ci.yml

name: CI

on:
  # PRs are covered by `pull_request`; the merge queue by `merge_group`.
  # Scoping `push` to main avoids a duplicate run on every PR branch
  # (push + pull_request) while still validating main after a queue merge.
  push:
    branches: [main]
  pull_request:
  merge_group:

permissions:
  contents: read

concurrency:
  # One in-flight run per PR (or per ref elsewhere); cancel superseded PR runs.
  group: ci-${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

jobs:
  build:
    name: Lint, typecheck, test, build (Node ${{ matrix.node }})
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        # sandbox engines.node >=22 is the binding floor; agent (>=20) runs fine
        # on these. 26.3.0 matches the version pinned in mise.toml.
        node: ["22", "24", "26.3.0"]
    env:
      # Override the node version per matrix cell. MISE_LOCKFILE=false disables
      # mise's locked mode for this job: mise.lock only pins node 26.3.0, so the
      # 22/24 cells aren't in the lock and locked mode would refuse them. Tool
      # versions still come from mise.toml; the lock stays authoritative for local
      # dev and the (un-overridden) lint-workflows job below.
      MISE_NODE_VERSION: ${{ matrix.node }}
      MISE_LOCKFILE: "false"
    steps:
      - name: Checkout
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
        with:
          persist-credentials: false

      - name: Set up mise
        uses: jdx/mise-action@e6a8b3978addb5a52f2b4cd9d91eafa7f0ab959d # v4
        with:
          # Don't auto-install: the action force-adds `--locked` when a lockfile
          # is present, which fails for matrix node versions not in the lock.
          install: false

      - name: Install node and pnpm via mise
        run: mise install node pnpm

      - name: Resolve pnpm store path
        run: echo "STORE_PATH=$(pnpm store path --silent)" >> "$GITHUB_ENV"

      - name: Cache pnpm store
        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
        with:
          path: ${{ env.STORE_PATH }}
          key: ${{ runner.os }}-node${{ matrix.node }}-pnpm-${{ hashFiles('pnpm-lock.yaml') }}
          restore-keys: |
            ${{ runner.os }}-node${{ matrix.node }}-pnpm-

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Lint
        run: pnpm lint

      - name: Check formatting
        run: pnpm format:check

      # Build before typecheck and test: a package may depend on a sibling workspace
      # package's built output/types (e.g. @coder/ai-sdk-eve-sandbox imports
      # @coder/ai-sdk-sandbox). `pnpm -r build` runs in topological order, so each
      # dependency's dist/ exists before its dependents are typechecked, tested, or built.
      - name: Build
        run: pnpm build

      - name: Typecheck
        run: pnpm typecheck

      - name: Test
        run: pnpm test

      # ESM-only publish gates — sandbox + provider (the root scripts --filter them).
      # Run after build so dist/ exists.
      - name: Publint (sandbox, provider)
        run: pnpm publint

      - name: Are the types wrong? (sandbox, provider)
        run: pnpm attw

  lint-workflows:
    name: Lint workflows (actionlint + zizmor)
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
        with:
          persist-credentials: false

      - name: Install tools via mise
        uses: jdx/mise-action@e6a8b3978addb5a52f2b4cd9d91eafa7f0ab959d # v4

      - name: actionlint
        run: actionlint

      - name: zizmor
        run: zizmor .github/workflows
        env:
          GH_TOKEN: ${{ github.token }}

  # Single, stable required status check. The branch ruleset requires exactly
  # one context named "Required"; it aggregates every other job, so it stays
  # valid no matter how the matrix or job list changes — 'success' only if all
  # passed. Runs in the merge queue (merge_group) too.
  Required:
    name: Required
    if: ${{ always() }}
    needs: [build, lint-workflows]
    runs-on: ubuntu-latest
    steps:
      - name: Verify all jobs succeeded
        env:
          BUILD_RESULT: ${{ needs.build.result }}
          LINT_RESULT: ${{ needs.lint-workflows.result }}
        run: |
          echo "build=$BUILD_RESULT lint-workflows=$LINT_RESULT"
          test "$BUILD_RESULT" = "success"
          test "$LINT_RESULT" = "success"