autoflow-ci.yml

name: AutoFlow CI

on:
  push:
    branches: [main, dev]
  pull_request:
    branches: [main, dev]
  workflow_call:
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: ci-${{ github.ref }}
  cancel-in-progress: true

jobs:
  dependency-review:
    if: github.event_name == 'pull_request'
    runs-on: ubuntu-latest
    permissions:
      contents: read
      pull-requests: write
    steps:
      # v5.0.0
      - uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294
        with:
          fail-on-severity: high

  autoflow-ci:
    runs-on: ubuntu-latest
    timeout-minutes: 30
    steps:
      # v7.0.1
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        with:
          # #1156 R11: test the exact attested SHA — the PR head on
          # pull_request, github.sha on push/workflow_call/workflow_dispatch —
          # never checkout's default synthetic merge ref.
          ref: ${{ github.event.pull_request.head.sha || github.sha }}
          fetch-depth: 0
          persist-credentials: false
      # #1156 (B2.6): mature OSS governance gates (ADR-0144) — fail fast,
      # before the heavy matrix. Binaries pinned by version + SHA-256;
      # zizmor-action pinned in tools/check-action-pins.ts.
      - name: actionlint (workflow lint)
        run: |
          curl -sSfL -o /tmp/actionlint.tar.gz \
            https://github.com/rhysd/actionlint/releases/download/v1.7.12/actionlint_1.7.12_linux_amd64.tar.gz
          echo "8aca8db96f1b94770f1b0d72b6dddcb1ebb8123cb3712530b08cc387b349a3d8  /tmp/actionlint.tar.gz" | sha256sum -c -
          tar -xzf /tmp/actionlint.tar.gz -C /tmp actionlint
          /tmp/actionlint -color
      # v0.6.3
      - uses: zizmorcore/zizmor-action@70fb788f84895a7701f5643d103d587e460b5c99
        with:
          # Offline audits only: this gate must be deterministic and
          # reproducible locally (`zizmor --offline .github/workflows
          # .github/actions`); network-dependent audits stay out of CI.
          online-audits: false
          advanced-security: false
          version: '1.30.0'
      - name: gitleaks (secret scan)
        run: |
          curl -sSfL -o /tmp/gitleaks.tar.gz \
            https://github.com/gitleaks/gitleaks/releases/download/v8.30.1/gitleaks_8.30.1_linux_x64.tar.gz
          echo "551f6fc83ea457d62a0d98237cbad105af8d557003051f41f3e7ca7b3f2470eb  /tmp/gitleaks.tar.gz" | sha256sum -c -
          tar -xzf /tmp/gitleaks.tar.gz -C /tmp gitleaks
          /tmp/gitleaks git --redact --verbose .
      - uses: ./.github/actions/setup-deno-workspace
      # ADR-0144 / #1229 (B2.7): generic toolchain gates are pinned OSS tool steps, not AutoFlow gates.
      - run: deno fmt --check
      - run: deno lint
      - run: deno task lint:markdown
      - run: deno task typecheck
      - name: Install Playwright browsers
        # All three engines up front: the gate's fixture:request-time:gate
        # runs the request-time fixture suite on Chromium, Firefox and WebKit.
        run: ./node_modules/.bin/playwright install --with-deps chromium firefox webkit
      - name: AutoFlow3 CI gate
        run: deno task autoflow:ci
      # #1232 (B2.10): e2e failures must be inspectable — the 'github'
      # reporter annotates the run inline, and this step publishes the
      # Playwright HTML report + per-test traces/screenshots on failure.
      - name: Upload Playwright failure artifacts
        if: failure()
        # v7.0.1
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
        with:
          name: playwright-failure-artifacts-${{ github.run_id }}-${{ github.run_attempt }}
          path: |
            www/e2e/test-results
            www/e2e/playwright-report
            e2e/starter-smoke/test-results
            packages/adapter-vite/__fixtures__/request-time/e2e/test-results
            packages/adapter-vite/__fixtures__/ui-dogfood/e2e/test-results
          if-no-files-found: ignore
          retention-days: 14

  # Issue #628 (first slice): the generated dist/server artifact must boot
  # under plain Node, not just under the Deno CLI (#969). The runtime floor
  # is Node.js >= 24 (WHATWG URLPattern global), so the matrix asserts real
  # serving on 24 and the clean early error on 20.
  node-serve-smoke:
    name: dist/server Node smoke (Node ${{ matrix.node }})
    runs-on: ubuntu-latest
    timeout-minutes: 10
    strategy:
      fail-fast: false
      matrix:
        node: ['20', '24']
    steps:
      # v7.0.1
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        with:
          # #1156 R11: same exact-SHA expression as every required job.
          ref: ${{ github.event.pull_request.head.sha || github.sha }}
          persist-credentials: false
      - uses: ./.github/actions/setup-deno-workspace
      # v7.0.0
      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
        with:
          node-version: ${{ matrix.node }}
      - name: Build the request-time fixture
        run: deno task fixture:request-time:build
      - name: Shim @openelement/adapter-vite/nitro-mount for Node resolution
        # The workspace publishes to JSR, so plain Node cannot resolve the
        # bare specifier the generated index.js imports. Materialize the
        # exact nitro-mount an npm consumer would get, transpiled from the
        # real source (type-only imports drop out). The shim lives under
        # dist/node_modules: on Node's resolution path from
        # dist/server/index.js, but invisible to the fixture's own Vite
        # config resolution (which walks up from the fixture root).
        run: |
          shim=packages/adapter-vite/__fixtures__/request-time/dist/node_modules/@openelement/adapter-vite
          mkdir -p "$shim"
          ./node_modules/.bin/esbuild packages/adapter-vite/src/nitro-mount.ts \
            --format=esm --outfile="$shim/nitro-mount.js"
          printf '{ "name": "@openelement/adapter-vite", "version": "0.0.0-smoke", "type": "module", "exports": { "./nitro-mount": "./nitro-mount.js" } }\n' \
            > "$shim/package.json"
      - name: Boot dist/server/serve.mjs under Node ${{ matrix.node }}
        working-directory: packages/adapter-vite/__fixtures__/request-time
        run: |
          set -u
          if [ "${{ matrix.node }}" = "24" ]; then
            OPEN_ELEMENT_PORT=4891 OPEN_ELEMENT_HOST=127.0.0.1 node dist/server/serve.mjs &
            server_pid=$!
            trap 'kill $server_pid 2>/dev/null || true' EXIT
            for _ in $(seq 1 50); do
              curl -sf -o /dev/null http://127.0.0.1:4891/ && break
              sleep 0.2
            done
            curl -sf http://127.0.0.1:4891/ | grep -q 'request-time fixture home'
            curl -sf http://127.0.0.1:4891/live | grep -q 'request-time live'
          else
            # Below the URLPattern floor (#969): serve.mjs must fail fast
            # with guidance, not a SyntaxError/ReferenceError.
            if node dist/server/serve.mjs > serve-error.log 2>&1; then
              echo 'expected a clean early exit below the runtime floor'
              exit 1
            fi
            grep -q 'requires a runtime with WHATWG URLPattern' serve-error.log
          fi

  # #1276 (B1.3-F1): the definePage route SSR tag-mismatch defect shipped
  # because the workspace runtime qualification was not CI-gated. Run the full
  # qualification leg (starter build -> Node 24 standalone + Wrangler workerd,
  # byte-identical HTML across both) as a required CI job so this defect class
  # cannot regress silently. Needs real Node 24 (the serve.mjs runtime floor,
  # #969) — the autoflow-ci job itself has no Node setup.
  workspace-qualification:
    runs-on: ubuntu-latest
    timeout-minutes: 20
    steps:
      # v7.0.1
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        with:
          # #1156 R11: same exact-SHA expression as every required job.
          ref: ${{ github.event.pull_request.head.sha || github.sha }}
          persist-credentials: false
      - uses: ./.github/actions/setup-deno-workspace
      # v7.0.0
      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
        with:
          node-version: '24'
      - name: Workspace runtime qualification (Node 24 + workerd)
        run: deno task fullstack:workspace-qualification

  # #1228 (B2.5): the deployment guide and PACKAGE_SURFACE.md claim the
  # generated dist/server artifacts run on Bun. A claim that survives only on
  # local evidence is an overclaim, so the same fixture the Node legs serve is
  # booted under a pinned Bun here: real server, real HTTP probes.
  bun-serve-smoke:
    name: dist/server Bun smoke
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      # v7.0.1
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        with:
          # #1156 R11: same exact-SHA expression as every required job.
          ref: ${{ github.event.pull_request.head.sha || github.sha }}
          persist-credentials: false
      - uses: ./.github/actions/setup-deno-workspace
      - name: Install Bun 1.4.1 (version + SHA-256 pinned)
        run: |
          curl -sSfL -o /tmp/bun.zip \
            https://github.com/oven-sh/bun/releases/download/bun-v1.4.1/bun-linux-x64.zip
          echo "74c1c3bee7cd998500c8f969cd8972355ac6a07207e94a39eece1999b56ffabf  /tmp/bun.zip" | sha256sum -c -
          unzip -q /tmp/bun.zip -d /tmp/bun
          echo "/tmp/bun/bun-linux-x64" >> "$GITHUB_PATH"
      - name: Build the request-time fixture
        run: deno task fixture:request-time:build
      - name: Boot dist/server/serve.mjs under Bun
        working-directory: packages/adapter-vite/__fixtures__/request-time
        run: |
          set -u
          OPEN_ELEMENT_PORT=4893 OPEN_ELEMENT_HOST=127.0.0.1 bun dist/server/serve.mjs &
          server_pid=$!
          trap 'kill $server_pid 2>/dev/null || true' EXIT
          for _ in $(seq 1 50); do
            curl -sf -o /dev/null http://127.0.0.1:4893/ && break
            sleep 0.2
          done
          curl -sf http://127.0.0.1:4893/ | grep -q 'request-time fixture home'
          curl -sf http://127.0.0.1:4893/live | grep -q 'request-time live'

  # #1156 (ADR-0146): one deterministic exact-SHA PR full-CI evidence artifact.
  # This job runs only for pull requests and only after every required
  # full-matrix job succeeded (default needs gating — no `if: always()`), so a
  # failed, skipped or cancelled matrix leg produces no artifact at all. The
  # record is derived from trusted workflow context (github.* / needs.*),
  # never from user-controlled inputs; the release lane independently resolves
  # the run through the GitHub API before trusting any field.
  pr-full-ci-evidence:
    name: pr-full-ci-evidence
    if: github.event_name == 'pull_request'
    needs: [
      dependency-review,
      autoflow-ci,
      node-serve-smoke,
      bun-serve-smoke,
      workspace-qualification,
    ]
    runs-on: ubuntu-latest
    timeout-minutes: 5
    permissions:
      contents: read
    steps:
      # v7.0.1
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        with:
          # #1156 R11: the aggregation job checks out the exact SHA it attests.
          ref: ${{ github.event.pull_request.head.sha || github.sha }}
          persist-credentials: false
      - uses: ./.github/actions/setup-deno-workspace
      - name: Write exact-SHA PR CI evidence record
        env:
          # R11: one trusted expression for checkout, attestation and naming.
          HEAD_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
          RUN_ID: ${{ github.run_id }}
          RUN_ATTEMPT: ${{ github.run_attempt }}
          REPOSITORY: ${{ github.repository }}
          EVENT_NAME: ${{ github.event_name }}
          NEEDS_JSON: ${{ toJSON(needs) }}
          RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
        run: deno run --allow-env --allow-write tools/autoflow/write-pr-ci-evidence.ts
      # v7.0.1
      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
        with:
          name: pr-full-ci-evidence-${{ github.event.pull_request.head.sha || github.sha }}
          path: pr-full-ci-evidence.json
          if-no-files-found: error
          retention-days: 90