ci.yml

name: CI
on:
  push:
    branches: [main]
  pull_request:

concurrency:
  group: ci-${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true

jobs:
  changes:
    runs-on: ubuntu-latest
    outputs:
      native: ${{ steps.filter.outputs.native }}
      cli: ${{ steps.filter.outputs.cli }}
    steps:
      - uses: actions/checkout@v6
      - uses: dorny/paths-filter@v3
        id: filter
        with:
          filters: |
            # Desktop host dependency closure: the Tauri package itself plus
            # the two shared crates it links. Keep platform-specific compile
            # and lifecycle coverage on every relevant PR.
            native:
              - 'src-tauri/Cargo.toml'
              - 'src-tauri/Cargo.lock'
              - 'src-tauri/build.rs'
              - 'src-tauri/tauri.conf.json'
              - 'src-tauri/capabilities/**'
              - 'src-tauri/src/**'
              - 'src-tauri/crates/altai-core/**'
              - 'src-tauri/crates/altai-agent-service/**'
              - '.github/workflows/ci.yml'
            # CLI dependency closure. Desktop-only Rust changes do not need
            # to pay for a release CLI build on three operating systems.
            cli:
              - 'src-tauri/Cargo.toml'
              - 'src-tauri/Cargo.lock'
              - 'src-tauri/crates/altai-cli/**'
              - 'src-tauri/crates/altai-core/**'
              - 'src-tauri/crates/altai-agent-service/**'
              - 'src-tauri/crates/altai-protocol/**'
              - 'scripts/stage-altai-cli.mjs'
              - '.github/workflows/ci.yml'

  rust:
    name: rust (${{ matrix.os }})
    needs: changes
    if: needs.changes.outputs.native == 'true'
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        # Compile-check on every target so the platform-gated native code
        # (macOS Dock menu / Windows Jump List) is verified on PRs, not just at
        # release time. The full clippy + test pass runs on Linux only to keep
        # CI fast.
        os: [ubuntu-22.04, windows-latest, macos-14]
    steps:
      - uses: actions/checkout@v6

      - name: Install Linux build dependencies
        if: runner.os == 'Linux'
        # Tauri 2 needs webkit2gtk-4.1 + the ayatana appindicator. Mirrors the
        # canonical set from release.yml — keep these in sync.
        run: |
          sudo apt-get update
          sudo apt-get install -y \
            libwebkit2gtk-4.1-dev \
            librsvg2-dev \
            patchelf \
            build-essential \
            libssl-dev \
            libayatana-appindicator3-dev \
            libgtk-3-dev \
            libsoup-3.0-dev \
            libjavascriptcoregtk-4.1-dev

      - uses: dtolnay/rust-toolchain@stable
        with:
          components: clippy

      - uses: Swatinem/rust-cache@v2
        with:
          workspaces: src-tauri -> target
          key: ${{ matrix.os }}

      # Tauri validates platform externalBin paths during cargo check. The
      # cli-smoke job builds and validates the real sidecar on every platform;
      # this lightweight placeholder keeps the compile matrix focused on Rust.
      - name: Create sidecar placeholder for compile checks
        if: runner.os != 'macOS'
        shell: bash
        run: |
          if [ "$RUNNER_OS" = "Windows" ]; then
            target=x86_64-pc-windows-msvc
            suffix=.exe
          else
            target=x86_64-unknown-linux-gnu
            suffix=''
          fi
          mkdir -p src-tauri/binaries
          : > "src-tauri/binaries/altai-cli-${target}${suffix}"

      - run: cargo check --manifest-path src-tauri/Cargo.toml

      - name: Lifecycle hook smoke tests
        # These execute the platform shell and process-tree guard, so a
        # compile-only Windows/macOS job cannot mask runtime incompatibility.
        # `evaluate_all_allow` has sporadically dropped one PowerShell result
        # under hosted-Windows load. Retry this narrow smoke group once on
        # Windows only; a repeated failure still fails the matrix job.
        shell: bash
        run: |
          run_hook_smoke() {
            cargo test --manifest-path src-tauri/Cargo.toml 'orchestration::hooks::tests::' -- --test-threads=1
          }
          if ! run_hook_smoke; then
            if [ "$RUNNER_OS" != "Windows" ]; then
              exit 1
            fi
            echo "::warning::Retrying the Windows lifecycle hook smoke suite once after a known hosted-runner flake."
            run_hook_smoke
          fi

      - name: Clippy + tests (Linux only)
        if: runner.os == 'Linux'
        run: |
          cargo clippy --manifest-path src-tauri/Cargo.toml -- -D warnings
          cargo test --manifest-path src-tauri/Cargo.toml

  frontend-static:
    name: frontend static
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6

      - uses: pnpm/action-setup@v6
        with:
          version: 9

      - uses: actions/setup-node@v6
        with:
          node-version: '22'
          cache: pnpm

      - run: pnpm install --frozen-lockfile
      - run: pnpm exec tsc --noEmit
      - run: pnpm lint
      # TypeScript was checked above; call Vite directly so `pnpm build`
      # (`tsc && vite build`) does not type-check the whole app a second time.
      - run: pnpm exec vite build

  frontend-tests:
    name: frontend tests
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6

      - uses: pnpm/action-setup@v6
        with:
          version: 9

      - uses: actions/setup-node@v6
        with:
          node-version: '22'
          cache: pnpm

      - run: pnpm install --frozen-lockfile
      - run: pnpm test

  cli-smoke:
    name: altai-cli smoke (${{ matrix.label }})
    needs: changes
    if: needs.changes.outputs.cli == 'true'
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: ubuntu-22.04
            label: linux-x64
            rust_target: x86_64-unknown-linux-gnu
            binary: altai-cli
          - os: windows-latest
            label: win32-x64
            rust_target: x86_64-pc-windows-msvc
            binary: altai-cli.exe
          - os: macos-14
            label: darwin-arm64
            rust_target: aarch64-apple-darwin
            binary: altai-cli
    steps:
      - uses: actions/checkout@v6

      - uses: dtolnay/rust-toolchain@stable
        with:
          targets: ${{ matrix.rust_target }}

      - uses: Swatinem/rust-cache@v2
        with:
          workspaces: src-tauri -> target
          key: cli-smoke-${{ matrix.rust_target }}

      - name: Build altai-cli
        run: cargo build --manifest-path src-tauri/Cargo.toml -p altai-cli --release --target ${{ matrix.rust_target }}

      - name: Smoke installed-style command contract (Unix)
        if: runner.os != 'Windows'
        run: |
          BIN=src-tauri/target/${{ matrix.rust_target }}/release/altai-cli
          "$BIN" version --verbose
          "$BIN" doctor --json >/tmp/altai-doctor.json
          "$BIN" completion bash >/tmp/altai.bash
          "$BIN" open . --dry-run >/tmp/altai-open.json
          "$BIN" . --dry-run >/tmp/altai-agent.json
          "$BIN" . --prompt "smoke" --dry-run >/tmp/altai-run.json
          "$BIN" journal summary --json >/tmp/altai-journal.json || true
          python3 - <<'PY'
          import json
          for path in ("/tmp/altai-doctor.json", "/tmp/altai-open.json", "/tmp/altai-agent.json", "/tmp/altai-run.json"):
              with open(path) as f:
                  json.load(f)
          print("cli smoke ok")
          PY

      - name: Smoke installed-style command contract (Windows)
        if: runner.os == 'Windows'
        shell: bash
        run: |
          BIN=src-tauri/target/${{ matrix.rust_target }}/release/altai-cli.exe
          "$BIN" version --verbose
          "$BIN" doctor --json >"$RUNNER_TEMP/altai-doctor.json"
          "$BIN" completion powershell >"$RUNNER_TEMP/altai.ps1"
          "$BIN" open . --dry-run >"$RUNNER_TEMP/altai-open.json"
          "$BIN" . --dry-run >"$RUNNER_TEMP/altai-agent.json"
          "$BIN" . --prompt "smoke" --dry-run >"$RUNNER_TEMP/altai-run.json"
          "$BIN" journal summary --json >"$RUNNER_TEMP/altai-journal.json" || true
          python - <<PY
          import json, os
          root = os.environ["RUNNER_TEMP"]
          for name in ("altai-doctor.json", "altai-open.json", "altai-agent.json", "altai-run.json"):
              with open(os.path.join(root, name), encoding="utf-8-sig") as f:
                  json.load(f)
          print("cli smoke ok")
          PY

      - name: Stage installer sidecar
        shell: bash
        run: |
          node scripts/stage-altai-cli.mjs \
            --skip-build \
            --binary "src-tauri/target/${{ matrix.rust_target }}/release/${{ matrix.binary }}" \
            --target "${{ matrix.rust_target }}"
          test -f "src-tauri/binaries/altai-cli-${{ matrix.rust_target }}${{ runner.os == 'Windows' && '.exe' || '' }}"