ci.yml

name: CI

on:
  push:
    branches: [main, feat-atlas]
  pull_request:
    branches: [main]

permissions:
  contents: read

jobs:
  frontend:
    name: Frontend
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.2.2

      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
        with:
          node-version: 22
          cache: npm

      - name: Remove non-app workspaces
        run: |
          node -e "const fs=require('fs'),p=JSON.parse(fs.readFileSync('package.json','utf8'));p.workspaces=p.workspaces.filter(w=>w!=='web'&&w!=='docs');fs.writeFileSync('package.json',JSON.stringify(p,null,2))"
          rm -rf web docs
          npm install --package-lock-only --ignore-scripts

      - name: Install dependencies
        run: npm ci

      - name: Type check
        run: npx tsc --noEmit

      - name: Build frontend
        run: npm run build:frontend

  rust:
    name: Rust
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.2.2

      - uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable

      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.8.1
        with:
          workspaces: src-tauri -> src-tauri/target

      - name: Install system dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y \
            libwebkit2gtk-4.1-dev \
            libappindicator3-dev \
            librsvg2-dev \
            patchelf \
            libxdo-dev

      - name: Stub atlas bundle for cargo check
        run: mkdir -p src-tauri/resources/atlas && touch src-tauri/resources/atlas/.keep

      - name: Stub cloudflared sidecar for cargo check
        run: mkdir -p src-tauri/binaries && touch src-tauri/binaries/cloudflared-x86_64-unknown-linux-gnu

      - name: Check
        working-directory: src-tauri
        run: cargo check

      - name: Test
        working-directory: src-tauri
        run: cargo test

  macos-atlas-probe:
    name: macOS Atlas spawn probe
    runs-on: macos-latest
    steps:
      # macOS GUI apps launched via LaunchServices / Finder inherit a minimal
      # PATH — no /opt/homebrew/bin, no /usr/local/bin, no nvm/volta/fnm shims.
      # That's why `Command::new("node").spawn()` in start_atlas_index used to
      # fail with `os error 2` even though `node` works from the user's shell
      # (issue #36). This job asserts the strategies `resolve_node()` in
      # src-tauri/src/lib.rs relies on still succeed on stock macOS runners:
      # login-shell resolution and the hardcoded homebrew paths.
      - name: Assert node resolves under Finder-launched restricted PATH
        shell: bash
        run: |
          set -eo pipefail
          env -i HOME="$HOME" PATH=/usr/bin:/bin:/usr/sbin:/sbin bash -euo pipefail -c '
            echo "PATH=$PATH"
            # Direct lookup MUST fail — this is the bug we simulate.
            if command -v node >/dev/null 2>&1; then
              echo "UNEXPECTED: node on restricted PATH — probe no longer simulates the bug"; exit 1
            fi
            echo "confirmed: node NOT on restricted PATH"

            # Strategy 1 (primary): login shell honors user dotfiles/nvm/volta/fnm.
            resolved=$(/bin/sh -lc "command -v node" || true)
            if [ -n "$resolved" ] && [ -x "$resolved" ]; then
              echo "OK login-shell: $resolved ($($resolved --version))"
            else
              echo "FAIL login-shell resolution"; exit 1
            fi

            # Strategy 2 (fallback): hardcoded homebrew paths.
            found=""
            for p in /opt/homebrew/bin/node /usr/local/bin/node; do
              if [ -x "$p" ]; then found="$p"; break; fi
            done
            if [ -n "$found" ]; then
              echo "OK hardcoded: $found ($($found --version))"
            else
              echo "FAIL no hardcoded path exists"; exit 1
            fi
          '