≤ 2GB)
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Read expected image name
        id: read-image
        run: |
          IMAGE_NAME=$(awk -F': ' '$1 == "local_dev_image_name" { print $2 }' deploy/docker/managed-user/image.lock)
          if [ -z "$IMAGE_NAME" ]; then
            echo "failed to read local_dev_image_name from image.lock" >&2
            exit 1
          fi
          echo "IMAGE_NAME=$IMAGE_NAME" >> "$GITHUB_OUTPUT"

      - name: Build managed-user image
        run: |
          docker build \
            -t "${{ steps.read-image.outputs.IMAGE_NAME }}" \
            -f deploy/docker/managed-user/Dockerfile \
            .

      - name: Run verify-managed-image.sh
        run: bash scripts/verify-managed-image.sh

      - name: Assert uncompressed size ≤ 3GB
        run: |
          size=$(docker image inspect "${{ steps.read-image.outputs.IMAGE_NAME }}" --format='{{.Size}}')
          max=$((2048 * 1024 * 1024))   # 2048 MiB = 2147483648 bytes
          echo "image_size_bytes=$size (max=$max)"
          if [ "$size" -gt "$max" ]; then
            echo "FAIL: image size $size > $max (2GB)" >&2
            exit 1
          fi
          echo "PASS: image size within BASE-04 budget"

  lint-no-bare-sleep:
    name: Lint — no bare sleep in tests/e2e
    # Phase 45 Plan 05：守护 tests/e2e/ 套件不出现裸 time.Sleep。
    # 与 .github/workflows/e2e.yml 的同名步骤双重守护：本 job 永远跑（不带
    # paths 过滤），保证脚本本身不腐烂；e2e.yml 上的 lint 是 paths 过滤后的
    # 强制守护。重复运行成本极低（脚本 < 1s）。
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: bash -n
        run: bash -n scripts/lint-no-bare-sleep.sh

      - name: Run lint-no-bare-sleep
        run: bash scripts/lint-no-bare-sleep.sh