ci.yml

name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

jobs:
  build-and-test:
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, windows-latest]
        node-version: [20, 22]

    steps:
      - uses: actions/checkout@v4

      - name: Use Node.js ${{ matrix.node-version }}
        uses: actions/setup-node@v4
        with:
          node-version: ${{ matrix.node-version }}
          cache: npm

      # ripgrep is required by the grep "never-worse" gate (ADR-0007): the
      # handler shells out to `rg` to size the agent's raw grep before deciding
      # to intercept. Without it the gate can't measure and passes through, so
      # the deny-path integration tests (bash/grep) see null instead of a packet.
      # Runners don't ship rg by default, so install it per-OS. These steps are
      # best-effort (continue-on-error): rg availability is an ENVIRONMENT detail,
      # not a code property, so an install hiccup (e.g. a flaky choco mirror) must
      # never red CI — the tests carry `it.skipIf(!HAS_RG)` and skip cleanly when
      # rg is absent. apt is reliable, so the gate is exercised for real on Linux.
      - name: Install ripgrep (Linux)
        if: runner.os == 'Linux'
        run: sudo apt-get update && sudo apt-get install -y ripgrep
        continue-on-error: true
      - name: Install ripgrep (Windows)
        if: runner.os == 'Windows'
        run: choco install ripgrep -y --no-progress
        continue-on-error: true
      - name: Report ripgrep availability (tests skip cleanly if absent)
        run: rg --version
        continue-on-error: true

      - name: Install dependencies
        run: npm ci

      - name: Typecheck
        run: npm run lint

      - name: Build
        run: npm run build

      - name: Test
        run: npx vitest run