ci.yml

name: CI

on:
  pull_request:
  push:
    branches:
      - main
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: ci-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

defaults:
  run:
    shell: bash

env:
  NODE_VERSION: "22"
  PNPM_VERSION: "9.15.4"
  ONNXRUNTIME_NODE_INSTALL_CUDA: "skip"

jobs:
  repo-hygiene:
    name: repo-hygiene
    runs-on: ubuntu-24.04
    timeout-minutes: 10
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: Setup Node
        uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION }}
      - name: Run repo hygiene
        run: node scripts/ci/repo-hygiene.mjs

  package-metadata:
    name: package-metadata
    runs-on: ubuntu-24.04
    timeout-minutes: 10
    steps:
      - name: Checkout
        uses: actions/checkout@v4
      - name: Setup Node
        uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION }}
      - name: Run package metadata checks
        run: node scripts/ci/package-metadata.mjs

  release-policy:
    name: release-policy
    runs-on: ubuntu-24.04
    timeout-minutes: 10
    steps:
      - name: Checkout
        uses: actions/checkout@v4
      - name: Setup Node
        uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION }}
      # release-policy.mjs parses workflow YAML with the root `yaml`
      # devDependency, so this job needs an install (it previously ran on a
      # bare checkout).
      - name: Setup pnpm
        run: |
          corepack enable
          corepack prepare pnpm@${PNPM_VERSION} --activate
      - name: Install dependencies
        run: pnpm install --frozen-lockfile --ignore-scripts
      - name: Run release-policy guardrails
        run: node scripts/ci/release-policy.mjs
      - name: Run release-policy unit tests
        run: node --test scripts/ci/__tests__/release-policy.test.mjs
      # Every surface that can write a verbatim memory must be able to stamp
      # content_class. The 0.2.0 release fixed Hermes for Core's raw-content
      # policy and missed OpenClaw, whose published plugin could not perform a
      # verbatim ingest at all. Tests run first: a conformance check whose own
      # logic is unverified is not evidence of anything.
      - name: Run ingest contract conformance tests
        run: node --test scripts/ci/__tests__/ingest-contract-conformance.test.mjs
      - name: Check ingest contract conformance
        run: node scripts/check-ingest-contract-conformance.mjs
      - name: Run guard unit tests
        run: node --test scripts/guards/__tests__/*.test.mjs

  affected-build-test:
    name: affected-build-test (node ${{ matrix.node-version }})
    runs-on: ubuntu-24.04
    timeout-minutes: 20
    strategy:
      fail-fast: false
      matrix:
        node-version: ["22", "24"]
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: Setup Node
        uses: actions/setup-node@v4
        with:
          node-version: ${{ matrix.node-version }}
      - name: Setup Python
        uses: actions/setup-python@v5
        with:
          python-version: "3.11"
      - name: Setup pnpm
        run: |
          corepack enable
          corepack prepare pnpm@${PNPM_VERSION} --activate
      - name: Install dependencies
        run: pnpm install --frozen-lockfile
      - name: Run affected build, typecheck, lint, and self-contained tests
        run: node scripts/ci/run-root-script.mjs ci:affected

  code-health:
    name: code-health
    runs-on: ubuntu-24.04
    timeout-minutes: 20
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: Setup Node
        uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION }}
      - name: Setup pnpm
        run: |
          corepack enable
          corepack prepare pnpm@${PNPM_VERSION} --activate
      - name: Install dependencies
        run: pnpm install --frozen-lockfile
      - name: Run code health checks
        run: node scripts/ci/run-root-script.mjs ci:code-health

  pack-dry-run:
    name: pack-dry-run
    runs-on: ubuntu-24.04
    timeout-minutes: 20
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: Setup Node
        uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION }}
      - name: Setup pnpm
        run: |
          corepack enable
          corepack prepare pnpm@${PNPM_VERSION} --activate
      - name: Install dependencies
        run: pnpm install --frozen-lockfile
      - name: Run package dry-runs through turbo
        run: node scripts/ci/run-root-script.mjs ci:pack-dry-run
      - name: Verify pack output shape
        run: node scripts/ci/pack-dry-run.mjs

  docs-contract:
    name: docs-contract
    runs-on: ubuntu-24.04
    timeout-minutes: 10
    steps:
      - name: Checkout
        uses: actions/checkout@v4
      - name: Setup Node
        uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION }}
      - name: Setup pnpm
        run: |
          corepack enable
          corepack prepare pnpm@${PNPM_VERSION} --activate
      - name: Install dependencies
        run: pnpm install --frozen-lockfile
      - name: Run docs contract
        run: node scripts/ci/run-root-script.mjs ci:docs-contract
      - name: Validate public smoke contract JSON when present
        run: |
          contract_path="tests/smoke/docs-contract/public-smoke-contract.json"
          if [ -f "${contract_path}" ]; then
            jq empty "${contract_path}"
          else
            echo "::notice::No public smoke contract yet; skipped JSON validation."
          fi

  public-integration-smoke:
    name: public-integration-smoke
    runs-on: ubuntu-24.04
    timeout-minutes: 20
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: Setup Node
        uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION }}
      - name: Setup pnpm
        run: |
          corepack enable
          corepack prepare pnpm@${PNPM_VERSION} --activate
      - name: Install dependencies
        run: pnpm install --frozen-lockfile
      - name: Run public integration smoke
        run: node scripts/ci/run-root-script.mjs ci:public-smoke

  core-docker-smoke:
    name: core-docker-smoke
    runs-on: ubuntu-24.04
    timeout-minutes: 25
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
      # Build + boot the real core image only when core changes — guards the
      # class of bug where the image builds but crashes on boot (e.g. a runtime
      # file the Dockerfile forgot to COPY). The unit/affected suites never
      # exercise the container, so without this a boot crash ships to publish.
      - name: Detect core-affecting changes
        id: changes
        env:
          BASE: ${{ github.event_name == 'pull_request' && github.event.pull_request.base.sha || github.event.before }}
        run: |
          if [ -z "$BASE" ] || [ "$BASE" = "0000000000000000000000000000000000000000" ]; then
            echo "core=true" >> "$GITHUB_OUTPUT"; exit 0
          fi
          changed="$(git diff --name-only "$BASE" HEAD || echo FORCE)"
          # Include root build-context files: a change to the workspace manifest,
          # turbo config, lockfile, or this workflow can alter the built image.
          if [ "$changed" = "FORCE" ] || printf '%s\n' "$changed" | grep -qE '^(packages/core/|pnpm-lock\.yaml$|pnpm-workspace\.yaml$|package\.json$|turbo\.json$|\.github/workflows/ci\.yml$)'; then
            echo "core=true" >> "$GITHUB_OUTPUT"
          else
            echo "core=false" >> "$GITHUB_OUTPUT"
          fi
      - name: Build core image + boot smoke
        if: steps.changes.outputs.core == 'true'
        # Boot-only keeps the gate deterministic: the ingest/search steps need a
        # networked model download that flakes. Boot + /openapi.json + capabilities
        # catch the image-won't-boot class (PR #31).
        env:
          SMOKE_BOOT_ONLY: '1'
        run: bash packages/core/scripts/docker-smoke-test.sh

  security-compliance:
    name: security-compliance
    runs-on: ubuntu-24.04
    timeout-minutes: 10
    permissions:
      contents: read
      pull-requests: read
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: Setup Node
        uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION }}
      - name: Run security compliance
        run: node scripts/security/security-compliance.mjs