ci.yml

name: CI

on:
  push:
    branches: [main]
    tags: ['v*']
  pull_request:
    branches: [main]
  workflow_dispatch:

jobs:
  typecheck:
    name: Typecheck (Node ${{ matrix.node }}, ${{ matrix.os }})
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: ubuntu-latest
            node: 20
          - os: ubuntu-latest
            node: 22
          - os: windows-latest
            node: 22
          - os: macos-latest
            node: 22
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: ${{ matrix.node }}
          cache: npm
      - run: npm ci
      - run: npm run typecheck

  test:
    name: Test (Node ${{ matrix.node }}, ${{ matrix.os }})
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: ubuntu-latest
            node: 20
          - os: ubuntu-latest
            node: 22
          - os: windows-latest
            node: 22
          - os: macos-latest
            node: 22
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: ${{ matrix.node }}
          cache: npm
      - run: npm ci
      - run: npm run build
      - run: npm test

  pack-verify:
    name: Pack & Verify (Node ${{ matrix.node }}, ${{ matrix.os }})
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: ubuntu-latest
            node: 22
          - os: windows-latest
            node: 22
          - os: macos-latest
            node: 22
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: ${{ matrix.node }}
          cache: npm
      - run: npm ci
      - run: npm run build

      - name: Verify package integrity
        run: node scripts/verify-package.cjs

  termux:
    name: Termux (Android, x86_64)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Run CI in Termux container
        shell: bash
        run: |
          cat > /tmp/termux-ci.sh <<'CI_SCRIPT'
          #!/bin/sh
          set -ex
          export PATH=/data/data/com.termux/files/usr/bin:$PATH
          export HOME=/home/builder
          export npm_config_cache=/home/builder/project/.npm-cache
          export TERMUX_VERSION=u0
          # Pin a known-reliable mirror to avoid transient 520s on community mirrors
          sed -i 's|^\(deb .*\)|deb https://packages-cf.termux.dev/apt/termux-main stable main|' /data/data/com.termux/files/usr/etc/apt/sources.list 2>/dev/null || true
          pkg update -y || {
            echo 'pkg update failed, retrying...'
            pkg update -y
          }
          # Retry package install up to 3 times — Termux mirrors are flaky
          for attempt in 1 2 3; do
            pkg install -y git nodejs-lts python build-essential && break
            echo "pkg install attempt $attempt failed, retrying..."
            pkg update -y || true
          done
          cd /home/builder/project
          npm install --no-audit --no-fund
          npm install --no-save --no-audit --no-fund @rollup/wasm-node@4
          rm -rf node_modules/rollup
          ln -s @rollup/wasm-node node_modules/rollup
          # .bin symlinks aren't in PATH in Termux's ash — add them explicitly
          export PATH="$PWD/node_modules/.bin:$PATH"
          node node_modules/tsup/dist/cli-default.js
          node scripts/post-build.cjs
          node -e "try { const Database = require('better-sqlite3'); const db = new Database(':memory:'); db.prepare('select 1').get(); db.close(); console.log('better-sqlite3 OK'); } catch (e) { console.log('better-sqlite3 unavailable (optional on Termux):', e.message); }"
          node -e "const { spawnSync } = require('node:child_process'); const r = spawnSync(process.execPath, ['dist/index.js', '--help'], { encoding: 'utf8' }); if (r.status !== 0 || !r.stdout.includes('Usage:')) process.exit(1)"
          node node_modules/vitest/vitest.mjs run
          CI_SCRIPT
          chmod +x /tmp/termux-ci.sh

          docker run --rm \
            --privileged \
            --entrypoint /entrypoint_root.sh \
            -v "${{ github.workspace }}:/home/builder/project" \
            -v /tmp/termux-ci.sh:/tmp/termux-ci.sh:ro \
            -e "HOME=/home/builder" \
            termux/termux-docker:x86_64 \
            bash -c "
              set -e
              chown -R system:system /home/builder
              mkdir -p /home/builder/.npm
              chown -R system:system /home/builder/.npm
              cp /tmp/termux-ci.sh /home/builder/termux-ci.sh
              chown system:system /home/builder/termux-ci.sh
              chmod +x /home/builder/termux-ci.sh
              su system /home/builder/termux-ci.sh
            "

# TEMPORARILY DISABLED: npm publish fails in CI and marks the whole pipeline red.
# Code kept for reference — re-enable (uncomment) once publishing is fixed.
#
# publish:
#   name: Publish to npm
#   needs: [typecheck, test, pack-verify, termux]
#   runs-on: ubuntu-latest
#   if: startsWith(github.ref, 'refs/tags/v')
#   permissions:
#     contents: read
#     id-token: write
#   steps:
#     - uses: actions/checkout@v4
#     - uses: actions/setup-node@v4
#       with:
#         node-version: 22
#         registry-url: https://registry.npmjs.org
#     - run: npm ci
#     - run: npm run build
#     - name: Check if version already published
#       run: |
#         PKG_VERSION=$(node -p "require('./package.json').version")
#         if npm view "@cosmicstack/mercury-agent@$PKG_VERSION" version 2>/dev/null; then
#           echo "Version $PKG_VERSION already published — skipping."
#           exit 0
#         fi
#     - run: npm publish --access public --provenance
#       env:
#         NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}