cli-check.yml

name: CLI Check


on:
  push:
    branches: [main]
    paths:
      - 'plugins/greptile/scripts/**'
      - 'plugins/greptile/skills/**'
      - '.github/workflows/cli-check.yml'
  pull_request:
    paths:
      - 'plugins/greptile/scripts/**'
      - 'plugins/greptile/skills/**'
      - '.github/workflows/cli-check.yml'
  schedule:
    - cron: '41 8 * * *'
  workflow_dispatch:

permissions:
  contents: read

jobs:
  check:
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4

      - name: Recorded version is well formed
        run: |
          set -euo pipefail
          version=$(tr -d '[:space:]' < plugins/greptile/scripts/greptile.version)
          if ! printf '%s' "$version" | grep -qE '^[0-9]+\.[0-9]+\.[0-9]+$'; then
            echo "::error::plugins/greptile/scripts/greptile.version is not a plain semver string."
            exit 1
          fi
          printf '%s' "$version" > "$RUNNER_TEMP/version.txt"
          echo "Recorded version $version"

      - name: Bundle runs and reports the recorded version
        run: |
          set -euo pipefail
          version=$(cat "$RUNNER_TEMP/version.txt")
          reported=$(node plugins/greptile/scripts/greptile.mjs --version | tr -d '[:space:]')
          if [ "$reported" != "$version" ]; then
            echo "::error::Vendored bundle reports $reported but greptile.version records $version."
            exit 1
          fi
          echo "Bundle reports $reported."

      - name: Login and review run outside the checkout
        run: |
          set -euo pipefail
          mkdir -p "$RUNNER_TEMP/installed plugin/scripts"
          cp plugins/greptile/scripts/greptile.mjs "$RUNNER_TEMP/installed plugin/scripts/greptile.mjs"
          cd "$RUNNER_TEMP"
          GREPTILE_NO_UPDATE_CHECK=1 node "$RUNNER_TEMP/installed plugin/scripts/greptile.mjs" login --help
          GREPTILE_NO_AUTO_INSTALL=1 GREPTILE_NO_UPDATE_CHECK=1 node "$RUNNER_TEMP/installed plugin/scripts/greptile.mjs" review --agent --help

      - name: Bundle is byte-identical to the published npm release
        run: |
          set -euo pipefail
          version=$(cat "$RUNNER_TEMP/version.txt")
          cd "$RUNNER_TEMP"
          npm pack "greptile@$version" >/dev/null
          tar -xzf "greptile-$version.tgz"
          cd "$GITHUB_WORKSPACE"
          published=$(shasum -a 256 "$RUNNER_TEMP/package/dist/greptile.js" | cut -d' ' -f1)
          vendored=$(shasum -a 256 plugins/greptile/scripts/greptile.mjs | cut -d' ' -f1)
          if [ "$published" != "$vendored" ]; then
            echo "::error::Vendored bundle does not match npm greptile@$version. published=$published vendored=$vendored. Re-vendor with: npm pack greptile@$version && tar -xzf greptile-$version.tgz && cp package/dist/greptile.js plugins/greptile/scripts/greptile.mjs"
            exit 1
          fi
          echo "Vendored bundle matches npm greptile@$version ($vendored)."

      - name: Commands invoke the vendored bundle, not a fetched one
        run: |
          set -euo pipefail
          for f in plugins/greptile/skills/review/SKILL.md plugins/greptile/skills/login/SKILL.md; do
            block=$(awk '/^```/{fence = !fence; next} fence' "$f")
            if [ -z "$block" ]; then
              echo "::error::$f has no fenced command block to validate."
              exit 1
            fi
            if grep -q 'npx' <<<"$block"; then
              echo "::error::$f still fetches the CLI with npx. The plugin vendors it; invoke <plugin-root>/scripts/greptile.mjs instead."
              exit 1
            fi
            if ! grep -qF 'node "<plugin-root>/scripts/greptile.mjs"' <<<"$block"; then
              echo "::error::$f does not invoke the vendored bundle at <plugin-root>/scripts/greptile.mjs."
              exit 1
            fi
            if ! grep -qF 'GREPTILE_NO_UPDATE_CHECK=1 node "<plugin-root>/scripts/greptile.mjs"' <<<"$block"; then
              echo "::error::$f invokes the vendored bundle without GREPTILE_NO_UPDATE_CHECK=1. CLI versions that predate plugin-install detection read this path as a standalone install and name an installer that cannot update the plugin's copy. --agent already suppresses the notice, so this is a second line of defence for invocations that drop it."
              exit 1
            fi
          done
          echo "Commands invoke the vendored bundle with the update check disabled."

      - name: Review command suppresses the renderer download
        run: |
          set -euo pipefail
          block=$(awk '/^```/{fence = !fence; next} fence' plugins/greptile/skills/review/SKILL.md)
          if ! grep -qF 'GREPTILE_NO_AUTO_INSTALL=1 GREPTILE_NO_UPDATE_CHECK=1 node "<plugin-root>/scripts/greptile.mjs"' <<<"$block"; then
            echo "::error::plugins/greptile/skills/review/SKILL.md must invoke the bundle with GREPTILE_NO_AUTO_INSTALL=1 ahead of GREPTILE_NO_UPDATE_CHECK=1. README.md tells users the plugin never downloads the mmdr renderer; this is what makes that true."
            exit 1
          fi
          echo "Review command suppresses the renderer download."