.drone.yml

kind: pipeline
type: docker
name: default

trigger:
  event:
    - push
    - tag

workspace:
  base: /go
  path: src/github.com/helix-ml/helix

steps:
  - name: build-backend
    image: golang:1.25-alpine
    volumes:
      - name: go-build-cache
        path: /root/.cache/go-build
      - name: go-mod-cache
        path: /go/pkg/mod
    environment:
      GITHUB_TOKEN:
        from_secret: github_token
    commands:
      - apk add --no-cache gcc g++ musl-dev
      - CGO_ENABLED=1 go build -tags "!rocm"
    when:
      event:
        - tag
    depends_on: []

  - name: build-frontend
    image: node:23-alpine
    volumes:
      - name: yarn-cache
        path: /usr/local/share/.cache/yarn
      - name: node-modules-cache
        path: /go/src/github.com/helix-ml/helix/frontend/node_modules
    commands:
      - cd frontend
      - yarn install --frozen-lockfile --check-files
      - yarn test
      - yarn build
    depends_on: []

  #  - name: run-linter
  #    image: golangci/golangci-lint:v2.8.0-alpine
  #    volumes:
  #      - name: go-build-cache
  #        path: /root/.cache/go-build
  #      - name: go-mod-cache
  #        path: /go/pkg/mod
  #    commands:
  #      - golangci-lint cache clean
  #      - golangci-lint run
  #    when:
  #      event:
  #        - push
  #    depends_on: []

  - name: helm-lint
    image: alpine/helm:3.16.4
    commands:
      # Fetch subchart dependencies (postgresql, common) before lint/template
      - helm dependency build charts/helix-controlplane
      # Lint all three charts with default values
      - helm lint charts/helix-controlplane
      - helm lint charts/helix-runner
      - helm lint charts/helix-sandbox
      # Lint controlplane with production-like example values
      - helm lint charts/helix-controlplane -f charts/helix-controlplane/values-example.yaml
      - helm lint charts/helix-runner -f charts/helix-runner/values-example.yaml
      # Template render to catch runtime errors (missing helpers, bad references)
      - helm template test-release charts/helix-controlplane -f charts/helix-controlplane/values-example.yaml > /dev/null
      - helm template test-release charts/helix-runner -f charts/helix-runner/values-example.yaml > /dev/null
      - helm template test-release charts/helix-sandbox > /dev/null
      # Template with each sandbox values variant
      - helm template test-release charts/helix-sandbox -f charts/helix-sandbox/values-bare-metal.yaml > /dev/null
      - helm template test-release charts/helix-sandbox -f charts/helix-sandbox/values-eks.yaml > /dev/null
      - helm template test-release charts/helix-sandbox -f charts/helix-sandbox/values-gke.yaml > /dev/null
      - helm template test-release charts/helix-sandbox -f charts/helix-sandbox/values-aks.yaml > /dev/null
    when:
      event:
        - push
    depends_on: []

  - name: check-for-secrets
    image: ghcr.io/gitleaks/gitleaks:v8.24.0
    commands:
      - gitleaks dir -v
    when:
      event:
        - push
    depends_on: []

  - name: shell-script-tests
    image: alpine:3.21
    commands:
      - apk add --no-cache bash git
      - git config --global user.email "ci@helix.ml"
      - git config --global user.name "CI"
      - chmod +x ./desktop/shared/test-helix-specs-creation.sh
      - ./desktop/shared/test-helix-specs-creation.sh
    when:
      event:
        - push
    depends_on: []

  # Build API binary once for migrations and integration tests.
  # This avoids recompiling in each step that needs the binary.
  - name: build-api-binary
    image: golang:1.25-alpine
    volumes:
      - name: go-build-cache
        path: /root/.cache/go-build
      - name: go-mod-cache
        path: /go/pkg/mod
    commands:
      - apk add --no-cache gcc g++ musl-dev
      - CGO_ENABLED=1 go build -ldflags "-s -w" -o ./helix-bin ./api
    when:
      event:
        - push
    depends_on: [clone]

  # Run database migrations once before parallel test steps.
  # This prevents race conditions where multiple test steps try to create
  # ENUM types simultaneously, causing "duplicate key" constraint errors.
  - name: run-migrations
    image: golang:1.25-alpine
    environment:
      POSTGRES_HOST: postgres
      POSTGRES_PORT: "5432"
      POSTGRES_USER: postgres
      POSTGRES_PASSWORD: postgres
      POSTGRES_DATABASE: postgres
    commands:
      - ./helix-bin serve --migrate-only
    when:
      event:
        - push
    depends_on: [build-api-binary]

  - name: unit-test
    image: golang:1.25-alpine
    volumes:
      - name: go-build-cache
        path: /root/.cache/go-build
      - name: go-mod-cache
        path: /go/pkg/mod
    environment:
      # Reduce log noise in CI - suppress trace/debug logs that bloat output
      LOG_LEVEL: "warn"
      # Disabled until tested with togetherai
      DISABLE_AGENT_TESTS: "true"
      # Skip migrations - already run by run-migrations step
      HELIX_SKIP_AUTOMIGRATE: "1"
      GEMINI_API_KEY:
        from_secret: GEMINI_API_KEY
      OPENAI_API_KEY:
        from_secret: openai_tools
      TOGETHER_API_KEY:
        from_secret: openai_api_key
      TOGETHER_BASE_URL:
        from_secret: openai_base_url
      # TODO: reenable
      # CI_ADO_TOKEN:
      #   from_secret: ci_ado_token
      # CI_ADO_REPO:
      #   from_secret: ci_ado_repo
      # Database config (running in a sidecar)
      POSTGRES_HOST: postgres
      POSTGRES_PORT: "5432"
      POSTGRES_USER: postgres
      POSTGRES_PASSWORD: postgres
      POSTGRES_DATABASE: postgres
      TYPESENSE_URL: http://typesense:8108
      TYPESENSE_API_KEY: typesense
      TEXT_EXTRACTION_TIKA_URL: http://tika:9998
      RAG_CRAWLER_LAUNCHER_URL: http://chrome:7317

    commands:
      - apk add --no-cache gcc g++ musl-dev git
      - git config --global user.email "ci@helix.ml"
      - git config --global user.name "CI"
      - chmod +x ./scripts/run-tests-with-timeout.sh
      # Run tests excluding GStreamer-dependent packages (tested separately with CGO disabled)
      - go list ./api/... | grep -v '/desktop' | grep -v '/desktop-bridge' | xargs ./scripts/run-tests-with-timeout.sh -timeout 8m -v
    when:
      event:
        - push
    depends_on: [run-migrations]

  - name: unit-test-nocgo
    image: golang:1.25-alpine
    volumes:
      - name: go-build-cache
        path: /root/.cache/go-build
      - name: go-mod-cache
        path: /go/pkg/mod
    commands:
      - apk add --no-cache git
      # Test GStreamer-dependent packages with CGO disabled (uses stub implementations)
      - CGO_ENABLED=0 go test -timeout 5m -v ./api/pkg/desktop/... ./api/cmd/desktop-bridge/...
    when:
      event:
        - push
    depends_on: []

  - name: api-integration-test
    image: golang:1.25-alpine
    volumes:
      - name: go-build-cache
        path: /root/.cache/go-build
      - name: go-mod-cache
        path: /go/pkg/mod
    environment:
      # Reduce log noise in CI - suppress trace/debug logs that bloat output
      LOG_LEVEL: "warn"
      # Skip migrations - already run by run-migrations step
      HELIX_SKIP_AUTOMIGRATE: "1"
      OPENAI_API_KEY:
        from_secret: openai_tools
      TOGETHER_API_KEY:
        from_secret: openai_api_key
      TOGETHER_BASE_URL:
        from_secret: openai_base_url
      # Database config (running in a sidecar)
      POSTGRES_HOST: postgres
      POSTGRES_PORT: "5432"
      POSTGRES_USER: postgres
      POSTGRES_PASSWORD: postgres
      POSTGRES_DATABASE: postgres
      TYPESENSE_URL: http://typesense:8108
      TYPESENSE_API_KEY: typesense
      TEXT_EXTRACTION_TIKA_URL: http://tika:9998
      RAG_CRAWLER_LAUNCHER_URL: http://chrome:7317
      ORGANIZATIONS_CREATE_ENABLED_FOR_NON_ADMINS: "true"
      START_HELIX_TEST_SERVER: "true"
      # Agent configuration
      REASONING_MODEL_PROVIDER: openai
      REASONING_MODEL: o3-mini
      REASONING_MODEL_EFFORT: none
      GENERATION_MODEL_PROVIDER: openai
      GENERATION_MODEL: gpt-4o
      SMALL_REASONING_MODEL_PROVIDER: openai
      SMALL_REASONING_MODEL: o3-mini
      SMALL_REASONING_MODEL_EFFORT: none
      SMALL_GENERATION_MODEL_PROVIDER: openai
      SMALL_GENERATION_MODEL: gpt-4o-mini

    commands:
      - apk add --no-cache gcc g++ musl-dev git
      - git config --global user.email "ci@helix.ml"
      - git config --global user.name "CI"
      - chmod +x ./scripts/run-tests-with-timeout.sh
      # Use pre-built binary from build-api-binary step
      - mkdir -p $GOPATH/bin && cp ./helix-bin $GOPATH/bin/helix
      # Debug: verify binary was copied and test server startup
      - which helix && helix version
      - timeout 5 helix serve 2>&1 || echo "Server exited (expected - checking for startup errors)"
      # Run tests
      - pwd && ./scripts/run-tests-with-timeout.sh -timeout 8m -v ./integration-test/api/...
    when:
      event:
        - push
    depends_on: [run-migrations]

  # - name: oauth-github-integration-test
  #   image: golang:1.25
  #   volumes:
  #     - name: oauth-github-test-results
  #       path: /tmp/helix-oauth-test-results
  #     - name: go-build-cache
  #       path: /root/.cache/go-build
  #     - name: go-mod-cache
  #       path: /go/pkg/mod
  #   environment:
  #     # GitHub OAuth test credentials
  #     GITHUB_SKILL_TEST_OAUTH_CLIENT_ID:
  #       from_secret: github_skill_test_oauth_client_id
  #     GITHUB_SKILL_TEST_OAUTH_CLIENT_SECRET:
  #       from_secret: github_skill_test_oauth_client_secret
  #     GITHUB_SKILL_TEST_OAUTH_USERNAME:
  #       from_secret: github_skill_test_oauth_username
  #     GITHUB_SKILL_TEST_OAUTH_PASSWORD:
  #       from_secret: github_skill_test_oauth_password
  #     GITHUB_SKILL_TEST_SETUP_PAT:
  #       from_secret: github_skill_test_setup_pat
  #     GMAIL_CREDENTIALS_BASE64:
  #       from_secret: gmail_credentials_base64
  #     # Database config (running in a sidecar)
  #     POSTGRES_HOST: postgres
  #     POSTGRES_PORT: "5432"
  #     POSTGRES_USER: postgres
  #     POSTGRES_PASSWORD: postgres
  #     POSTGRES_DATABASE: postgres
  #     TYPESENSE_URL: http://typesense:8108
  #     TYPESENSE_API_KEY: typesense
  #     TEXT_EXTRACTION_TIKA_URL: http://tika:9998
  #     RAG_CRAWLER_LAUNCHER_URL: http://chrome:7317
  #     ORGANIZATIONS_CREATE_ENABLED_FOR_NON_ADMINS: "true"
  #     # CI-specific configuration for OAuth test
  #     WEB_SERVER_HOST: "localhost"
  #     # API Keys for LLM providers
  #     OPENAI_API_KEY:
  #       from_secret: openai_api_key
  #     ANTHROPIC_API_KEY:
  #       from_secret: anthropic_api_key
  #     # Agent configuration
  #     REASONING_MODEL_PROVIDER: openai
  #     REASONING_MODEL: o3-mini
  #     REASONING_MODEL_EFFORT: none
  #     GENERATION_MODEL_PROVIDER: openai
  #     GENERATION_MODEL: gpt-4o
  #     SMALL_REASONING_MODEL_PROVIDER: openai
  #     SMALL_REASONING_MODEL: o3-mini
  #     SMALL_REASONING_MODEL_EFFORT: none
  #     SMALL_GENERATION_MODEL_PROVIDER: openai
  #     SMALL_GENERATION_MODEL: gpt-4o-mini
  #   commands:
  #     - chmod +x ./scripts/run-oauth-integration-test.sh
  #     - ./scripts/run-oauth-integration-test.sh github TestGitHubOAuthSkillsE2E
  #   when:
  #     event:
  #       - push
  #   # depends_on: [unit-test]
  # - name: upload-oauth-github-test-artifacts
  #   image: golang:1.25
  #   volumes:
  #     - name: oauth-github-test-results
  #       path: /tmp/helix-oauth-test-results
  #   environment:
  #     LAUNCHPAD_URL: "https://deploy.helix.ml"
  #     CI_SHARED_SECRET:
  #       from_secret: ci_shared_secret
  #   commands:
  #     - chmod +x ./scripts/upload-oauth-test-artifacts.sh
  #     - ./scripts/upload-oauth-test-artifacts.sh github
  #   when:
  #     event:
  #       - push
  #     status:
  #       - success
  #       - failure
  #   depends_on: [oauth-github-integration-test]
  # - name: oauth-gmail-integration-test
  #   image: golang:1.25
  #   volumes:
  #   - name: oauth-gmail-test-results
  #     path: /tmp/helix-oauth-test-results
  #   - name: go-build-cache
  #     path: /root/.cache/go-build
  #   - name: go-mod-cache
  #     path: /go/pkg/mod
  #   environment:
  #     # Google OAuth test credentials
  #     GOOGLE_SKILL_TEST_OAUTH_CLIENT_ID:
  #       from_secret: google_skill_test_oauth_client_id
  #     GOOGLE_SKILL_TEST_OAUTH_CLIENT_SECRET:
  #       from_secret: google_skill_test_oauth_client_secret
  #     GOOGLE_SKILL_TEST_OAUTH_USERNAME:
  #       from_secret: google_skill_test_oauth_username
  #     GOOGLE_SKILL_TEST_OAUTH_PASSWORD:
  #       from_secret: google_skill_test_oauth_password
  #     # Gmail credentials for device verification
  #     GMAIL_CREDENTIALS_BASE64:
  #       from_secret: gmail_credentials_base64
  #     # Database config (running in a sidecar)
  #     POSTGRES_HOST: postgres
  #     POSTGRES_PORT: "5432"
  #     POSTGRES_USER: postgres
  #     POSTGRES_PASSWORD: postgres
  #     POSTGRES_DATABASE: postgres
  #     TYPESENSE_URL: http://typesense:8108
  #     TYPESENSE_API_KEY: typesense
  #     TEXT_EXTRACTION_TIKA_URL: http://tika:9998
  #     RAG_CRAWLER_LAUNCHER_URL: http://chrome:7317
  #     ORGANIZATIONS_CREATE_ENABLED_FOR_NON_ADMINS: "true"
  #     # CI-specific configuration for OAuth test
  #     WEB_SERVER_HOST: "localhost"
  #     # API Keys for LLM providers
  #     OPENAI_API_KEY:
  #       from_secret: openai_api_key
  #     ANTHROPIC_API_KEY:
  #       from_secret: anthropic_api_key
  #     # Agent configuration
  #     REASONING_MODEL_PROVIDER: openai
  #     REASONING_MODEL: o3-mini
  #     REASONING_MODEL_EFFORT: none
  #     GENERATION_MODEL_PROVIDER: openai
  #     GENERATION_MODEL: gpt-4o
  #     SMALL_REASONING_MODEL_PROVIDER: openai
  #     SMALL_REASONING_MODEL: o3-mini
  #     SMALL_REASONING_MODEL_EFFORT: none
  #     SMALL_GENERATION_MODEL_PROVIDER: openai
  #     SMALL_GENERATION_MODEL: gpt-4o-mini
  #   commands:
  #     - chmod +x scripts/run-oauth-integration-test.sh
  #     - ./scripts/run-oauth-integration-test.sh gmail TestGmailOAuthSkillsE2E
  #   when:
  #     event:
  #     - push
  #   # depends_on: [unit-test]
  # - name: upload-oauth-gmail-test-artifacts
  #   image: golang:1.25
  #   volumes:
  #   - name: oauth-gmail-test-results
  #     path: /tmp/helix-oauth-test-results
  #   environment:
  #     LAUNCHPAD_URL: "https://deploy.helix.ml"
  #     CI_SHARED_SECRET:
  #       from_secret: ci_shared_secret
  #   commands:
  #     - chmod +x scripts/upload-oauth-test-artifacts.sh
  #     - ./scripts/upload-oauth-test-artifacts.sh gmail
  #   when:
  #     event:
  #     - push
  #     status:
  #     - success
  #     - failure
  #   depends_on: [oauth-gmail-integration-test]
  # Outlook OAuth test disabled — Microsoft enforces MFA on the test account,
  # which can't be automated in headless CI. Same issue as Gmail/GitHub/Jira tests.
  # To re-enable: disable MFA on the test account in Azure AD, or switch to
  # client credentials flow (app-only auth, no user interaction).
  #
  # - name: oauth-outlook-integration-test
  #   image: golang:1.25
  #   volumes:
  #     - name: oauth-outlook-test-results
  #       path: /tmp/helix-oauth-test-results
  #     - name: go-build-cache
  #       path: /root/.cache/go-build
  #     - name: go-mod-cache
  #       path: /go/pkg/mod
  #   environment:
  #     HELIX_SKIP_AUTOMIGRATE: "1"
  #     MICROSOFT_SKILL_TEST_OAUTH_CLIENT_ID:
  #       from_secret: microsoft_skill_test_oauth_client_id
  #     MICROSOFT_SKILL_TEST_OAUTH_CLIENT_SECRET:
  #       from_secret: microsoft_skill_test_oauth_client_secret
  #     MICROSOFT_SKILL_TEST_OAUTH_USERNAME:
  #       from_secret: microsoft_skill_test_oauth_username
  #     MICROSOFT_SKILL_TEST_OAUTH_PASSWORD:
  #       from_secret: microsoft_skill_test_oauth_password
  #     POSTGRES_HOST: postgres
  #     POSTGRES_PORT: "5432"
  #     POSTGRES_USER: postgres
  #     POSTGRES_PASSWORD: postgres
  #     POSTGRES_DATABASE: postgres
  #     TYPESENSE_URL: http://typesense:8108
  #     TYPESENSE_API_KEY: typesense
  #     TEXT_EXTRACTION_TIKA_URL: http://tika:9998
  #     RAG_CRAWLER_LAUNCHER_URL: http://chrome:7317
  #     ORGANIZATIONS_CREATE_ENABLED_FOR_NON_ADMINS: "true"
  #     WEB_SERVER_HOST: "localhost"
  #     OPENAI_API_KEY:
  #       from_secret: openai_api_key
  #     ANTHROPIC_API_KEY:
  #       from_secret: anthropic_api_key
  #     REASONING_MODEL_PROVIDER: openai
  #     REASONING_MODEL: o3-mini
  #     REASONING_MODEL_EFFORT: none
  #     GENERATION_MODEL_PROVIDER: openai
  #     GENERATION_MODEL: gpt-4o
  #     SMALL_REASONING_MODEL_PROVIDER: openai
  #     SMALL_REASONING_MODEL: o3-mini
  #     SMALL_REASONING_MODEL_EFFORT: none
  #     SMALL_GENERATION_MODEL_PROVIDER: openai
  #     SMALL_GENERATION_MODEL: gpt-4o-mini
  #   commands:
  #     - apt-get update && apt-get install -y git && rm -rf /var/lib/apt/lists/*
  #     - git config --global user.email "ci@helix.ml"
  #     - git config --global user.name "CI"
  #     - chmod +x scripts/run-oauth-integration-test.sh
  #     - ./scripts/run-oauth-integration-test.sh outlook TestOutlookOAuthSkillsE2E
  #   when:
  #     event:
  #       - push
  #   depends_on: [run-migrations]
  #
  # - name: upload-oauth-outlook-test-artifacts
  #   image: golang:1.25
  #   volumes:
  #     - name: oauth-outlook-test-results
  #       path: /tmp/helix-oauth-test-results
  #   environment:
  #     LAUNCHPAD_URL: "https://deploy.helix.ml"
  #     CI_SHARED_SECRET:
  #       from_secret: ci_shared_secret
  #   commands:
  #     - chmod +x scripts/upload-oauth-test-artifacts.sh
  #     - ./scripts/upload-oauth-test-artifacts.sh outlook
  #   when:
  #     event:
  #       - push
  #     status:
  #       - success
  #       - failure
  #   depends_on: [oauth-outlook-integration-test]

  # - name: oauth-google-calendar-integration-test
  #   image: golang:1.25
  #   volumes:
  #   - name: oauth-google-calendar-test-results
  #     path: /tmp/helix-oauth-test-results
  #   - name: go-build-cache
  #     path: /root/.cache/go-build
  #   - name: go-mod-cache
  #     path: /go/pkg/mod
  #   environment:
  #     # Google OAuth test credentials
  #     GOOGLE_SKILL_TEST_OAUTH_CLIENT_ID:
  #       from_secret: google_skill_test_oauth_client_id
  #     GOOGLE_SKILL_TEST_OAUTH_CLIENT_SECRET:
  #       from_secret: google_skill_test_oauth_client_secret
  #     GOOGLE_SKILL_TEST_OAUTH_USERNAME:
  #       from_secret: google_skill_test_oauth_username
  #     GOOGLE_SKILL_TEST_OAUTH_PASSWORD:
  #       from_secret: google_skill_test_oauth_password
  #     # Gmail credentials for device verification
  #     GMAIL_CREDENTIALS_BASE64:
  #       from_secret: gmail_credentials_base64
  #     # Database config (running in a sidecar)
  #     POSTGRES_HOST: postgres
  #     POSTGRES_PORT: "5432"
  #     POSTGRES_USER: postgres
  #     POSTGRES_PASSWORD: postgres
  #     POSTGRES_DATABASE: postgres
  #     TYPESENSE_URL: http://typesense:8108
  #     TYPESENSE_API_KEY: typesense
  #     TEXT_EXTRACTION_TIKA_URL: http://tika:9998
  #     RAG_CRAWLER_LAUNCHER_URL: http://chrome:7317
  #     ORGANIZATIONS_CREATE_ENABLED_FOR_NON_ADMINS: "true"
  #     # CI-specific configuration for OAuth test
  #     WEB_SERVER_HOST: "localhost"
  #     # API Keys for LLM providers
  #     OPENAI_API_KEY:
  #       from_secret: openai_api_key
  #     ANTHROPIC_API_KEY:
  #       from_secret: anthropic_api_key
  #     # Agent configuration
  #     REASONING_MODEL_PROVIDER: openai
  #     REASONING_MODEL: o3-mini
  #     REASONING_MODEL_EFFORT: none
  #     GENERATION_MODEL_PROVIDER: openai
  #     GENERATION_MODEL: gpt-4o
  #     SMALL_REASONING_MODEL_PROVIDER: openai
  #     SMALL_REASONING_MODEL: o3-mini
  #     SMALL_REASONING_MODEL_EFFORT: none
  #     SMALL_GENERATION_MODEL_PROVIDER: openai
  #     SMALL_GENERATION_MODEL: gpt-4o-mini

  #   commands:
  #     - chmod +x ./scripts/run-oauth-integration-test.sh
  #     - ./scripts/run-oauth-integration-test.sh google-calendar TestGoogleCalendarOAuthSkillsE2E
  #   when:
  #     event:
  #     - push
  #   # depends_on: [unit-test]

  # - name: upload-oauth-google-calendar-test-artifacts
  #   image: golang:1.25
  #   volumes:
  #   - name: oauth-google-calendar-test-results
  #     path: /tmp/helix-oauth-test-results
  #   environment:
  #     LAUNCHPAD_URL: "https://deploy.helix.ml"
  #     CI_SHARED_SECRET:
  #       from_secret: ci_shared_secret
  #   commands:
  #     - chmod +x ./scripts/upload-oauth-test-artifacts.sh
  #     - ./scripts/upload-oauth-test-artifacts.sh google-calendar
  #   when:
  #     event:
  #     - push
  #     status:
  #     - success
  #     - failure
  #   depends_on: [oauth-google-calendar-integration-test]

  # - name: oauth-jira-integration-test
  #   image: golang:1.25
  #   volumes:
  #   - name: oauth-jira-test-results
  #     path: /tmp/helix-oauth-test-results
  #   - name: go-build-cache
  #     path: /root/.cache/go-build
  #   - name: go-mod-cache
  #     path: /go/pkg/mod
  #   environment:
  #     # Atlassian OAuth test credentials
  #     ATLASSIAN_SKILL_TEST_OAUTH_CLIENT_ID:
  #       from_secret: atlassian_skill_test_oauth_client_id
  #     ATLASSIAN_SKILL_TEST_OAUTH_CLIENT_SECRET:
  #       from_secret: atlassian_skill_test_oauth_client_secret
  #     ATLASSIAN_SKILL_TEST_OAUTH_USERNAME:
  #       from_secret: atlassian_skill_test_oauth_username
  #     ATLASSIAN_SKILL_TEST_OAUTH_PASSWORD:
  #       from_secret: atlassian_skill_test_oauth_password
  #     ATLASSIAN_SKILL_TEST_JIRA_CLOUD_ID:
  #       from_secret: atlassian_skill_test_jira_cloud_id
  #     # Gmail credentials for MFA handling
  #     GMAIL_CREDENTIALS_BASE64:
  #       from_secret: gmail_credentials_base64
  #     # Database config (running in a sidecar)
  #     POSTGRES_HOST: postgres
  #     POSTGRES_PORT: "5432"
  #     POSTGRES_USER: postgres
  #     POSTGRES_PASSWORD: postgres
  #     POSTGRES_DATABASE: postgres
  #     TYPESENSE_URL: http://typesense:8108
  #     TYPESENSE_API_KEY: typesense
  #     TEXT_EXTRACTION_TIKA_URL: http://tika:9998
  #     RAG_CRAWLER_LAUNCHER_URL: http://chrome:7317
  #     ORGANIZATIONS_CREATE_ENABLED_FOR_NON_ADMINS: "true"
  #     # CI-specific configuration for OAuth test
  #     WEB_SERVER_HOST: "localhost"
  #     # API Keys for LLM providers
  #     OPENAI_API_KEY:
  #       from_secret: openai_api_key
  #     ANTHROPIC_API_KEY:
  #       from_secret: anthropic_api_key
  #     # Agent configuration
  #     REASONING_MODEL_PROVIDER: openai
  #     REASONING_MODEL: o3-mini
  #     REASONING_MODEL_EFFORT: none
  #     GENERATION_MODEL_PROVIDER: openai
  #     GENERATION_MODEL: gpt-4o
  #     SMALL_REASONING_MODEL_PROVIDER: openai
  #     SMALL_REASONING_MODEL: o3-mini
  #     SMALL_REASONING_MODEL_EFFORT: none
  #     SMALL_GENERATION_MODEL_PROVIDER: openai
  #     SMALL_GENERATION_MODEL: gpt-4o-mini

  #   commands:
  #     - chmod +x ./scripts/run-oauth-integration-test.sh
  #     - echo "=== Environment Variable Check ==="
  #     - echo "GMAIL_CREDENTIALS_BASE64 length:" $(echo -n "${GMAIL_CREDENTIALS_BASE64}" | wc -c)
  #     - echo "ATLASSIAN_SKILL_TEST_OAUTH_CLIENT_ID is set:" $(test -n "${ATLASSIAN_SKILL_TEST_OAUTH_CLIENT_ID}" && echo "YES" || echo "NO")
  #     - echo "ATLASSIAN_SKILL_TEST_OAUTH_USERNAME is set:" $(test -n "${ATLASSIAN_SKILL_TEST_OAUTH_USERNAME}" && echo "YES" || echo "NO")
  #     - echo "ATLASSIAN_SKILL_TEST_JIRA_CLOUD_ID is set:" $(test -n "${ATLASSIAN_SKILL_TEST_JIRA_CLOUD_ID}" && echo "YES" || echo "NO")
  #     - echo "=== Starting Jira OAuth Test ==="
  #     - ./scripts/run-oauth-integration-test.sh jira TestJiraOAuthSkillsE2E
  #   when:
  #     event:
  #     - push
  #   # depends_on: [unit-test]

  # - name: upload-oauth-jira-test-artifacts
  #   image: golang:1.25
  #   volumes:
  #   - name: oauth-jira-test-results
  #     path: /tmp/helix-oauth-test-results
  #   environment:
  #     LAUNCHPAD_URL: "https://deploy.helix.ml"
  #     CI_SHARED_SECRET:
  #       from_secret: ci_shared_secret
  #   commands:
  #     - chmod +x ./scripts/upload-oauth-test-artifacts.sh
  #     - ./scripts/upload-oauth-test-artifacts.sh jira
  #   when:
  #     event:
  #     - push
  #     status:
  #     - success
  #     - failure
  #   depends_on: [oauth-jira-integration-test]

  # - name: oauth-confluence-integration-test
  #   image: golang:1.25
  #   volumes:
  #   - name: oauth-confluence-test-results
  #     path: /tmp/helix-oauth-test-results
  #   - name: go-build-cache
  #     path: /root/.cache/go-build
  #   - name: go-mod-cache
  #     path: /go/pkg/mod
  #   environment:
  #     # Atlassian OAuth test credentials
  #     ATLASSIAN_SKILL_TEST_OAUTH_CLIENT_ID:
  #       from_secret: atlassian_skill_test_oauth_client_id
  #     ATLASSIAN_SKILL_TEST_OAUTH_CLIENT_SECRET:
  #       from_secret: atlassian_skill_test_oauth_client_secret
  #     ATLASSIAN_SKILL_TEST_OAUTH_USERNAME:
  #       from_secret: atlassian_skill_test_oauth_username
  #     ATLASSIAN_SKILL_TEST_OAUTH_PASSWORD:
  #       from_secret: atlassian_skill_test_oauth_password
  #     ATLASSIAN_SKILL_TEST_CONFLUENCE_CLOUD_ID:
  #       from_secret: atlassian_skill_test_confluence_cloud_id
  #     # Gmail credentials for MFA handling
  #     GMAIL_CREDENTIALS_BASE64:
  #       from_secret: gmail_credentials_base64
  #     # Database config (running in a sidecar)
  #     POSTGRES_HOST: postgres
  #     POSTGRES_PORT: "5432"
  #     POSTGRES_USER: postgres
  #     POSTGRES_PASSWORD: postgres
  #     POSTGRES_DATABASE: postgres
  #     TYPESENSE_URL: http://typesense:8108
  #     TYPESENSE_API_KEY: typesense
  #     TEXT_EXTRACTION_TIKA_URL: http://tika:9998
  #     RAG_CRAWLER_LAUNCHER_URL: http://chrome:7317
  #     ORGANIZATIONS_CREATE_ENABLED_FOR_NON_ADMINS: "true"
  #     # CI-specific configuration for OAuth test
  #     WEB_SERVER_HOST: "localhost"
  #     # API Keys for LLM providers
  #     OPENAI_API_KEY:
  #       from_secret: openai_api_key
  #     ANTHROPIC_API_KEY:
  #       from_secret: anthropic_api_key
  #     # Agent configuration
  #     REASONING_MODEL_PROVIDER: openai
  #     REASONING_MODEL: o3-mini
  #     REASONING_MODEL_EFFORT: none
  #     GENERATION_MODEL_PROVIDER: openai
  #     GENERATION_MODEL: gpt-4o
  #     SMALL_REASONING_MODEL_PROVIDER: openai
  #     SMALL_REASONING_MODEL: o3-mini
  #     SMALL_REASONING_MODEL_EFFORT: none
  #     SMALL_GENERATION_MODEL_PROVIDER: openai
  #     SMALL_GENERATION_MODEL: gpt-4o-mini

  #   commands:
  #     - chmod +x ./scripts/run-oauth-integration-test.sh
  #     - echo "=== Environment Variable Check ==="
  #     - echo "GMAIL_CREDENTIALS_BASE64 length:" $(echo -n "${GMAIL_CREDENTIALS_BASE64}" | wc -c)
  #     - echo "ATLASSIAN_SKILL_TEST_OAUTH_CLIENT_ID is set:" $(test -n "${ATLASSIAN_SKILL_TEST_OAUTH_CLIENT_ID}" && echo "YES" || echo "NO")
  #     - echo "ATLASSIAN_SKILL_TEST_OAUTH_USERNAME is set:" $(test -n "${ATLASSIAN_SKILL_TEST_OAUTH_USERNAME}" && echo "YES" || echo "NO")
  #     - echo "ATLASSIAN_SKILL_TEST_CONFLUENCE_CLOUD_ID is set:" $(test -n "${ATLASSIAN_SKILL_TEST_CONFLUENCE_CLOUD_ID}" && echo "YES" || echo "NO")
  #     - echo "=== Starting Confluence OAuth Test ==="
  #     - ./scripts/run-oauth-integration-test.sh confluence TestConfluenceOAuthSkillsE2E
  #   when:
  #     event:
  #     - push
  #   # depends_on: [unit-test]

  # - name: upload-oauth-confluence-test-artifacts
  #   image: golang:1.25
  #   volumes:
  #   - name: oauth-confluence-test-results
  #     path: /tmp/helix-oauth-test-results
  #   environment:
  #     LAUNCHPAD_URL: "https://deploy.helix.ml"
  #     CI_SHARED_SECRET:
  #       from_secret: ci_shared_secret
  #   commands:
  #     - chmod +x ./scripts/upload-oauth-test-artifacts.sh
  #     - ./scripts/upload-oauth-test-artifacts.sh confluence
  #   when:
  #     event:
  #     - push
  #     status:
  #     - success
  #     - failure
  #   depends_on: [oauth-confluence-integration-test]

  - name: release-backend
    image: golang:1.25-bookworm
    volumes:
      - name: go-build-cache
        path: /root/.cache/go-build
      - name: go-mod-cache
        path: /go/pkg/mod
    when:
      event:
        - tag
    environment:
      GITHUB_TOKEN:
        from_secret: github_token
    commands:
      - |
        if [ -n "$DRONE_TAG" ]; then
          VERSION_FLAG="-X github.com/helixml/helix/api/pkg/data.Version=$DRONE_TAG"
        else
          VERSION_FLAG=""
        fi
        # Build CLI binary (nokodit tag excludes kodit CGO dependencies) for all platforms
        for target in linux/amd64 linux/arm64 darwin/amd64 darwin/arm64 windows/amd64; do
          os=$(echo "$target" | cut -d/ -f1)
          arch=$(echo "$target" | cut -d/ -f2)
          ext=""; [ "$os" = "windows" ] && ext=".exe"
          echo "Building helix-$os-$arch$ext"
          CGO_ENABLED=0 GOOS="$os" GOARCH="$arch" go build -tags nokodit -ldflags "-w -s $VERSION_FLAG" -o "helix-$os-$arch$ext" .
        done
      - ./helix-linux-amd64 version
      - apt-get update && apt-get install -y curl
      - curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg | dd of=/usr/share/keyrings/githubcli-archive-keyring.gpg
      - echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/githubcli-archive-keyring.gpg] https://cli.github.com/packages stable main" | tee /etc/apt/sources.list.d/github-cli.list > /dev/null
      - apt-get update && apt-get install -y gh
      - sed -i "s/\${HELIX_VERSION:-latest}/$DRONE_TAG/g" docker-compose.yaml
      - |
        if [ -n "$DRONE_TAG" ]; then
          # Look for either exact match or tag followed by space and description
          RELEASE=$(gh release list | awk -v tag="$DRONE_TAG" '$1 == tag || $1 ~ "^"tag" " {print $1; exit}')
          if [ -n "$RELEASE" ]; then
            echo "Uploading helix binaries, installer, and docker-compose.yaml to release $RELEASE"
            gh release upload --clobber "$RELEASE" helix-linux-amd64 helix-linux-arm64 helix-darwin-amd64 helix-darwin-arm64 helix-windows-amd64.exe docker-compose.yaml
          else
            echo "No matching release found for tag $DRONE_TAG"
          fi
        else
          echo "No tag present, skipping release upload"
        fi
    depends_on: [build-backend, build-frontend]

  - name: build-operator
    image: golang:1.25-alpine
    volumes:
      - name: go-build-cache
        path: /root/.cache/go-build
      - name: go-mod-cache
        path: /go/pkg/mod
    environment:
      GITHUB_TOKEN:
        from_secret: github_token
    commands:
      - cd operator && go mod tidy && go build ./...
    depends_on: []

  - name: run-linter-operator
    image: golangci/golangci-lint:v2.8.0-alpine
    volumes:
      - name: go-build-cache
        path: /root/.cache/go-build
      - name: go-mod-cache
        path: /go/pkg/mod
    commands:
      - cd operator && go mod tidy && golangci-lint run ./...
    when:
      event:
        - push
    depends_on: []

services:
  - name: postgres
    image: postgres:12.13-alpine
    environment:
      POSTGRES_USER: postgres
      POSTGRES_PASSWORD: postgres
      POSTGRES_DB: postgres
  - name: typesense
    image: typesense/typesense:27.0
    command: ["--data-dir", "/tmp", "--api-key", "typesense"]
  - name: tika
    image: apache/tika:2.9.2.1
  - name: chrome
    image: ghcr.io/go-rod/rod:v0.115.0
  - name: pgvector
    image: pgvector/pgvector:pg17
    environment:
      POSTGRES_USER: postgres
      POSTGRES_PASSWORD: postgres
      POSTGRES_DB: postgres

volumes:
  - name: oauth-github-test-results
    temp: {}
  - name: oauth-gmail-test-results
    temp: {}
  - name: oauth-outlook-test-results
    temp: {}
  - name: oauth-google-calendar-test-results
    temp: {}
  - name: oauth-jira-test-results
    temp: {}
  - name: oauth-confluence-test-results
    temp: {}
  - name: go-build-cache
    host:
      path: /var/cache/drone/go-build
  - name: go-mod-cache
    host:
      path: /var/cache/drone/go-mod
  - name: yarn-cache
    host:
      path: /var/cache/drone/yarn
  - name: node-modules-cache
    host:
      path: /var/cache/drone/node_modules
---
kind: pipeline
type: docker
name: build-controlplane-amd64

platform:
  os: linux
  arch: amd64

trigger:
  ref:
    include:
      - refs/heads/main
      - refs/tags/*

volumes:
  - name: dockersocket
    host:
      path: /var/run/docker.sock

steps:
  - name: publish-image
    image: docker:cli
    commands:
      - |
        if [ -n "${DRONE_TAG}" ]; then
          VERSION="${DRONE_TAG}"
        else
          VERSION=$$(echo ${DRONE_COMMIT_SHA} | head -c 7)
        fi
        echo "Building controlplane:$${VERSION}-linux-amd64"
        docker build --pull --provenance=false \
          -f Dockerfile \
          --build-arg APP_VERSION=${DRONE_TAG:-${DRONE_COMMIT_SHA:-latest}} \
          -t registry.helixml.tech/helix/controlplane:$${VERSION}-linux-amd64 \
          .
        echo "$${REGISTRY_PASSWORD}" | docker login registry.helixml.tech -u admin --password-stdin
        docker push registry.helixml.tech/helix/controlplane:$${VERSION}-linux-amd64
        scripts/ghcr-push.sh registry.helixml.tech/helix/controlplane:$${VERSION}-linux-amd64
    environment:
      REGISTRY_PASSWORD:
        from_secret: helix_registry_password
      GITHUB_TOKEN:
        from_secret: github_token
    volumes:
      - name: dockersocket
        path: /var/run/docker.sock

---
kind: pipeline
type: docker
name: build-controlplane-arm64

platform:
  os: linux
  arch: arm64

trigger:
  ref:
    include:
      - refs/heads/main
      - refs/tags/*

volumes:
  - name: dockersocket
    host:
      path: /var/run/docker.sock

steps:
  - name: publish-image
    image: docker:cli
    environment:
      REGISTRY_PASSWORD:
        from_secret: helix_registry_password
      GITHUB_TOKEN:
        from_secret: github_token
    commands:
      - echo "$${REGISTRY_PASSWORD}" | docker login registry.helixml.tech -u admin --password-stdin
      - |
        if [ -n "${DRONE_TAG}" ]; then
          VERSION="${DRONE_TAG}"
        else
          VERSION=$$(echo ${DRONE_COMMIT_SHA} | head -c 7)
        fi
        docker build --pull --provenance=false \
          -f Dockerfile \
          --build-arg APP_VERSION=${DRONE_TAG:-${DRONE_COMMIT_SHA:-latest}} \
          -t registry.helixml.tech/helix/controlplane:$${VERSION}-linux-arm64 \
          .
        docker push registry.helixml.tech/helix/controlplane:$${VERSION}-linux-arm64
        scripts/ghcr-push.sh registry.helixml.tech/helix/controlplane:$${VERSION}-linux-arm64
    volumes:
      - name: dockersocket
        path: /var/run/docker.sock

---
kind: pipeline
type: docker
name: manifest-controlplane

depends_on:
  - build-controlplane-amd64
  - build-controlplane-arm64

trigger:
  ref:
    include:
      - refs/heads/main
      - refs/tags/*

volumes:
  - name: dockersocket
    host:
      path: /var/run/docker.sock

steps:
  - name: manifest
    image: docker:cli
    environment:
      REGISTRY_PASSWORD:
        from_secret: helix_registry_password
      GITHUB_TOKEN:
        from_secret: github_token
    commands:
      - echo "$${REGISTRY_PASSWORD}" | docker login registry.helixml.tech -u admin --password-stdin
      - |
        if [ -n "${DRONE_TAG}" ]; then
          VERSION="${DRONE_TAG}"
        else
          VERSION=$$(echo ${DRONE_COMMIT_SHA} | head -c 7)
        fi
        REPO="registry.helixml.tech/helix/controlplane"
        docker manifest create --amend $${REPO}:$${VERSION} \
          $${REPO}:$${VERSION}-linux-amd64 \
          $${REPO}:$${VERSION}-linux-arm64
        docker manifest push $${REPO}:$${VERSION}
        echo "Multi-arch manifest pushed: $${REPO}:$${VERSION}"
        scripts/ghcr-manifest.sh $${REPO} $${VERSION}
    volumes:
      - name: dockersocket
        path: /var/run/docker.sock

---
kind: pipeline
type: docker
name: build-haystack-amd64

platform:
  os: linux
  arch: amd64

trigger:
  ref:
    include:
      - refs/heads/main
      - refs/tags/*

volumes:
  - name: dockersocket
    host:
      path: /var/run/docker.sock

steps:
  - name: publish-image
    image: docker:cli
    commands:
      - |
        if [ -n "${DRONE_TAG}" ]; then
          VERSION="${DRONE_TAG}"
        else
          VERSION=$$(echo ${DRONE_COMMIT_SHA} | head -c 7)
        fi
        echo "Building haystack:$${VERSION}-linux-amd64"
        docker build --pull --provenance=false \
          -f haystack_service/Dockerfile \
          --build-arg APP_VERSION=${DRONE_TAG:-${DRONE_COMMIT_SHA:-latest}} \
          -t registry.helixml.tech/helix/haystack:$${VERSION}-linux-amd64 \
          haystack_service
        echo "$${REGISTRY_PASSWORD}" | docker login registry.helixml.tech -u admin --password-stdin
        docker push registry.helixml.tech/helix/haystack:$${VERSION}-linux-amd64
        scripts/ghcr-push.sh registry.helixml.tech/helix/haystack:$${VERSION}-linux-amd64
    environment:
      REGISTRY_PASSWORD:
        from_secret: helix_registry_password
      GITHUB_TOKEN:
        from_secret: github_token
    volumes:
      - name: dockersocket
        path: /var/run/docker.sock

---
kind: pipeline
type: docker
name: build-haystack-arm64

platform:
  os: linux
  arch: arm64

trigger:
  ref:
    include:
      - refs/heads/main
      - refs/tags/*

volumes:
  - name: dockersocket
    host:
      path: /var/run/docker.sock

steps:
  - name: publish-image
    image: docker:cli
    environment:
      REGISTRY_PASSWORD:
        from_secret: helix_registry_password
      GITHUB_TOKEN:
        from_secret: github_token
    commands:
      - echo "$${REGISTRY_PASSWORD}" | docker login registry.helixml.tech -u admin --password-stdin
      - |
        if [ -n "${DRONE_TAG}" ]; then
          VERSION="${DRONE_TAG}"
        else
          VERSION=$$(echo ${DRONE_COMMIT_SHA} | head -c 7)
        fi
        docker build --pull --provenance=false \
          -f haystack_service/Dockerfile \
          --build-arg APP_VERSION=${DRONE_TAG:-${DRONE_COMMIT_SHA:-latest}} \
          -t registry.helixml.tech/helix/haystack:$${VERSION}-linux-arm64 \
          haystack_service
        docker push registry.helixml.tech/helix/haystack:$${VERSION}-linux-arm64
        scripts/ghcr-push.sh registry.helixml.tech/helix/haystack:$${VERSION}-linux-arm64
    volumes:
      - name: dockersocket
        path: /var/run/docker.sock

---
kind: pipeline
type: docker
name: manifest-haystack

depends_on:
  - build-haystack-amd64
  - build-haystack-arm64

trigger:
  ref:
    include:
      - refs/heads/main
      - refs/tags/*

volumes:
  - name: dockersocket
    host:
      path: /var/run/docker.sock

steps:
  - name: manifest
    image: docker:cli
    environment:
      REGISTRY_PASSWORD:
        from_secret: helix_registry_password
      GITHUB_TOKEN:
        from_secret: github_token
    commands:
      - echo "$${REGISTRY_PASSWORD}" | docker login registry.helixml.tech -u admin --password-stdin
      - |
        if [ -n "${DRONE_TAG}" ]; then
          VERSION="${DRONE_TAG}"
        else
          VERSION=$$(echo ${DRONE_COMMIT_SHA} | head -c 7)
        fi
        REPO="registry.helixml.tech/helix/haystack"
        docker manifest create --amend $${REPO}:$${VERSION} \
          $${REPO}:$${VERSION}-linux-amd64 \
          $${REPO}:$${VERSION}-linux-arm64
        docker manifest push $${REPO}:$${VERSION}
        echo "Multi-arch manifest pushed: $${REPO}:$${VERSION}"
        scripts/ghcr-manifest.sh $${REPO} $${VERSION}
    volumes:
      - name: dockersocket
        path: /var/run/docker.sock

---
kind: pipeline
type: docker
name: build-runner

trigger:
  ref:
    include:
      - refs/heads/main
      - refs/tags/*

volumes:
  - name: dockersocket
    host:
      path: /var/run/docker.sock

steps:
  # Retag 2.7.12 runner images instead of rebuilding.
  # All runner tags after 2.7.12 are identical to 2.7.12.
  - name: retag-runner
    image: docker
    volumes:
      - name: dockersocket
        path: /var/run/docker.sock
    environment:
      REGISTRY_PASSWORD:
        from_secret: helix_registry_password
      GITHUB_TOKEN:
        from_secret: github_token
    commands:
      - docker login registry.helixml.tech -u admin -p "$REGISTRY_PASSWORD"
      - docker pull registry.helixml.tech/helix/runner:2.7.12
      - |
        if [ -n "$DRONE_TAG" ]; then
          docker tag registry.helixml.tech/helix/runner:2.7.12 registry.helixml.tech/helix/runner:$DRONE_TAG
          docker push registry.helixml.tech/helix/runner:$DRONE_TAG
          scripts/ghcr-push.sh registry.helixml.tech/helix/runner:$DRONE_TAG
        fi
      - docker tag registry.helixml.tech/helix/runner:2.7.12 registry.helixml.tech/helix/runner:latest
      - docker push registry.helixml.tech/helix/runner:latest
      - scripts/ghcr-push.sh registry.helixml.tech/helix/runner:latest
    when:
      ref:
        include:
          - refs/heads/main
          - refs/tags/*

---
kind: pipeline
type: docker
name: build-runner-small

trigger:
  ref:
    include:
      - refs/heads/main
      - refs/tags/*

volumes:
  - name: dockersocket
    host:
      path: /var/run/docker.sock

steps:
  # Retag 2.7.12-small runner images instead of rebuilding.
  - name: retag-runner
    image: docker
    volumes:
      - name: dockersocket
        path: /var/run/docker.sock
    environment:
      REGISTRY_PASSWORD:
        from_secret: helix_registry_password
      GITHUB_TOKEN:
        from_secret: github_token
    commands:
      - docker login registry.helixml.tech -u admin -p "$REGISTRY_PASSWORD"
      - docker pull registry.helixml.tech/helix/runner:2.7.12-small
      - |
        if [ -n "$DRONE_TAG" ]; then
          docker tag registry.helixml.tech/helix/runner:2.7.12-small registry.helixml.tech/helix/runner:${DRONE_TAG}-small
          docker push registry.helixml.tech/helix/runner:${DRONE_TAG}-small
          scripts/ghcr-push.sh registry.helixml.tech/helix/runner:${DRONE_TAG}-small
        fi
      - docker tag registry.helixml.tech/helix/runner:2.7.12-small registry.helixml.tech/helix/runner:latest-small
      - docker push registry.helixml.tech/helix/runner:latest-small
      - scripts/ghcr-push.sh registry.helixml.tech/helix/runner:latest-small
    when:
      ref:
        include:
          - refs/heads/main
          - refs/tags/*

  - name: retag-runner-branch
    image: docker
    volumes:
      - name: dockersocket
        path: /var/run/docker.sock
    environment:
      REGISTRY_PASSWORD:
        from_secret: helix_registry_password
      GITHUB_TOKEN:
        from_secret: github_token
    commands:
      - docker login registry.helixml.tech -u admin -p "$REGISTRY_PASSWORD"
      - docker pull registry.helixml.tech/helix/runner:2.7.12-small
      - docker tag registry.helixml.tech/helix/runner:2.7.12-small registry.helixml.tech/helix/runner:${DRONE_COMMIT_SHA}-small
      - docker push registry.helixml.tech/helix/runner:${DRONE_COMMIT_SHA}-small
      - scripts/ghcr-push.sh registry.helixml.tech/helix/runner:${DRONE_COMMIT_SHA}-small
    when:
      branch:
        exclude:
          - main

---
kind: pipeline
type: docker
name: build-runner-large

trigger:
  ref:
    include:
      - refs/heads/main
      - refs/tags/*

volumes:
  - name: dockersocket
    host:
      path: /var/run/docker.sock

steps:
  # Retag 2.7.12-large runner images instead of rebuilding.
  - name: retag-runner
    image: docker
    volumes:
      - name: dockersocket
        path: /var/run/docker.sock
    environment:
      REGISTRY_PASSWORD:
        from_secret: helix_registry_password
      GITHUB_TOKEN:
        from_secret: github_token
    commands:
      - docker login registry.helixml.tech -u admin -p "$REGISTRY_PASSWORD"
      - docker pull registry.helixml.tech/helix/runner:2.7.12-large
      - |
        if [ -n "$DRONE_TAG" ]; then
          docker tag registry.helixml.tech/helix/runner:2.7.12-large registry.helixml.tech/helix/runner:${DRONE_TAG}-large
          docker push registry.helixml.tech/helix/runner:${DRONE_TAG}-large
          scripts/ghcr-push.sh registry.helixml.tech/helix/runner:${DRONE_TAG}-large
        fi
      - docker tag registry.helixml.tech/helix/runner:2.7.12-large registry.helixml.tech/helix/runner:latest-large
      - docker push registry.helixml.tech/helix/runner:latest-large
      - scripts/ghcr-push.sh registry.helixml.tech/helix/runner:latest-large
    when:
      ref:
        include:
          - refs/heads/main
          - refs/tags/*

  - name: retag-runner-branch
    image: docker
    volumes:
      - name: dockersocket
        path: /var/run/docker.sock
    environment:
      REGISTRY_PASSWORD:
        from_secret: helix_registry_password
      GITHUB_TOKEN:
        from_secret: github_token
    commands:
      - docker login registry.helixml.tech -u admin -p "$REGISTRY_PASSWORD"
      - docker pull registry.helixml.tech/helix/runner:2.7.12-large
      - docker tag registry.helixml.tech/helix/runner:2.7.12-large registry.helixml.tech/helix/runner:${DRONE_COMMIT_SHA}-large
      - docker push registry.helixml.tech/helix/runner:${DRONE_COMMIT_SHA}-large
      - scripts/ghcr-push.sh registry.helixml.tech/helix/runner:${DRONE_COMMIT_SHA}-large
    when:
      branch:
        exclude:
          - main

---
kind: pipeline
type: docker
name: build-typesense-amd64

platform:
  os: linux
  arch: amd64

trigger:
  ref:
    include:
      - refs/heads/main
      - refs/tags/*

volumes:
  - name: dockersocket
    host:
      path: /var/run/docker.sock

steps:
  - name: publish-typesense
    image: docker:cli
    commands:
      - |
        if [ -n "${DRONE_TAG}" ]; then
          VERSION="${DRONE_TAG}"
        else
          VERSION=$$(echo ${DRONE_COMMIT_SHA} | head -c 7)
        fi
        echo "Building typesense:$${VERSION}-linux-amd64"
        docker build --pull --provenance=false \
          -f Dockerfile.typesense \
          -t registry.helixml.tech/helix/typesense:$${VERSION}-linux-amd64 \
          .
        echo "$${REGISTRY_PASSWORD}" | docker login registry.helixml.tech -u admin --password-stdin
        docker push registry.helixml.tech/helix/typesense:$${VERSION}-linux-amd64
        scripts/ghcr-push.sh registry.helixml.tech/helix/typesense:$${VERSION}-linux-amd64
    environment:
      REGISTRY_PASSWORD:
        from_secret: helix_registry_password
      GITHUB_TOKEN:
        from_secret: github_token
    volumes:
      - name: dockersocket
        path: /var/run/docker.sock

---
kind: pipeline
type: docker
name: build-typesense-arm64

platform:
  os: linux
  arch: arm64

trigger:
  ref:
    include:
      - refs/heads/main
      - refs/tags/*

volumes:
  - name: dockersocket
    host:
      path: /var/run/docker.sock

steps:
  - name: publish-typesense
    image: docker:cli
    environment:
      REGISTRY_PASSWORD:
        from_secret: helix_registry_password
      GITHUB_TOKEN:
        from_secret: github_token
    commands:
      - echo "$${REGISTRY_PASSWORD}" | docker login registry.helixml.tech -u admin --password-stdin
      - |
        if [ -n "${DRONE_TAG}" ]; then
          VERSION="${DRONE_TAG}"
        else
          VERSION=$$(echo ${DRONE_COMMIT_SHA} | head -c 7)
        fi
        docker build --pull --provenance=false \
          -f Dockerfile.typesense \
          -t registry.helixml.tech/helix/typesense:$${VERSION}-linux-arm64 \
          .
        docker push registry.helixml.tech/helix/typesense:$${VERSION}-linux-arm64
        scripts/ghcr-push.sh registry.helixml.tech/helix/typesense:$${VERSION}-linux-arm64
    volumes:
      - name: dockersocket
        path: /var/run/docker.sock

---
kind: pipeline
type: docker
name: manifest-typesense

depends_on:
  - build-typesense-amd64
  - build-typesense-arm64

trigger:
  ref:
    include:
      - refs/heads/main
      - refs/tags/*

volumes:
  - name: dockersocket
    host:
      path: /var/run/docker.sock

steps:
  - name: manifest
    image: docker:cli
    environment:
      REGISTRY_PASSWORD:
        from_secret: helix_registry_password
      GITHUB_TOKEN:
        from_secret: github_token
    commands:
      - echo "$${REGISTRY_PASSWORD}" | docker login registry.helixml.tech -u admin --password-stdin
      - |
        if [ -n "${DRONE_TAG}" ]; then
          VERSION="${DRONE_TAG}"
        else
          VERSION=$$(echo ${DRONE_COMMIT_SHA} | head -c 7)
        fi
        REPO="registry.helixml.tech/helix/typesense"
        docker manifest create --amend $${REPO}:$${VERSION} \
          $${REPO}:$${VERSION}-linux-amd64 \
          $${REPO}:$${VERSION}-linux-arm64
        docker manifest push $${REPO}:$${VERSION}
        echo "Multi-arch manifest pushed: $${REPO}:$${VERSION}"
        scripts/ghcr-manifest.sh $${REPO} $${VERSION}
    volumes:
      - name: dockersocket
        path: /var/run/docker.sock

---
kind: pipeline
type: docker
name: build-demos

trigger:
  ref:
    include:
      - refs/heads/main
      - refs/tags/*

volumes:
  - name: dockersocket
    host:
      path: /var/run/docker.sock

steps:
  - name: publish-demos
    image: plugins/docker
    pull: always
    settings:
      dockerfile: Dockerfile.demos
      auto_tag: true
      daemon_off: true
      pull_image: true
      registry: registry.helixml.tech
      repo: registry.helixml.tech/helix/demos
      username: admin
      password:
        from_secret: helix_registry_password
    volumes:
      - name: dockersocket
        path: /var/run/docker.sock
    when:
      ref:
        include:
          - refs/heads/main
          - refs/tags/*

  - name: mirror-demos-to-ghcr
    image: docker:cli
    environment:
      GITHUB_TOKEN:
        from_secret: github_token
      REGISTRY_PASSWORD:
        from_secret: helix_registry_password
    commands:
      - echo "$${REGISTRY_PASSWORD}" | docker login registry.helixml.tech -u admin --password-stdin
      - |
        # auto_tag produces "latest" on main, semver tags on git tags
        if [ -n "${DRONE_TAG}" ]; then
          VERSION="${DRONE_TAG}"
        else
          VERSION="latest"
        fi
        docker pull registry.helixml.tech/helix/demos:$${VERSION}
        scripts/ghcr-push.sh registry.helixml.tech/helix/demos:$${VERSION}
    volumes:
      - name: dockersocket
        path: /var/run/docker.sock
    when:
      ref:
        include:
          - refs/heads/main
          - refs/tags/*
    depends_on: [publish-demos]

---
# See integration-test/smoke/README.md
kind: pipeline
type: docker
name: smoke-test

workspace:
  base: /go
  path: src/github.com/helix-ml/helix

trigger:
  event:
    - cron
  cron:
    - smoke-test-hourly
    - developer

steps:
  - name: smoke-test-saas
    image: golang:1.25-alpine
    volumes:
      - name: integration-test
        path: /integration-test
      - name: go-build-cache
        path: /root/.cache/go-build
      - name: go-mod-cache
        path: /go/pkg/mod
    environment:
      BROWSER_URL: http://chrome:7317
      SERVER_URL: https://app.helix.ml
      HELIX_USER: phil+smoketest@helix.ml
      HELIX_PASSWORD:
        from_secret: smoke_test_helix_password
      # Test setup
    commands:
      - apk add --no-cache curl bash openssl
      - cp -r integration-test/* /integration-test
      - go test -timeout 600s -tags=integration -v ./integration-test/smoke
    depends_on: []
  - name: slack-notification
    image: plugins/slack
    settings:
      webhook:
        from_secret: JANITOR_SLACK_WEBHOOK_URL
      channel: helix-janitor
      # See the slack formatting docs: https://api.slack.com/reference/surfaces/formatting
      message: "❌ Smoke test failed (<@U010X78FM18>). (<https://drone.lukemarsden.net/helixml/helix/${DRONE_BUILD_NUMBER}|Build>)"
    when:
      status:
        - failure

volumes:
  - name: integration-test
    temp: {}

services:
  - name: chrome
    image: ghcr.io/go-rod/rod:v0.115.0
    volumes:
      - name: integration-test
        path: /integration-test

---
# Helm Upgrade Compatibility Test
# Catches backwards-incompatible Helm chart changes before they reach customers.
# Installs the previous published chart version then upgrades to the latest.
# Run locally: ./scripts/helm-upgrade-test.sh
kind: pipeline
type: docker
name: helm-upgrade-test

concurrency:
  limit: 1

platform:
  os: linux
  arch: amd64

trigger:
  event:
    - cron
  cron:
    - helm-upgrade-nightly
    - developer

steps:
  - name: helm-upgrade-test
    image: docker:27-cli
    volumes:
      - name: dockersocket
        path: /var/run/docker.sock
    commands:
      # Install tools
      - apk add --no-cache bash curl git helm kubectl jq
      # Install kind
      - curl -Lo /usr/local/bin/kind https://kind.sigs.k8s.io/dl/v0.27.0/kind-linux-amd64
      - chmod +x /usr/local/bin/kind
      # Verify Docker is accessible via host socket
      - docker info >/dev/null 2>&1 || (echo "Cannot access Docker socket" && exit 1)
      # Pre-flight cleanup: remove any orphaned Kind containers from previous failed runs
      - docker rm -f helm-upgrade-test-control-plane 2>/dev/null || true
      # Run upgrade test
      - bash scripts/helm-upgrade-test.sh
    depends_on: []

  - name: slack-notification
    image: plugins/slack
    settings:
      webhook:
        from_secret: JANITOR_SLACK_WEBHOOK_URL
      channel: helix-janitor
      message: "❌ Helm upgrade test failed — possible breaking chart change. (<https://drone.lukemarsden.net/helixml/helix/${DRONE_BUILD_NUMBER}|Build>)"
    when:
      status:
        - failure

volumes:
  - name: dockersocket
    host:
      path: /var/run/docker.sock

# ---
# Spectask/Sandbox Integration Tests
# These tests can run with software rendering (no GPU required).
# Run locally with: go test -v -tags=spectask ./integration-test/smoke/... -run TestSpectask
#
# Software Rendering Configuration (for CI without GPU):
#   GPU_VENDOR=none
#   WOLF_RENDER_NODE=software
#   LIBGL_ALWAYS_SOFTWARE=1
#   MESA_GL_VERSION_OVERRIDE=4.5
#   WOLF_USE_ZERO_COPY=FALSE
#
# Required environment variables:
#   HELIX_API_KEY          - API key with hl- prefix
#   HELIX_URL              - Helix API URL (default: http://localhost:8080)
#   HELIX_PROJECT          - Project ID for creating test tasks
#   HELIX_UBUNTU_AGENT     - Ubuntu/Sway agent app ID (PipeWire mode)
#   HELIX_KDE_AGENT        - KDE agent app ID (optional, for KDE tests)
#   HELIX_SESSION_ID       - Optional: existing session ID (skips session creation)
#
# Available test suites:
#   TestSpectaskStreamSuite      - Default stream tests
#   TestSpectaskSwayStreamSuite  - Sway/Ubuntu desktop tests (PipeWire mode)
#   TestSpectaskKDEStreamSuite   - KDE desktop tests
#   TestSpectaskMCPSuite         - MCP desktop tools with video recording
#
# Example:
#   source .env.usercreds
#   go test -v -tags=spectask ./integration-test/smoke/... -run TestSpectaskSwayStreamSuite
#
# kind: pipeline
# type: docker
# name: spectask-test
#
# workspace:
#   base: /go
#   path: src/github.com/helix-ml/helix
#
# trigger:
#   event:
#     - cron
#   cron:
#     - spectask-test-daily
#
# steps:
#   - name: spectask-sway-test
#     image: golang:1.25-alpine
#     volumes:
#       - name: spectask-test-results
#         path: /tmp/helix-spectask-test-results
#       - name: go-build-cache
#         path: /root/.cache/go-build
#       - name: go-mod-cache
#         path: /go/pkg/mod
#     environment:
#       HELIX_URL: https://app.helix.ml
#       HELIX_API_KEY:
#         from_secret: spectask_test_api_key
#       HELIX_PROJECT:
#         from_secret: spectask_test_project
#       HELIX_UBUNTU_AGENT:
#         from_secret: spectask_test_ubuntu_agent
#       HELIX_KDE_AGENT:
#         from_secret: spectask_test_kde_agent
#     commands:
#       - apk add --no-cache curl bash
#       - go test -timeout 300s -tags=spectask -v ./integration-test/smoke/... -run TestSpectaskSwayStreamSuite
#     depends_on: []
#
#   - name: spectask-kde-test
#     image: golang:1.25-alpine
#     volumes:
#       - name: spectask-test-results
#         path: /tmp/helix-spectask-test-results
#       - name: go-build-cache
#         path: /root/.cache/go-build
#       - name: go-mod-cache
#         path: /go/pkg/mod
#     environment:
#       HELIX_URL: https://app.helix.ml
#       HELIX_API_KEY:
#         from_secret: spectask_test_api_key
#       HELIX_PROJECT:
#         from_secret: spectask_test_project
#       HELIX_UBUNTU_AGENT:
#         from_secret: spectask_test_ubuntu_agent
#       HELIX_KDE_AGENT:
#         from_secret: spectask_test_kde_agent
#     commands:
#       - apk add --no-cache curl bash
#       - go test -timeout 300s -tags=spectask -v ./integration-test/smoke/... -run TestSpectaskKDEStreamSuite
#     depends_on: []
#
#   - name: slack-notification
#     image: plugins/slack
#     settings:
#       webhook:
#         from_secret: JANITOR_SLACK_WEBHOOK_URL
#       channel: helix-janitor
#       message: "❌ Spectask test failed. (<https://drone.lukemarsden.net/helixml/helix/${DRONE_BUILD_NUMBER}|Build>)"
#     when:
#       status:
#         - failure
#
# volumes:
#   - name: spectask-test-results
#     temp: {}

---
# ====================================================================
# Sandbox Build Pipeline
# ====================================================================
# Builds the complete sandbox stack:
#   1. Zed binary (Rust, from helixml/zed)
#   2. qwen-code (Node.js, from helixml/qwen-code)
#   3. Desktop images (helix-sway, helix-ubuntu)
#   4. Sandbox image (embeds desktop tarballs)
#
# Versioning:
#   - Tags: use git tag (e.g., v1.2.3)
#   - Branches: use commit hash (e.g., abc123f)
#
# Concurrency:
#   Steps use shared host volumes for caching. To prevent race conditions
#   when multiple builds run concurrently, we use flock for file-based locking.
#   flock auto-releases on process death (no stale locks).
#
# No GPU required - builds work on standard runners.
# ====================================================================
kind: pipeline
type: docker
name: build-sandbox-amd64

platform:
  os: linux
  arch: amd64

trigger:
  event:
    - push
    - tag

volumes:
  - name: dockersocket
    host:
      path: /var/run/docker.sock
  - name: sandbox-build-cache
    host:
      path: /var/cache/drone/sandbox-build
  - name: cargo-cache
    host:
      path: /var/cache/drone/cargo
  - name: npm-cache
    host:
      path: /var/cache/drone/npm

steps:
  # Step 1: Clone external repositories (pinned commits from sandbox-versions.txt)
  # Pinned for reproducibility - update sandbox-versions.txt when upgrading deps
  # Optional: CI warns if pinned version is behind upstream HEAD
  #
  # CONCURRENCY: Uses flock to prevent race conditions when multiple builds
  # access shared cache. flock auto-releases on process death (no stale locks).
  - name: clone-dependencies
    image: alpine/git:latest
    commands:
      - apk add --no-cache flock
      - mkdir -p /drone/src/external /drone/src/cache
      # Read pinned versions
      - |
        . /drone/src/sandbox-versions.txt
        echo "Pinned versions: ZED=$${ZED_COMMIT} QWEN=$${QWEN_COMMIT}"
        echo "$${ZED_COMMIT}" > /drone/src/zed-commit.txt
        echo "$${QWEN_COMMIT}" > /drone/src/qwen-code-commit.txt
      # Warn if pinned versions are stale (informational only, doesn't fail)
      - |
        . /drone/src/sandbox-versions.txt
        ZED_HEAD=$$(git ls-remote https://github.com/helixml/zed.git HEAD | cut -f1)
        QWEN_HEAD=$$(git ls-remote https://github.com/helixml/qwen-code.git HEAD | cut -f1)
        if [ "$${ZED_COMMIT}" != "$${ZED_HEAD}" ]; then
          echo "⚠️  ZED_COMMIT is behind upstream HEAD ($${ZED_HEAD:0:12})"
        fi
        if [ "$${QWEN_COMMIT}" != "$${QWEN_HEAD}" ]; then
          echo "⚠️  QWEN_COMMIT is behind upstream HEAD ($${QWEN_HEAD:0:12})"
        fi
      # Clone Zed only if not cached (flock prevents concurrent clone race)
      - |
        . /drone/src/sandbox-versions.txt
        ZED_SHORT=$${ZED_COMMIT:0:12}
        flock /drone/src/cache/zed-source.lock -c "
          if [ -f '/drone/src/cache/zed-$${ZED_SHORT}/zed' ] && [ -f '/drone/src/cache/zed-$${ZED_SHORT}/app-icon.png' ]; then
            echo '✓ Zed binary+icon cached for $${ZED_SHORT}'
          else
            echo 'Cloning Zed at commit $${ZED_COMMIT}...'
            cd /
            rm -rf /drone/src/cache/zed-source
            git init /drone/src/cache/zed-source
            git -C /drone/src/cache/zed-source fetch --depth 1 https://github.com/helixml/zed.git $${ZED_COMMIT}
            git -C /drone/src/cache/zed-source checkout FETCH_HEAD
          fi
        "
      # Clone qwen-code only if not cached (flock prevents concurrent clone race)
      - |
        . /drone/src/sandbox-versions.txt
        QWEN_SHORT=$${QWEN_COMMIT:0:12}
        flock /drone/src/cache/qwen-source.lock -c "
          if [ -f '/drone/src/cache/qwen-$${QWEN_SHORT}/dist/cli.js' ]; then
            echo '✓ qwen-code cached for $${QWEN_SHORT}'
          else
            echo 'Cloning qwen-code at commit $${QWEN_COMMIT}...'
            cd /
            rm -rf /drone/src/cache/qwen-source
            git init /drone/src/cache/qwen-source
            git -C /drone/src/cache/qwen-source fetch --depth 1 https://github.com/helixml/qwen-code.git $${QWEN_COMMIT}
            git -C /drone/src/cache/qwen-source checkout FETCH_HEAD
          fi
        "
      - echo "=== Dependency versions ==="
      - echo "Zed:" && cat /drone/src/zed-commit.txt
      - echo "qwen-code:" && cat /drone/src/qwen-code-commit.txt
    volumes:
      - name: sandbox-build-cache
        path: /drone/src/cache

  # Step 2: Build qwen-code (with caching)
  # Uses flock to prevent concurrent builds from racing on shared cache
  - name: build-qwen-code
    image: node:20-slim
    commands:
      - apt-get update && apt-get install -y git flock && rm -rf /var/lib/apt/lists/*
      - |
        QWEN_COMMIT=$$(cat /drone/src/qwen-code-commit.txt | head -c 12)
        # Use flock for entire build to prevent races on qwen-source and cache
        flock /drone/src/cache/qwen-build.lock -c "
          # Double-check cache after acquiring lock (another build may have finished)
          if [ -f '/drone/src/cache/qwen-$${QWEN_COMMIT}/dist/cli.js' ]; then
            echo 'Using cached qwen-code for commit $${QWEN_COMMIT}'
            mkdir -p /drone/src/qwen-code-build
            cp -r /drone/src/cache/qwen-$${QWEN_COMMIT}/* /drone/src/qwen-code-build/
            exit 0
          fi

          echo 'Building qwen-code for commit $${QWEN_COMMIT}...'
          mkdir -p /drone/src/qwen-code-build
          cd /drone/src/cache/qwen-source
          npm ci --ignore-scripts
          npm run bundle

          # Copy everything needed for runtime (matching ./stack build-qwen-code)
          # node_modules is required because tiktoken has native bindings that can't be bundled
          cp -r package.json package-lock.json dist/ /drone/src/qwen-code-build/
          cp -r packages/ /drone/src/qwen-code-build/ 2>/dev/null || true
          cp -r node_modules/ /drone/src/qwen-code-build/
          cat /drone/src/qwen-code-commit.txt > /drone/src/qwen-code-build/.git-commit-hash
          echo 'qwen-code build complete'
          ls -la /drone/src/qwen-code-build/

          # Cache the build
          mkdir -p /drone/src/cache/qwen-$${QWEN_COMMIT}
          cp -r /drone/src/qwen-code-build/* /drone/src/cache/qwen-$${QWEN_COMMIT}/
        "
      # Copy from workspace (flock wrote here)
      - mkdir -p qwen-code-build && cp -r /drone/src/qwen-code-build/* qwen-code-build/ 2>/dev/null || true
    volumes:
      - name: sandbox-build-cache
        path: /drone/src/cache
      - name: npm-cache
        path: /root/.npm
    depends_on:
      - clone-dependencies

  # Step 3: Build Zed binary
  # Uses flock to prevent concurrent builds from racing on shared cache
  - name: build-zed
    image: docker:cli
    environment:
      DOCKER_HOST: unix:///var/run/docker.sock
    commands:
      - apk add --no-cache flock
      - |
        ZED_COMMIT=$$(cat /drone/src/zed-commit.txt | head -c 12)
        CACHE_KEY="zed-$${ZED_COMMIT}"
        # Use flock for entire build to prevent races on cache
        flock /drone/src/cache/zed-build.lock -c "
          # Double-check cache after acquiring lock (another build may have finished)
          if [ -f '/drone/src/cache/$${CACHE_KEY}/zed' ] && [ -f '/drone/src/cache/$${CACHE_KEY}/app-icon.png' ]; then
            echo 'Using cached Zed binary + icon for commit $${ZED_COMMIT}'
            mkdir -p zed-build
            cp /drone/src/cache/$${CACHE_KEY}/zed zed-build/zed
            cp /drone/src/cache/$${CACHE_KEY}/app-icon.png zed-build/app-icon.png
            chmod +x zed-build/zed
            exit 0
          fi

          echo 'Building Zed binary (this may take 15-20 minutes on first run)...'

          # Build the Zed builder environment image (deps + rustup, no compilation)
          # --target builder-env stops before COPY/cargo build (which needs Zed source as context)
          docker build --pull --target builder-env -t zed-builder:ubuntu25 -f Dockerfile.zed-build .

          # Run Zed build in container, output directly to cache directory
          # Note: Zed source is cloned to /drone/src/cache/zed-source (inside Drone container)
          #       which maps to /var/cache/drone/sandbox-build/zed-source on the HOST.
          #       Docker-in-Docker mounts use HOST paths, not container paths.
          mkdir -p /drone/src/cache/$${CACHE_KEY}
          docker run --rm \\
            -v '/var/cache/drone/sandbox-build/zed-source:/zed:ro' \\
            -v '/var/cache/drone/cargo/registry:/root/.cargo/registry' \\
            -v '/var/cache/drone/cargo/git:/root/.cargo/git' \\
            -v '/var/cache/drone/cargo/zed-target:/zed-target' \\
            -v \"/var/cache/drone/sandbox-build/$${CACHE_KEY}:/output\" \\
            -w /zed \\
            zed-builder:ubuntu25 \\
            bash -c '
              export CARGO_TARGET_DIR=/zed-target
              RUSTFLAGS=\"-C link-arg=-s\" cargo build --locked --release --features external_websocket_sync
              cp /zed-target/release/zed /output/zed
              cp /zed/crates/zed/resources/app-icon.png /output/app-icon.png
            '

          ls -la /drone/src/cache/$${CACHE_KEY}/

          # Copy from cache to workspace
          mkdir -p zed-build
          cp /drone/src/cache/$${CACHE_KEY}/zed zed-build/zed
          cp /drone/src/cache/$${CACHE_KEY}/app-icon.png zed-build/app-icon.png
          chmod +x zed-build/zed
        "
      - chmod +x zed-build/zed
    volumes:
      - name: dockersocket
        path: /var/run/docker.sock
      - name: sandbox-build-cache
        path: /drone/src/cache
      - name: cargo-cache
        path: /drone/src/cargo-registry
    depends_on:
      - clone-dependencies

  # Step 3b: Run Zed WebSocket E2E test
  # Builds a Go test server (imports real Helix server code) + runtime image,
  # then runs the multi-phase E2E test (thread creation, follow-ups, thread
  # transitions, UI state queries, open_thread). Uses multi-stage Docker build
  # to compile the Go test server with the current helix source.
  - name: zed-e2e-test
    image: docker:cli
    environment:
      DOCKER_HOST: unix:///var/run/docker.sock
      ANTHROPIC_API_KEY:
        from_secret: anthropic_api_key
    commands:
      - apk add --no-cache flock
      - |
        ZED_COMMIT=$$(cat /drone/src/zed-commit.txt | head -c 12)
        ZED_SOURCE="/drone/src/cache/zed-source"

        # Verify Zed binary exists from build-zed step
        if [ ! -f "zed-build/zed" ]; then
          echo "ERROR: Zed binary not found - build-zed step must run first"
          exit 1
        fi

        # Use the Zed e2e-test dir as Docker context — only external inputs
        # are the pre-built zed binary and Helix Go source (for test server build)
        E2E_DIR="$${ZED_SOURCE}/crates/external_websocket_sync/e2e-test"

        # Clean up stale files from previous builds BEFORE copying.
        # Critical: if helix-api/ already exists from a failed build,
        # cp -r nests api/ inside it (creating helix-api/api/) which
        # breaks Go module resolution in the Docker build.
        # Use docker to remove as root — files may be root-owned from previous docker builds.
        docker run --rm -v "/var/cache/drone/sandbox-build/zed-source:/zed-source" alpine \
          rm -rf \
            "/zed-source/crates/external_websocket_sync/e2e-test/helix-api" \
            "/zed-source/crates/external_websocket_sync/e2e-test/helix-go.mod" \
            "/zed-source/crates/external_websocket_sync/e2e-test/helix-go.sum" \
            "/zed-source/crates/external_websocket_sync/e2e-test/zed-binary"

        cp zed-build/zed "$${E2E_DIR}/zed-binary"
        cp /drone/src/go.mod "$${E2E_DIR}/helix-go.mod"
        cp /drone/src/go.sum "$${E2E_DIR}/helix-go.sum"
        cp -r /drone/src/api "$${E2E_DIR}/helix-api"

        # Sync kodit version from helix into the E2E test server's go.mod.
        # The E2E test server has its own go.mod that may pin an older kodit;
        # go mod tidy in the Docker build will update go.sum automatically.
        KODIT_VERSION=$$(grep 'github.com/helixml/kodit' /drone/src/go.mod | awk '{print $$2}')
        if [ -n "$${KODIT_VERSION}" ]; then
          sed -i "s|github.com/helixml/kodit v[^ ]*|github.com/helixml/kodit $${KODIT_VERSION}|" \
            "$${E2E_DIR}/helix-ws-test-server/go.mod"
          echo "Synced kodit to $${KODIT_VERSION} in E2E test server go.mod"
        fi

        # Verify helix-api has expected structure (not nested from stale cp -r)
        if [ ! -d "$${E2E_DIR}/helix-api/pkg" ]; then
          echo "ERROR: helix-api structure is wrong — expected helix-api/pkg/ at top level"
          echo "Contents of helix-api/:"
          ls -la "$${E2E_DIR}/helix-api/" || true
          exit 1
        fi

        echo "Building E2E runtime image (multi-stage: Go builder + runtime)..."
        docker build -t zed-ws-e2e:$${ZED_COMMIT} \
          -f "$${E2E_DIR}/Dockerfile.ci" \
          "$${E2E_DIR}"

        # Clean up external files from cached Zed source
        # Use || true because stale files from previous builds on the shared
        # Docker volume cache may fail to remove (root-owned from docker build)
        rm -f "$${E2E_DIR}/zed-binary" "$${E2E_DIR}/helix-go.mod" "$${E2E_DIR}/helix-go.sum" || true
        rm -rf "$${E2E_DIR}/helix-api" || true

        echo "Running E2E test..."
        docker run --rm \
          -e ANTHROPIC_API_KEY="$${ANTHROPIC_API_KEY}" \
          -e TEST_TIMEOUT=240 \
          zed-ws-e2e:$${ZED_COMMIT}

        echo "Zed WebSocket E2E test passed"
    volumes:
      - name: dockersocket
        path: /var/run/docker.sock
      - name: sandbox-build-cache
        path: /drone/src/cache
    depends_on:
      - build-zed

  # Step 4: Build and push desktop images to registry
  - name: build-desktops
    image: docker:cli
    environment:
      DOCKER_HOST: unix:///var/run/docker.sock
      REGISTRY_PASSWORD:
        from_secret: helix_registry_password
      GITHUB_TOKEN:
        from_secret: github_token
    commands:
      - |
        # Determine version tag
        if [ -n "${DRONE_TAG}" ]; then
          VERSION="${DRONE_TAG}"
        else
          VERSION=$$(echo ${DRONE_COMMIT_SHA} | head -c 7)
        fi
        echo "Building desktop images with version: $${VERSION}"
      - echo "$${REGISTRY_PASSWORD}" | docker login registry.helixml.tech -u admin --password-stdin
      # Build and push helix-sway
      - |
        VERSION=$$(if [ -n "${DRONE_TAG}" ]; then echo ${DRONE_TAG}; else echo ${DRONE_COMMIT_SHA} | head -c 7; fi)
        echo "Building helix-sway..."
        docker build --pull --provenance=false \
          -f Dockerfile.sway-helix \
          -t registry.helixml.tech/helix/helix-sway:$${VERSION}-linux-amd64 \
          .
        docker push registry.helixml.tech/helix/helix-sway:$${VERSION}-linux-amd64
        scripts/ghcr-push.sh registry.helixml.tech/helix/helix-sway:$${VERSION}-linux-amd64
        echo "helix-sway:$${VERSION}-linux-amd64 pushed to registry"
      # Build and push helix-ubuntu
      - |
        VERSION=$$(if [ -n "${DRONE_TAG}" ]; then echo ${DRONE_TAG}; else echo ${DRONE_COMMIT_SHA} | head -c 7; fi)
        echo "Building helix-ubuntu..."
        docker build --pull --provenance=false \
          -f Dockerfile.ubuntu-helix \
          --build-arg CUDA_BASE_IMAGE=nvidia/cuda:12.6.3-runtime-ubuntu24.04 \
          -t registry.helixml.tech/helix/helix-ubuntu:$${VERSION}-linux-amd64 \
          .
        docker push registry.helixml.tech/helix/helix-ubuntu:$${VERSION}-linux-amd64
        scripts/ghcr-push.sh registry.helixml.tech/helix/helix-ubuntu:$${VERSION}-linux-amd64
        echo "helix-ubuntu:$${VERSION}-linux-amd64 pushed to registry"
      # Write version refs for sandbox
      - |
        VERSION=$$(if [ -n "${DRONE_TAG}" ]; then echo ${DRONE_TAG}; else echo ${DRONE_COMMIT_SHA} | head -c 7; fi)
        mkdir -p sandbox-images
        echo "ghcr.io/helixml/helix-sway:$${VERSION}-linux-amd64" > sandbox-images/helix-sway.ref
        echo "ghcr.io/helixml/helix-ubuntu:$${VERSION}-linux-amd64" > sandbox-images/helix-ubuntu.ref
        echo "$${VERSION}-linux-amd64" > sandbox-images/helix-sway.version
        echo "$${VERSION}-linux-amd64" > sandbox-images/helix-ubuntu.version
    volumes:
      - name: dockersocket
        path: /var/run/docker.sock
    depends_on:
      - build-qwen-code
      - build-zed

  # Step 5: Build sandbox image
  - name: build-sandbox
    image: docker:cli
    environment:
      DOCKER_HOST: unix:///var/run/docker.sock
    commands:
      - |
        # Determine version tag
        if [ -n "${DRONE_TAG}" ]; then
          VERSION="${DRONE_TAG}"
        else
          VERSION=$$(echo ${DRONE_COMMIT_SHA} | head -c 7)
        fi
        COMMIT=$$(echo ${DRONE_COMMIT_SHA} | head -c 7)
        echo "Building sandbox with version: $${VERSION}, commit: $${COMMIT}"
        docker build --pull -f Dockerfile.sandbox \
          -t helix-sandbox:$${VERSION}-linux-amd64 \
          -t registry.helixml.tech/helix/helix-sandbox:$${COMMIT}-linux-amd64 \
          -t registry.helixml.tech/helix/helix-sandbox:$${VERSION}-linux-amd64 \
          .
        echo "Sandbox image built successfully"
        docker images helix-sandbox
    volumes:
      - name: dockersocket
        path: /var/run/docker.sock
    depends_on:
      - build-desktops

  # Step 6: Push to registry (gated on E2E test passing)
  - name: push-sandbox
    image: docker:cli
    environment:
      DOCKER_HOST: unix:///var/run/docker.sock
      REGISTRY_PASSWORD:
        from_secret: helix_registry_password
      GITHUB_TOKEN:
        from_secret: github_token
    commands:
      - |
        # Determine version tag
        if [ -n "${DRONE_TAG}" ]; then
          VERSION="${DRONE_TAG}"
          IS_RELEASE="true"
        else
          VERSION=$$(echo ${DRONE_COMMIT_SHA} | head -c 7)
          IS_RELEASE="false"
        fi
        COMMIT=$$(echo ${DRONE_COMMIT_SHA} | head -c 7)
        echo "Logging in to registry..."
        echo "$${REGISTRY_PASSWORD}" | docker login registry.helixml.tech -u admin --password-stdin
        echo "Pushing helix-sandbox:$${COMMIT}-linux-amd64..."
        docker push registry.helixml.tech/helix/helix-sandbox:$${COMMIT}-linux-amd64
        scripts/ghcr-push.sh registry.helixml.tech/helix/helix-sandbox:$${COMMIT}-linux-amd64
        if [ "$${IS_RELEASE}" = "true" ]; then
          echo "Pushing release tag: $${VERSION}-linux-amd64..."
          docker push registry.helixml.tech/helix/helix-sandbox:$${VERSION}-linux-amd64
          scripts/ghcr-push.sh registry.helixml.tech/helix/helix-sandbox:$${VERSION}-linux-amd64
        fi
        echo "Push complete!"
    volumes:
      - name: dockersocket
        path: /var/run/docker.sock
    depends_on:
      - build-sandbox
      - zed-e2e-test

---
# ====================================================================
# ARM64 Sandbox Pipeline
# Mirrors build-sandbox-amd64 but runs on macOS Docker Desktop (flight)
# Key differences:
# - Uses docker:cli (not plugins/docker) for all steps
# - Volume host paths under /Volumes/Big/drone-cache/ (Docker Desktop VM mount)
# - DinD volume paths also use /Volumes/Big/drone-cache/
# - --provenance=false on all docker builds
# - --build-arg CUDA_BASE_IMAGE=ubuntu:25.10 for ubuntu-helix (no CUDA on ARM)
# - Skips zed-e2e-test (add later)
# ====================================================================
kind: pipeline
type: docker
name: build-sandbox-arm64

platform:
  os: linux
  arch: arm64

trigger:
  event:
    - push
    - tag

volumes:
  - name: dockersocket
    host:
      path: /var/run/docker.sock
  - name: sandbox-build-cache
    host:
      path: /Volumes/Big/drone-cache/sandbox-build
  - name: cargo-cache
    host:
      path: /Volumes/Big/drone-cache/cargo
  - name: npm-cache
    host:
      path: /Volumes/Big/drone-cache/npm

steps:
  # Step 1: Clone external repositories (same as amd64)
  - name: clone-dependencies
    image: alpine/git:latest
    commands:
      - apk add --no-cache flock
      - mkdir -p /drone/src/external /drone/src/cache
      - |
        . /drone/src/sandbox-versions.txt
        echo "Pinned versions: ZED=$${ZED_COMMIT} QWEN=$${QWEN_COMMIT}"
        echo "$${ZED_COMMIT}" > /drone/src/zed-commit.txt
        echo "$${QWEN_COMMIT}" > /drone/src/qwen-code-commit.txt
      - |
        . /drone/src/sandbox-versions.txt
        ZED_HEAD=$$(git ls-remote https://github.com/helixml/zed.git HEAD | cut -f1)
        QWEN_HEAD=$$(git ls-remote https://github.com/helixml/qwen-code.git HEAD | cut -f1)
        if [ "$${ZED_COMMIT}" != "$${ZED_HEAD}" ]; then
          echo "⚠️  ZED_COMMIT is behind upstream HEAD ($${ZED_HEAD:0:12})"
        fi
        if [ "$${QWEN_COMMIT}" != "$${QWEN_HEAD}" ]; then
          echo "⚠️  QWEN_COMMIT is behind upstream HEAD ($${QWEN_HEAD:0:12})"
        fi
      - |
        . /drone/src/sandbox-versions.txt
        ZED_SHORT=$${ZED_COMMIT:0:12}
        flock /drone/src/cache/zed-source.lock -c "
          if [ -f '/drone/src/cache/zed-$${ZED_SHORT}/zed' ] && [ -f '/drone/src/cache/zed-$${ZED_SHORT}/app-icon.png' ]; then
            echo '✓ Zed binary+icon cached for $${ZED_SHORT}'
          else
            echo 'Cloning Zed at commit $${ZED_COMMIT}...'
            cd /
            rm -rf /drone/src/cache/zed-source
            git init /drone/src/cache/zed-source
            git -C /drone/src/cache/zed-source fetch --depth 1 https://github.com/helixml/zed.git $${ZED_COMMIT}
            git -C /drone/src/cache/zed-source checkout FETCH_HEAD
          fi
        "
      - |
        . /drone/src/sandbox-versions.txt
        QWEN_SHORT=$${QWEN_COMMIT:0:12}
        flock /drone/src/cache/qwen-source.lock -c "
          if [ -f '/drone/src/cache/qwen-$${QWEN_SHORT}/dist/cli.js' ]; then
            echo '✓ qwen-code cached for $${QWEN_SHORT}'
          else
            echo 'Cloning qwen-code at commit $${QWEN_COMMIT}...'
            cd /
            rm -rf /drone/src/cache/qwen-source
            git init /drone/src/cache/qwen-source
            git -C /drone/src/cache/qwen-source fetch --depth 1 https://github.com/helixml/qwen-code.git $${QWEN_COMMIT}
            git -C /drone/src/cache/qwen-source checkout FETCH_HEAD
          fi
        "
      - echo "=== Dependency versions ==="
      - echo "Zed:" && cat /drone/src/zed-commit.txt
      - echo "qwen-code:" && cat /drone/src/qwen-code-commit.txt
    volumes:
      - name: sandbox-build-cache
        path: /drone/src/cache

  # Step 2: Build qwen-code (same as amd64)
  - name: build-qwen-code
    image: node:20-slim
    commands:
      - apt-get update && apt-get install -y git flock && rm -rf /var/lib/apt/lists/*
      - |
        QWEN_COMMIT=$$(cat /drone/src/qwen-code-commit.txt | head -c 12)
        flock /drone/src/cache/qwen-build.lock -c "
          if [ -f '/drone/src/cache/qwen-$${QWEN_COMMIT}/dist/cli.js' ]; then
            echo 'Using cached qwen-code for commit $${QWEN_COMMIT}'
            mkdir -p /drone/src/qwen-code-build
            cp -r /drone/src/cache/qwen-$${QWEN_COMMIT}/* /drone/src/qwen-code-build/
            exit 0
          fi

          echo 'Building qwen-code for commit $${QWEN_COMMIT}...'
          mkdir -p /drone/src/qwen-code-build
          cd /drone/src/cache/qwen-source
          npm ci --ignore-scripts
          npm run bundle

          cp -r package.json package-lock.json dist/ /drone/src/qwen-code-build/
          cp -r packages/ /drone/src/qwen-code-build/ 2>/dev/null || true
          cp -r node_modules/ /drone/src/qwen-code-build/
          cat /drone/src/qwen-code-commit.txt > /drone/src/qwen-code-build/.git-commit-hash
          echo 'qwen-code build complete'
          ls -la /drone/src/qwen-code-build/

          mkdir -p /drone/src/cache/qwen-$${QWEN_COMMIT}
          cp -r /drone/src/qwen-code-build/* /drone/src/cache/qwen-$${QWEN_COMMIT}/
        "
      - mkdir -p qwen-code-build && cp -r /drone/src/qwen-code-build/* qwen-code-build/ 2>/dev/null || true
    volumes:
      - name: sandbox-build-cache
        path: /drone/src/cache
      - name: npm-cache
        path: /root/.npm
    depends_on:
      - clone-dependencies

  # Step 3: Build Zed binary (DinD with macOS Docker Desktop paths)
  - name: build-zed
    image: docker:cli
    environment:
      DOCKER_HOST: unix:///var/run/docker.sock
    commands:
      - apk add --no-cache flock
      - |
        ZED_COMMIT=$$(cat /drone/src/zed-commit.txt | head -c 12)
        CACHE_KEY="zed-$${ZED_COMMIT}"
        flock /drone/src/cache/zed-build.lock -c "
          if [ -f '/drone/src/cache/$${CACHE_KEY}/zed' ] && [ -f '/drone/src/cache/$${CACHE_KEY}/app-icon.png' ]; then
            echo 'Using cached Zed binary + icon for commit $${ZED_COMMIT}'
            mkdir -p zed-build
            cp /drone/src/cache/$${CACHE_KEY}/zed zed-build/zed
            cp /drone/src/cache/$${CACHE_KEY}/app-icon.png zed-build/app-icon.png
            chmod +x zed-build/zed
            exit 0
          fi

          echo 'Building Zed binary (this may take 15-20 minutes on first run)...'

          docker build --pull --provenance=false --target builder-env -t zed-builder:ubuntu25 -f Dockerfile.zed-build .

          mkdir -p /drone/src/cache/$${CACHE_KEY}
          docker run --rm \\
            -v '/Volumes/Big/drone-cache/sandbox-build/zed-source:/zed:ro' \\
            -v '/Volumes/Big/drone-cache/cargo/registry:/root/.cargo/registry' \\
            -v '/Volumes/Big/drone-cache/cargo/git:/root/.cargo/git' \\
            -v '/Volumes/Big/drone-cache/cargo/zed-target:/zed-target' \\
            -v \"/Volumes/Big/drone-cache/sandbox-build/$${CACHE_KEY}:/output\" \\
            -w /zed \\
            zed-builder:ubuntu25 \\
            bash -c '
              export CARGO_TARGET_DIR=/zed-target
              RUSTFLAGS=\"-C link-arg=-s\" cargo build --locked --release --features external_websocket_sync
              cp /zed-target/release/zed /output/zed
              cp /zed/crates/zed/resources/app-icon.png /output/app-icon.png
            '

          ls -la /drone/src/cache/$${CACHE_KEY}/

          mkdir -p zed-build
          cp /drone/src/cache/$${CACHE_KEY}/zed zed-build/zed
          cp /drone/src/cache/$${CACHE_KEY}/app-icon.png zed-build/app-icon.png
          chmod +x zed-build/zed
        "
      - chmod +x zed-build/zed
    volumes:
      - name: dockersocket
        path: /var/run/docker.sock
      - name: sandbox-build-cache
        path: /drone/src/cache
      - name: cargo-cache
        path: /drone/src/cargo-registry
    depends_on:
      - clone-dependencies

  # Step 4: Build and push desktop images (arm64, with CUDA_BASE_IMAGE override)
  - name: build-desktops
    image: docker:cli
    environment:
      DOCKER_HOST: unix:///var/run/docker.sock
      REGISTRY_PASSWORD:
        from_secret: helix_registry_password
      GITHUB_TOKEN:
        from_secret: github_token
    commands:
      - |
        if [ -n "${DRONE_TAG}" ]; then
          VERSION="${DRONE_TAG}"
        else
          VERSION=$$(echo ${DRONE_COMMIT_SHA} | head -c 7)
        fi
        echo "Building ARM64 desktop images with version: $${VERSION}"
      - echo "$${REGISTRY_PASSWORD}" | docker login registry.helixml.tech -u admin --password-stdin
      # Build and push helix-sway (arm64)
      - |
        VERSION=$$(if [ -n "${DRONE_TAG}" ]; then echo ${DRONE_TAG}; else echo ${DRONE_COMMIT_SHA} | head -c 7; fi)
        echo "Building helix-sway (arm64)..."
        docker build --pull --provenance=false \
          -f Dockerfile.sway-helix \
          -t registry.helixml.tech/helix/helix-sway:$${VERSION}-linux-arm64 \
          .
        docker push registry.helixml.tech/helix/helix-sway:$${VERSION}-linux-arm64
        scripts/ghcr-push.sh registry.helixml.tech/helix/helix-sway:$${VERSION}-linux-arm64
        echo "helix-sway:$${VERSION}-linux-arm64 pushed to registry"
      # Build and push helix-ubuntu (arm64, no CUDA)
      - |
        VERSION=$$(if [ -n "${DRONE_TAG}" ]; then echo ${DRONE_TAG}; else echo ${DRONE_COMMIT_SHA} | head -c 7; fi)
        echo "Building helix-ubuntu (arm64, no CUDA)..."
        docker build --pull --provenance=false \
          -f Dockerfile.ubuntu-helix \
          --build-arg CUDA_BASE_IMAGE=ubuntu:25.10 \
          -t registry.helixml.tech/helix/helix-ubuntu:$${VERSION}-linux-arm64 \
          .
        docker push registry.helixml.tech/helix/helix-ubuntu:$${VERSION}-linux-arm64
        scripts/ghcr-push.sh registry.helixml.tech/helix/helix-ubuntu:$${VERSION}-linux-arm64
        echo "helix-ubuntu:$${VERSION}-linux-arm64 pushed to registry"
      # Write version refs for sandbox
      - |
        VERSION=$$(if [ -n "${DRONE_TAG}" ]; then echo ${DRONE_TAG}; else echo ${DRONE_COMMIT_SHA} | head -c 7; fi)
        mkdir -p sandbox-images
        echo "ghcr.io/helixml/helix-sway:$${VERSION}-linux-arm64" > sandbox-images/helix-sway.ref
        echo "ghcr.io/helixml/helix-ubuntu:$${VERSION}-linux-arm64" > sandbox-images/helix-ubuntu.ref
        echo "$${VERSION}-linux-arm64" > sandbox-images/helix-sway.version
        echo "$${VERSION}-linux-arm64" > sandbox-images/helix-ubuntu.version
    volumes:
      - name: dockersocket
        path: /var/run/docker.sock
    depends_on:
      - build-qwen-code
      - build-zed

  # Step 5: Build sandbox image (arm64)
  - name: build-sandbox
    image: docker:cli
    environment:
      DOCKER_HOST: unix:///var/run/docker.sock
    commands:
      - |
        if [ -n "${DRONE_TAG}" ]; then
          VERSION="${DRONE_TAG}"
        else
          VERSION=$$(echo ${DRONE_COMMIT_SHA} | head -c 7)
        fi
        COMMIT=$$(echo ${DRONE_COMMIT_SHA} | head -c 7)
        echo "Building ARM64 sandbox with version: $${VERSION}, commit: $${COMMIT}"
        docker build --pull --provenance=false -f Dockerfile.sandbox \
          -t helix-sandbox:$${VERSION}-linux-arm64 \
          -t registry.helixml.tech/helix/helix-sandbox:$${COMMIT}-linux-arm64 \
          -t registry.helixml.tech/helix/helix-sandbox:$${VERSION}-linux-arm64 \
          .
        echo "ARM64 sandbox image built successfully"
    volumes:
      - name: dockersocket
        path: /var/run/docker.sock
    depends_on:
      - build-desktops

  # Step 6: Push to registry (arm64)
  - name: push-sandbox
    image: docker:cli
    environment:
      DOCKER_HOST: unix:///var/run/docker.sock
      REGISTRY_PASSWORD:
        from_secret: helix_registry_password
      GITHUB_TOKEN:
        from_secret: github_token
    commands:
      - |
        if [ -n "${DRONE_TAG}" ]; then
          VERSION="${DRONE_TAG}"
          IS_RELEASE="true"
        else
          VERSION=$$(echo ${DRONE_COMMIT_SHA} | head -c 7)
          IS_RELEASE="false"
        fi
        COMMIT=$$(echo ${DRONE_COMMIT_SHA} | head -c 7)
        echo "Logging in to registry..."
        echo "$${REGISTRY_PASSWORD}" | docker login registry.helixml.tech -u admin --password-stdin
        echo "Pushing helix-sandbox:$${COMMIT}-linux-arm64..."
        docker push registry.helixml.tech/helix/helix-sandbox:$${COMMIT}-linux-arm64
        scripts/ghcr-push.sh registry.helixml.tech/helix/helix-sandbox:$${COMMIT}-linux-arm64
        if [ "$${IS_RELEASE}" = "true" ]; then
          echo "Pushing release tag: $${VERSION}-linux-arm64..."
          docker push registry.helixml.tech/helix/helix-sandbox:$${VERSION}-linux-arm64
          scripts/ghcr-push.sh registry.helixml.tech/helix/helix-sandbox:$${VERSION}-linux-arm64
        fi
        echo "ARM64 push complete!"
    volumes:
      - name: dockersocket
        path: /var/run/docker.sock
    depends_on:
      - build-sandbox

---
# ====================================================================
# Multi-arch manifest pipelines for sandbox and desktop images
# ====================================================================
kind: pipeline
type: docker
name: manifest-sandbox

depends_on:
  - build-sandbox-amd64
  - build-sandbox-arm64

trigger:
  ref:
    include:
      - refs/heads/main
      - refs/tags/*

volumes:
  - name: dockersocket
    host:
      path: /var/run/docker.sock

steps:
  - name: manifest-helix-sandbox
    image: docker:cli
    environment:
      REGISTRY_PASSWORD:
        from_secret: helix_registry_password
      GITHUB_TOKEN:
        from_secret: github_token
    commands:
      - echo "$${REGISTRY_PASSWORD}" | docker login registry.helixml.tech -u admin --password-stdin
      - |
        if [ -n "${DRONE_TAG}" ]; then
          VERSION="${DRONE_TAG}"
        else
          VERSION=$$(echo ${DRONE_COMMIT_SHA} | head -c 7)
        fi
        REPO="registry.helixml.tech/helix/helix-sandbox"
        echo "Creating multi-arch manifest for $${REPO}:$${VERSION}"
        docker manifest create --amend $${REPO}:$${VERSION} \
          $${REPO}:$${VERSION}-linux-amd64 \
          $${REPO}:$${VERSION}-linux-arm64
        docker manifest push $${REPO}:$${VERSION}
        echo "Multi-arch manifest pushed: $${REPO}:$${VERSION}"
        scripts/ghcr-manifest.sh $${REPO} $${VERSION}
    volumes:
      - name: dockersocket
        path: /var/run/docker.sock

  - name: manifest-helix-sway
    image: docker:cli
    environment:
      REGISTRY_PASSWORD:
        from_secret: helix_registry_password
      GITHUB_TOKEN:
        from_secret: github_token
    commands:
      - echo "$${REGISTRY_PASSWORD}" | docker login registry.helixml.tech -u admin --password-stdin
      - |
        if [ -n "${DRONE_TAG}" ]; then
          VERSION="${DRONE_TAG}"
        else
          VERSION=$$(echo ${DRONE_COMMIT_SHA} | head -c 7)
        fi
        REPO="registry.helixml.tech/helix/helix-sway"
        echo "Creating multi-arch manifest for $${REPO}:$${VERSION}"
        docker manifest create --amend $${REPO}:$${VERSION} \
          $${REPO}:$${VERSION}-linux-amd64 \
          $${REPO}:$${VERSION}-linux-arm64
        docker manifest push $${REPO}:$${VERSION}
        echo "Multi-arch manifest pushed: $${REPO}:$${VERSION}"
        scripts/ghcr-manifest.sh $${REPO} $${VERSION}
    volumes:
      - name: dockersocket
        path: /var/run/docker.sock

  - name: manifest-helix-ubuntu
    image: docker:cli
    environment:
      REGISTRY_PASSWORD:
        from_secret: helix_registry_password
      GITHUB_TOKEN:
        from_secret: github_token
    commands:
      - echo "$${REGISTRY_PASSWORD}" | docker login registry.helixml.tech -u admin --password-stdin
      - |
        if [ -n "${DRONE_TAG}" ]; then
          VERSION="${DRONE_TAG}"
        else
          VERSION=$$(echo ${DRONE_COMMIT_SHA} | head -c 7)
        fi
        REPO="registry.helixml.tech/helix/helix-ubuntu"
        echo "Creating multi-arch manifest for $${REPO}:$${VERSION}"
        docker manifest create --amend $${REPO}:$${VERSION} \
          $${REPO}:$${VERSION}-linux-amd64 \
          $${REPO}:$${VERSION}-linux-arm64
        docker manifest push $${REPO}:$${VERSION}
        echo "Multi-arch manifest pushed: $${REPO}:$${VERSION}"
        scripts/ghcr-manifest.sh $${REPO} $${VERSION}
    volumes:
      - name: dockersocket
        path: /var/run/docker.sock


# ====================================================================
# macOS DMG Build Pipeline
# Builds Helix.app, signs with Developer ID, creates DMG, notarizes,
# and uploads to Cloudflare R2.
# Runs on flight-arm64 (native macOS exec, not Docker).
# ====================================================================
---
kind: pipeline
type: exec
name: build-macos-dmg

platform:
  os: darwin
  arch: arm64

# Wait for ARM64 Docker images and release artifacts before provisioning the VM
depends_on:
  - default
  - build-controlplane-arm64
  - build-haystack-arm64
  - build-typesense-arm64
  - build-sandbox-arm64

trigger:
  ref:
    include:
      - refs/tags/*

steps:
  # Step 1: Provision VM image and upload to R2
  # Boots a QEMU VM, installs Helix using pre-built ARM64 Docker images,
  # compresses the disk with zstd, and uploads to R2 CDN.
  # This updates vm-manifest.json in the working tree for build-app to embed.
  - name: provision-vm
    environment:
      PATH: /opt/homebrew/bin:/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin:/Users/luke/go/bin
      R2_ACCESS_KEY_ID:
        from_secret: r2_access_key_id
      R2_SECRET_ACCESS_KEY:
        from_secret: r2_secret_access_key
      R2_ENDPOINT: https://f0150e619c6dc08f55aea6d2248b1c6c.r2.cloudflarestorage.com
      R2_BUCKET: helix-desktop
    commands:
      - export HOME=/Users/luke
      # Fail fast if R2 credentials are missing
      - |
        if [ -z "$R2_ACCESS_KEY_ID" ] || [ -z "$R2_SECRET_ACCESS_KEY" ]; then
          echo "ERROR: R2 credentials not set. Check Drone secrets r2_access_key_id and r2_secret_access_key."
          exit 1
        fi
        echo "R2 credentials verified (endpoint: $R2_ENDPOINT)"
      # Run provisioning with upload
      # Uses /Volumes/Big for VM disk (fast SSD on the runner)
      - |
        if [ -n "$DRONE_TAG" ]; then PROV_VERSION="$DRONE_TAG"; else PROV_VERSION=$(echo $DRONE_COMMIT_SHA | head -c 9); fi
        cd for-mac
        HELIX_VM_DIR=/Volumes/Big/helix-vm/ci-provision \
        VM_VERSION="$PROV_VERSION" \
        bash scripts/provision-vm-light.sh \
          --helix-version "$PROV_VERSION" \
          --upload
      # Clean up VM disk (no longer needed after upload to R2)
      - rm -rf /Volumes/Big/helix-vm/ci-provision

  # Step 2: Build Helix.app with embedded QEMU, frameworks, and vm-manifest.json
  - name: build-app
    environment:
      PATH: /opt/homebrew/bin:/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin:/Users/luke/go/bin
      KEYCHAIN_PASSWORD:
        from_secret: keychain_password
      APPLE_SIGNING_IDENTITY:
        from_secret: apple_signing_identity
    commands:
      - export HOME=/Users/luke
      # Unlock CI keychain for codesign access to Developer ID cert
      - security unlock-keychain -p "$KEYCHAIN_PASSWORD" /Users/luke/Library/Keychains/Helix-Dev.keychain-db
      - security list-keychains -d user -s /Users/luke/Library/Keychains/Helix-Dev.keychain-db /Users/luke/Library/Keychains/login.keychain-db
      # Create .env.signing so build scripts use Developer ID instead of ad-hoc
      - echo "APPLE_SIGNING_IDENTITY='$APPLE_SIGNING_IDENTITY'" > for-mac/.env.signing
      - cd for-mac
      - ./scripts/build-helix-app.sh

  # Step 3: Create DMG, sign, notarize, upload to R2
  - name: create-dmg
    environment:
      PATH: /opt/homebrew/bin:/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin:/Users/luke/go/bin
      KEYCHAIN_PASSWORD:
        from_secret: keychain_password
      APPLE_SIGNING_IDENTITY:
        from_secret: apple_signing_identity
      R2_ACCESS_KEY_ID:
        from_secret: r2_access_key_id
      R2_SECRET_ACCESS_KEY:
        from_secret: r2_secret_access_key
    commands:
      - export HOME=/Users/luke
      # Unlock CI keychain
      - security unlock-keychain -p "$KEYCHAIN_PASSWORD" /Users/luke/Library/Keychains/Helix-Dev.keychain-db
      - security list-keychains -d user -s /Users/luke/Library/Keychains/Helix-Dev.keychain-db /Users/luke/Library/Keychains/login.keychain-db
      # Create .env.signing for create-dmg's signing step
      - echo "APPLE_SIGNING_IDENTITY='$APPLE_SIGNING_IDENTITY'" > for-mac/.env.signing
      - cd for-mac
      # Build DMG (no upload yet — notarize first)
      - |
        if [ -n "$DRONE_TAG" ]; then DMG_VER="$DRONE_TAG"; else DMG_VER=$(echo $DRONE_COMMIT_SHA | head -c 7); fi
        ./scripts/create-dmg.sh --skip-styling --version "$DMG_VER"
      # Notarize with Helix-Dev keychain, then staple ticket into DMG
      - |
        xcrun notarytool submit build/bin/Helix-for-Mac.dmg \
          --keychain-profile "helix-notarize" \
          --keychain /Users/luke/Library/Keychains/Helix-Dev.keychain-db \
          --wait
      - xcrun stapler staple build/bin/Helix-for-Mac.dmg
      # Upload notarized+stapled DMG to R2
      - |
        export AWS_ACCESS_KEY_ID="$R2_ACCESS_KEY_ID"
        export AWS_SECRET_ACCESS_KEY="$R2_SECRET_ACCESS_KEY"
        if [ -n "$DRONE_TAG" ]; then DMG_VERSION="$DRONE_TAG"; else DMG_VERSION=$(echo $DRONE_COMMIT_SHA | head -c 7); fi
        echo "Uploading DMG for version: $DMG_VERSION"
        aws s3 cp build/bin/Helix-for-Mac.dmg \
          "s3://helix-desktop/desktop/$DMG_VERSION/Helix-for-Mac.dmg" \
          --endpoint-url "https://f0150e619c6dc08f55aea6d2248b1c6c.r2.cloudflarestorage.com" \
          --no-progress
      # Upload latest.json pointer for update checking
      - |
        if [ -n "${DRONE_TAG}" ]; then
          export AWS_ACCESS_KEY_ID="$R2_ACCESS_KEY_ID"
          export AWS_SECRET_ACCESS_KEY="$R2_SECRET_ACCESS_KEY"
          echo "{\"version\":\"${DRONE_TAG}\",\"dmg_url\":\"https://dl.helix.ml/desktop/${DRONE_TAG}/Helix-for-Mac.dmg\",\"vm_url\":\"https://dl.helix.ml/vm/${DRONE_TAG}/disk.qcow2.zst\"}" | \
            aws s3 cp - "s3://helix-desktop/desktop/latest.json" \
              --endpoint-url "https://f0150e619c6dc08f55aea6d2248b1c6c.r2.cloudflarestorage.com" \
              --content-type "application/json" \
              --no-progress
        fi