test.yml

name: Tests

# Comprehensive test orchestrator. Runs the full eliza test suite plus
# focused server/client/plugin slices and the database security guard.
# This is a peer of `ci.yaml` — `ci.yaml` is the canonical lint+typecheck+
# build+core-test gate; this workflow adds the broader integration surface.

on:
  pull_request:
    branches: [main, develop]
    paths-ignore:
      - "**/*.md"
      - "docs/**"
      - "packages/docs/**"
      - "AGENTS.md"
      - "CHANGELOG.md"
      - "LICENSE"
      - ".github/ISSUE_TEMPLATE/**"
      - ".github/pull_request_template.md"
  push:
    branches: [main, develop]
    paths-ignore:
      - "**/*.md"
      - "docs/**"
      - "packages/docs/**"
      - "AGENTS.md"
      - "CHANGELOG.md"
      - "LICENSE"
      - ".github/ISSUE_TEMPLATE/**"
      - ".github/pull_request_template.md"
  workflow_dispatch:
  schedule:
    # Nightly live smoke for container-backed remote capability plugins.
    - cron: "17 9 * * *"

concurrency:
  group: test-${{ github.ref }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

env:
  CI: "true"
  BUN_VERSION: "1.3.13"
  NODE_VERSION: "24.15.0"
  NODE_NO_WARNINGS: "1"
  NODE_OPTIONS: "--max-old-space-size=8192"
  # Live-test keys. Suites gated via describeLive() / requiredEnv skip cleanly
  # with a yellow warning when a key is missing — the workflow stays green.
  # Cerebras is the universal default LLM (gpt-oss-120b); the OPENAI_* aliases
  # are auto-applied by packages/scripts/run-all-tests.mjs when CEREBRAS_API_KEY is set.
  CEREBRAS_API_KEY: ${{ secrets.CEREBRAS_API_KEY }}
  OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
  ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
  GROQ_API_KEY: ${{ secrets.GROQ_API_KEY }}
  OPENROUTER_API_KEY: ${{ secrets.OPENROUTER_API_KEY }}
  GOOGLE_GENERATIVE_AI_API_KEY: ${{ secrets.GOOGLE_GENERATIVE_AI_API_KEY }}
  XAI_API_KEY: ${{ secrets.XAI_API_KEY }}
  NVIDIA_API_KEY: ${{ secrets.NVIDIA_API_KEY }}
  ELIZAOS_CLOUD_API_KEY: ${{ secrets.ELIZAOS_CLOUD_API_KEY }}

# Default to least privilege. Override per-job where needed.
permissions:
  contents: read

jobs:
  server-tests:
    name: Server Tests
    runs-on: ubuntu-24.04
    timeout-minutes: 60
    env:
      TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}
      TURBO_TEAM: ${{ vars.TURBO_TEAM }}
      TURBO_REMOTE_ONLY: true
      PGLITE_WASM_MODE: node
    steps:
      - uses: actions/checkout@v4
        with:
          submodules: false

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION }}

      - name: Setup workspace dependencies
        uses: ./.github/actions/setup-bun-workspace
        with:
          bun-version: ${{ env.BUN_VERSION }}
          install-command: bun install
          install-native-deps: "false"
          skip-avatar-clone: "true"
          no-vision-deps: "true"

      - name: Build view bundles
        run: bun run build:views

      - name: Views system tests
        run: bunx vitest run packages/agent/src/__tests__/views-system-smoke.test.ts packages/agent/src/__tests__/views-registry-integration.test.ts

      - name: Remote capability router tests
        run: bun run test:remote-capabilities

      - name: Remote capability plugin surface audit
        run: bun run test:remote-capabilities:surface-audit

      - name: Remote capability live CI audit
        run: bun run test:remote-capabilities:live-ci-audit

      - name: Remote capability live CI audit self-test
        run: bun run test:remote-capabilities:live-ci-audit:self-test

      - name: Remote capability naming audit
        run: bun run test:remote-capabilities:naming-audit

      - name: Remote capability naming audit self-test
        run: bun run test:remote-capabilities:naming-audit:self-test

      - name: Remote capability source-build smoke
        run: bun run test:remote-capabilities:source-build

      - name: Remote capability fixture server smoke
        run: bun run test:remote-capabilities:fixture-server

      - name: Remote capability live report validator self-test
        run: bun run test:remote-capabilities:validate-live-reports:self-test

      - name: Remote capability GitHub live evidence self-test
        run: bun run test:remote-capabilities:github-live-evidence:self-test

      - name: Remote capability GitHub live artifact self-test
        run: bun run test:remote-capabilities:github-live-artifacts:self-test

      - name: Remote capability Docker smoke
        run: bun run test:remote-capabilities:docker

      - name: Run server tests
        run: bun run test:server

      - name: Run node:sqlite tests
        # training-benchmarks.test.ts requires node:sqlite (Node ≥22.5, stable
        # in Node ≥24). It is excluded from the Bun-run vitest.config.ts because
        # Bun doesn't expose that built-in. This step runs it under Node with a
        # minimal config that doesn't have the exclude.
        working-directory: packages/app-core
        run: |
          node ../../node_modules/vitest/vitest.mjs run --config vitest.node-sqlite.config.ts

  client-tests:
    name: Client Tests
    runs-on: ubuntu-24.04
    timeout-minutes: 60
    env:
      TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}
      TURBO_TEAM: ${{ vars.TURBO_TEAM }}
      TURBO_REMOTE_ONLY: true
    steps:
      - uses: actions/checkout@v4
        with:
          submodules: false

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION }}

      - name: Setup workspace dependencies
        uses: ./.github/actions/setup-bun-workspace
        with:
          bun-version: ${{ env.BUN_VERSION }}
          install-command: bun install
          install-native-deps: "false"
          skip-avatar-clone: "true"
          no-vision-deps: "true"

      - name: Run client tests
        run: bun run test:client

      - name: Install Playwright Chromium
        run: bunx playwright install --with-deps chromium

      - name: Remote capability UI smoke
        run: bun run test:remote-capabilities:ui

  plugin-tests:
    name: Plugin Tests
    runs-on: ubuntu-24.04
    timeout-minutes: 95
    env:
      TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}
      TURBO_TEAM: ${{ vars.TURBO_TEAM }}
      TURBO_REMOTE_ONLY: true
      # Share compiled rust artifacts across all plugin crates so the
      # `elizaos = "2.0.0"` crate (and its sqlx/hyper/etc transitive deps)
      # only compiles once, not once per plugin. Without this, each
      # plugin-{discord,groq,openai,sql,whatsapp} rebuilds the same heavy
      # dep tree from scratch, blowing past the step timeout.
      CARGO_TARGET_DIR: ${{ github.workspace }}/.cargo-shared-target
      CARGO_INCREMENTAL: "0"
    steps:
      - uses: actions/checkout@v4
        with:
          submodules: false
          fetch-depth: 1

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION }}

      - name: Setup workspace dependencies
        uses: ./.github/actions/setup-bun-workspace
        with:
          bun-version: ${{ env.BUN_VERSION }}
          install-command: bun install
          install-native-deps: "false"
          skip-avatar-clone: "true"
          no-vision-deps: "true"

      - name: Cache cargo registry and shared target dir
        uses: actions/cache@v5
        with:
          path: |
            ~/.cargo/registry
            ~/.cargo/git
            ${{ github.workspace }}/.cargo-shared-target
          key: ${{ runner.os }}-cargo-plugin-tests-${{ hashFiles('plugins/*/rust/Cargo.lock', 'plugins/*/rust/Cargo.toml') }}
          restore-keys: |
            ${{ runner.os }}-cargo-plugin-tests-

      - name: Run plugin tests
        # Cap step below the 95m job budget so a flaky plugin
        # (most recently plugin-shell rust PTY tests in run 25234887145)
        # fails fast instead of burning the whole job's wall clock.
        timeout-minutes: 85
        run: bun run test:plugins

  desktop-contract:
    name: Electrobun Desktop Contract
    runs-on: ubuntu-24.04
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@v4
        with:
          submodules: false

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION }}

      - name: Setup workspace dependencies
        uses: ./.github/actions/setup-bun-workspace
        with:
          bun-version: ${{ env.BUN_VERSION }}
          install-command: bun install
          install-native-deps: "false"

      - name: Build workspace packages for Vitest resolution
        run: bun run build:core

      - name: Run Electrobun contract tests
        working-directory: packages/app-core/platforms/electrobun
        run: bun run test

  cloud-live-e2e:
    name: Cloud Live E2E (Eliza Cloud)
    runs-on: ubuntu-24.04
    timeout-minutes: 60
    env:
      TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}
      TURBO_TEAM: ${{ vars.TURBO_TEAM }}
      TURBO_REMOTE_ONLY: true
    steps:
      - name: Check cloud secrets
        id: cloud
        env:
          EVENT_NAME: ${{ github.event_name }}
          ELIZAOS_CLOUD_API_KEY: ${{ secrets.ELIZAOS_CLOUD_API_KEY != '' && secrets.ELIZAOS_CLOUD_API_KEY || secrets.ELIZACLOUD_API_KEY }}
        run: |
          if [ -z "${ELIZAOS_CLOUD_API_KEY}" ]; then
            if [ "${EVENT_NAME}" = "workflow_dispatch" ] || [ "${EVENT_NAME}" = "schedule" ]; then
              echo "::error::No Eliza Cloud API key configured for observed cloud live E2E."
              exit 1
            fi
            echo "::warning::No Eliza Cloud API key configured - skipping optional cloud live E2E for ${EVENT_NAME}."
            echo "skip=true" >> "$GITHUB_OUTPUT"
          else
            echo "skip=false" >> "$GITHUB_OUTPUT"
          fi

      - name: Checkout
        if: steps.cloud.outputs.skip != 'true'
        uses: actions/checkout@v4
        with:
          submodules: false

      - name: Setup Node.js
        if: steps.cloud.outputs.skip != 'true'
        uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION }}

      - name: Setup workspace dependencies
        if: steps.cloud.outputs.skip != 'true'
        uses: ./.github/actions/setup-bun-workspace
        with:
          bun-version: ${{ env.BUN_VERSION }}
          install-command: bun install
          install-native-deps: "false"
          skip-avatar-clone: "true"
          no-vision-deps: "true"

      - name: Run Cloud tests
        if: steps.cloud.outputs.skip != 'true'
        shell: bash
        run: |
          set -o pipefail
          log_file="$(mktemp)"

          if bun run --cwd packages/cloud-sdk test:e2e 2>&1 | tee "$log_file"; then
            exit 0
          fi

          if grep -Eiq 'exceeded your current quota|quota exceeded|insufficient[_ -]?(quota|balance|funds|credits?)|billing details|credit balance|please add credits|top[_ -]?up your credits|invalid api key|unauthorized|authentication|status code: 429|too many requests|unexpected error occurred while processing the request|temporarily unavailable|service unavailable|internal server error|overloaded' "$log_file"; then
            echo "::warning::Cloud Live E2E skipped because the configured external provider is unavailable."
            exit 0
          fi

          exit 1
        env:
          ELIZA_LIVE_TEST: "1"
          ELIZAOS_CLOUD_API_KEY: ${{ secrets.ELIZAOS_CLOUD_API_KEY != '' && secrets.ELIZAOS_CLOUD_API_KEY || secrets.ELIZACLOUD_API_KEY }}
          ELIZA_CLOUD_API_KEY: ${{ secrets.ELIZAOS_CLOUD_API_KEY != '' && secrets.ELIZAOS_CLOUD_API_KEY || secrets.ELIZACLOUD_API_KEY }}
          ELIZAOS_CLOUD_BASE_URL: ${{ secrets.ELIZAOS_CLOUD_BASE_URL }}
          ELIZA_CLOUD_BASE_URL: ${{ secrets.ELIZAOS_CLOUD_BASE_URL }}

      - name: Prepare remote capability cloud live report directory
        if: steps.cloud.outputs.skip != 'true' && (github.event_name == 'workflow_dispatch' || github.event_name == 'schedule')
        run: |
          rm -rf reports/remote-capabilities/cloud
          mkdir -p reports/remote-capabilities/cloud

      - name: Remote capability cloud sandbox live smoke
        if: steps.cloud.outputs.skip != 'true' && (github.event_name == 'workflow_dispatch' || github.event_name == 'schedule')
        run: bun run --cwd packages/agent test:remote-capabilities:cloud-live
        env:
          ELIZA_LIVE_TEST: "1"
          ELIZA_REMOTE_CAPABILITY_LIVE_REPORT_DIR: reports/remote-capabilities/cloud
          ELIZAOS_CLOUD_API_KEY: ${{ secrets.ELIZAOS_CLOUD_API_KEY != '' && secrets.ELIZAOS_CLOUD_API_KEY || secrets.ELIZACLOUD_API_KEY }}
          ELIZAOS_CLOUD_BASE_URL: ${{ secrets.ELIZAOS_CLOUD_BASE_URL }}
          ELIZA_CLOUD_BASE_URL: ${{ secrets.ELIZAOS_CLOUD_BASE_URL }}

      - name: Validate remote capability cloud live report
        if: steps.cloud.outputs.skip != 'true' && (github.event_name == 'workflow_dispatch' || github.event_name == 'schedule')
        run: bun run test:remote-capabilities:validate-live-reports --kind cloud --expect-count 1 --max-age-minutes 90 --max-future-minutes 5 --require-ci --require-file-identity --match-github-env reports/remote-capabilities/cloud

      - name: Upload remote capability cloud live report
        if: steps.cloud.outputs.skip != 'true' && (github.event_name == 'workflow_dispatch' || github.event_name == 'schedule')
        uses: actions/upload-artifact@v7
        with:
          name: remote-capability-cloud-live-report
          path: reports/remote-capabilities/cloud/*.json
          if-no-files-found: error
          retention-days: 30

      - name: Note remote capability cloud live smoke not observed
        if: steps.cloud.outputs.skip != 'true' && github.event_name != 'workflow_dispatch' && github.event_name != 'schedule'
        run: |
          echo "::notice::Remote capability cloud sandbox live smoke is only observed on workflow_dispatch or schedule events."
          {
            echo "### Remote capability cloud live smoke"
            echo ""
            echo "Not observed for event \`${{ github.event_name }}\`. The full-surface cloud sandbox smoke runs only on \`workflow_dispatch\` and \`schedule\`."
          } >> "$GITHUB_STEP_SUMMARY"

  provider-live-e2e:
    name: Remote Capability Provider Live E2E
    runs-on: ubuntu-24.04
    timeout-minutes: 45
    env:
      TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}
      TURBO_TEAM: ${{ vars.TURBO_TEAM }}
      TURBO_REMOTE_ONLY: true
    steps:
      - name: Check provider endpoint secrets
        id: providers
        env:
          EVENT_NAME: ${{ github.event_name }}
          E2B_URL: ${{ secrets.ELIZA_REMOTE_CAPABILITY_E2B_URL }}
          HOME_URL: ${{ secrets.ELIZA_REMOTE_CAPABILITY_HOME_MACHINE_URL }}
          MOBILE_URL: ${{ secrets.ELIZA_REMOTE_CAPABILITY_MOBILE_COMPANION_URL }}
          DESKTOP_URL: ${{ secrets.ELIZA_REMOTE_CAPABILITY_DESKTOP_COMPANION_URL }}
        run: |
          if [ -z "${E2B_URL}${HOME_URL}${MOBILE_URL}${DESKTOP_URL}" ]; then
            if [ "${EVENT_NAME}" = "workflow_dispatch" ] || [ "${EVENT_NAME}" = "schedule" ]; then
              echo "::error::No remote capability provider endpoints configured for observed provider live E2E."
              exit 1
            fi
            echo "::warning::No remote capability provider endpoints configured - skipping optional provider live E2E."
            echo "skip=true" >> "$GITHUB_OUTPUT"
            exit 0
          fi

          missing_required=()
          if [ -z "${E2B_URL}" ]; then
            missing_required+=("ELIZA_REMOTE_CAPABILITY_E2B_URL")
          fi
          if [ -z "${HOME_URL}" ]; then
            missing_required+=("ELIZA_REMOTE_CAPABILITY_HOME_MACHINE_URL")
          fi
          if [ -z "${MOBILE_URL}" ]; then
            missing_required+=("ELIZA_REMOTE_CAPABILITY_MOBILE_COMPANION_URL")
          fi

          if [ "${#missing_required[@]}" -gt 0 ]; then
            message="Missing required remote capability provider endpoint secrets: ${missing_required[*]}"
            if [ "${EVENT_NAME}" = "workflow_dispatch" ] || [ "${EVENT_NAME}" = "schedule" ]; then
              echo "::error::${message}"
              exit 1
            fi
            echo "::notice::${message}. Provider live smoke is only observed on workflow_dispatch or schedule events."
            echo "skip=false" >> "$GITHUB_OUTPUT"
          else
            echo "skip=false" >> "$GITHUB_OUTPUT"
          fi

      - name: Checkout
        if: steps.providers.outputs.skip != 'true' && (github.event_name == 'workflow_dispatch' || github.event_name == 'schedule')
        uses: actions/checkout@v4
        with:
          submodules: false

      - name: Setup Node.js
        if: steps.providers.outputs.skip != 'true' && (github.event_name == 'workflow_dispatch' || github.event_name == 'schedule')
        uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION }}

      - name: Setup workspace dependencies
        if: steps.providers.outputs.skip != 'true' && (github.event_name == 'workflow_dispatch' || github.event_name == 'schedule')
        uses: ./.github/actions/setup-bun-workspace
        with:
          bun-version: ${{ env.BUN_VERSION }}
          install-command: bun install
          install-native-deps: "false"
          skip-avatar-clone: "true"
          no-vision-deps: "true"

      - name: Prepare remote capability provider live report directory
        if: steps.providers.outputs.skip != 'true' && (github.event_name == 'workflow_dispatch' || github.event_name == 'schedule')
        run: |
          rm -rf reports/remote-capabilities/providers
          mkdir -p reports/remote-capabilities/providers

      - name: Remote capability URL-backed provider live smoke
        if: steps.providers.outputs.skip != 'true' && (github.event_name == 'workflow_dispatch' || github.event_name == 'schedule')
        run: bun run --cwd packages/agent test:remote-capabilities:provider-live
        env:
          ELIZA_LIVE_TEST: "1"
          ELIZA_REMOTE_CAPABILITY_LIVE_REPORT_DIR: reports/remote-capabilities/providers
          ELIZA_REMOTE_CAPABILITY_E2B_URL: ${{ secrets.ELIZA_REMOTE_CAPABILITY_E2B_URL }}
          ELIZA_REMOTE_CAPABILITY_E2B_TOKEN: ${{ secrets.ELIZA_REMOTE_CAPABILITY_E2B_TOKEN }}
          ELIZA_REMOTE_CAPABILITY_E2B_ENDPOINT_ID: ${{ secrets.ELIZA_REMOTE_CAPABILITY_E2B_ENDPOINT_ID }}
          ELIZA_REMOTE_CAPABILITY_E2B_MODULES: ${{ secrets.ELIZA_REMOTE_CAPABILITY_E2B_MODULES }}
          ELIZA_REMOTE_CAPABILITY_HOME_MACHINE_URL: ${{ secrets.ELIZA_REMOTE_CAPABILITY_HOME_MACHINE_URL }}
          ELIZA_REMOTE_CAPABILITY_HOME_MACHINE_TOKEN: ${{ secrets.ELIZA_REMOTE_CAPABILITY_HOME_MACHINE_TOKEN }}
          ELIZA_REMOTE_CAPABILITY_HOME_MACHINE_ENDPOINT_ID: ${{ secrets.ELIZA_REMOTE_CAPABILITY_HOME_MACHINE_ENDPOINT_ID }}
          ELIZA_REMOTE_CAPABILITY_HOME_MACHINE_MODULES: ${{ secrets.ELIZA_REMOTE_CAPABILITY_HOME_MACHINE_MODULES }}
          ELIZA_REMOTE_CAPABILITY_MOBILE_COMPANION_URL: ${{ secrets.ELIZA_REMOTE_CAPABILITY_MOBILE_COMPANION_URL }}
          ELIZA_REMOTE_CAPABILITY_MOBILE_COMPANION_TOKEN: ${{ secrets.ELIZA_REMOTE_CAPABILITY_MOBILE_COMPANION_TOKEN }}
          ELIZA_REMOTE_CAPABILITY_MOBILE_COMPANION_ENDPOINT_ID: ${{ secrets.ELIZA_REMOTE_CAPABILITY_MOBILE_COMPANION_ENDPOINT_ID }}
          ELIZA_REMOTE_CAPABILITY_MOBILE_COMPANION_MODULES: ${{ secrets.ELIZA_REMOTE_CAPABILITY_MOBILE_COMPANION_MODULES }}
          ELIZA_REMOTE_CAPABILITY_DESKTOP_COMPANION_URL: ${{ secrets.ELIZA_REMOTE_CAPABILITY_DESKTOP_COMPANION_URL }}
          ELIZA_REMOTE_CAPABILITY_DESKTOP_COMPANION_TOKEN: ${{ secrets.ELIZA_REMOTE_CAPABILITY_DESKTOP_COMPANION_TOKEN }}
          ELIZA_REMOTE_CAPABILITY_DESKTOP_COMPANION_ENDPOINT_ID: ${{ secrets.ELIZA_REMOTE_CAPABILITY_DESKTOP_COMPANION_ENDPOINT_ID }}
          ELIZA_REMOTE_CAPABILITY_DESKTOP_COMPANION_MODULES: ${{ secrets.ELIZA_REMOTE_CAPABILITY_DESKTOP_COMPANION_MODULES }}

      - name: Validate remote capability provider live reports
        if: steps.providers.outputs.skip != 'true' && (github.event_name == 'workflow_dispatch' || github.event_name == 'schedule')
        run: bun run test:remote-capabilities:validate-live-reports --kind provider --expect-count 3..4 --max-age-minutes 90 --max-future-minutes 5 --allowed-providers e2b,home-machine,mobile-companion,desktop-companion --require-providers e2b,home-machine,mobile-companion --require-ci --require-file-identity --match-github-env reports/remote-capabilities/providers

      - name: Upload remote capability provider live report
        if: steps.providers.outputs.skip != 'true' && (github.event_name == 'workflow_dispatch' || github.event_name == 'schedule')
        uses: actions/upload-artifact@v7
        with:
          name: remote-capability-provider-live-report
          path: reports/remote-capabilities/providers/*.json
          if-no-files-found: error
          retention-days: 30

      - name: Note provider live smoke not observed
        if: steps.providers.outputs.skip != 'true' && github.event_name != 'workflow_dispatch' && github.event_name != 'schedule'
        run: |
          echo "::notice::Remote capability provider live smoke is only observed on workflow_dispatch or schedule events."
          {
            echo "### Remote capability provider live smoke"
            echo ""
            echo "Endpoint secrets are configured, but the full-surface provider live smoke was not observed for event \`${{ github.event_name }}\`. It runs only on \`workflow_dispatch\` and \`schedule\`."
          } >> "$GITHUB_STEP_SUMMARY"

  github-live-artifact-validate:
    name: Remote Capability GitHub Live Artifact Validator
    needs:
      - cloud-live-e2e
      - provider-live-e2e
    if: always() && (github.event_name == 'workflow_dispatch' || github.event_name == 'schedule')
    runs-on: ubuntu-24.04
    timeout-minutes: 15
    env:
      GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}
      TURBO_TEAM: ${{ vars.TURBO_TEAM }}
      TURBO_REMOTE_ONLY: true
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          submodules: false

      - name: Setup workspace dependencies
        uses: ./.github/actions/setup-bun-workspace
        with:
          bun-version: ${{ env.BUN_VERSION }}
          install-command: bun install
          install-native-deps: "false"
          skip-avatar-clone: "true"
          no-vision-deps: "true"

      - name: Download cloud + provider live report artifacts
        run: |
          mkdir -p reports/remote-capabilities/cloud reports/remote-capabilities/providers
          gh run download "$GITHUB_RUN_ID" \
            --repo "$GITHUB_REPOSITORY" \
            --name remote-capability-cloud-live-report \
            --dir reports/remote-capabilities/cloud || echo "::notice::remote-capability-cloud-live-report artifact not present"
          gh run download "$GITHUB_RUN_ID" \
            --repo "$GITHUB_REPOSITORY" \
            --name remote-capability-provider-live-report \
            --dir reports/remote-capabilities/providers || echo "::notice::remote-capability-provider-live-report artifact not present"

      - name: Re-validate cloud live report from downloaded artifact
        if: needs.cloud-live-e2e.result == 'success'
        run: bun run test:remote-capabilities:validate-live-reports --kind cloud --expect-count 1 --max-age-minutes 120 --max-future-minutes 5 --require-ci --require-file-identity reports/remote-capabilities/cloud

      - name: Re-validate provider live reports from downloaded artifacts
        if: needs.provider-live-e2e.result == 'success'
        run: bun run test:remote-capabilities:validate-live-reports --kind provider --expect-count 3..4 --max-age-minutes 120 --max-future-minutes 5 --allowed-providers e2b,home-machine,mobile-companion,desktop-companion --require-providers e2b,home-machine,mobile-companion --require-ci --require-file-identity reports/remote-capabilities/providers

  test-status:
    name: All Tests Passed
    if: always()
    needs:
      - server-tests
      - client-tests
      - plugin-tests
      - desktop-contract
      - cloud-live-e2e
      - provider-live-e2e
      - github-live-artifact-validate
    runs-on: ubuntu-24.04
    steps:
      - name: Check test results
        shell: bash
        run: |
          set -u
          echo "=== Required test job results ==="
          echo "server-tests:     ${{ needs.server-tests.result }}"
          echo "client-tests:     ${{ needs.client-tests.result }}"
          echo "plugin-tests:     ${{ needs.plugin-tests.result }}"
          echo "desktop-contract: ${{ needs.desktop-contract.result }}"
          echo "cloud-live-e2e:   ${{ needs.cloud-live-e2e.result }}"
          echo "provider-live-e2e:${{ needs.provider-live-e2e.result }}"
          echo "github-live-artifact-validate:${{ needs.github-live-artifact-validate.result }}"
          echo "==================================="
          strict_results="${{ github.event_name == 'workflow_dispatch' || github.event_name == 'schedule' }}"
          bad=0
          for pair in \
            "server-tests:${{ needs.server-tests.result }}" \
            "client-tests:${{ needs.client-tests.result }}" \
            "plugin-tests:${{ needs.plugin-tests.result }}" \
            "desktop-contract:${{ needs.desktop-contract.result }}" \
            "cloud-live-e2e:${{ needs.cloud-live-e2e.result }}" \
            "provider-live-e2e:${{ needs.provider-live-e2e.result }}" \
            "github-live-artifact-validate:${{ needs.github-live-artifact-validate.result }}"; do
            name="${pair%%:*}"
            result="${pair##*:}"
            if [ "$result" = "skipped" ] && [ "$strict_results" != "true" ]; then
              echo "::warning title=Test gate::Live-only job '${name}' was skipped for this PR context."
              continue
            fi
            if [ "$result" != "success" ]; then
              echo "::error title=Test gate::Required job '${name}' finished with '${result}' (expected success)"
              bad=1
            fi
          done
          if [ "$bad" -ne 0 ]; then
            exit 1
          fi
          echo "All required test jobs passed."