ci.yml

name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
    types: [opened, synchronize, reopened]
  merge_group:
    types: [checks_requested]
  workflow_dispatch:

concurrency:
  group: ci-${{ github.workflow }}-${{ github.ref }}
  # A newer PR commit supersedes stale evidence; the required aggregate must
  # still fail closed if cancellation reaches its dependencies.
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

permissions:
  contents: read

jobs:
  static:
    name: static
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - uses: ./.github/actions/setup-python-tests
        with:
          python-version: "3.12"
      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: "24"
          package-manager-cache: false
      - run: make lint-full
      - run: make typecheck
      - run: make architecture
      - run: make todo-check
      - run: make import-contracts
      - run: make docs-linkcheck
      - run: make npm-test
      - run: make build
      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: dist
          path: dist/

  python:
    name: python (${{ matrix.lane }})
    runs-on: ubuntu-latest
    timeout-minutes: ${{ matrix.timeout-minutes }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - lane: unit
            timeout-minutes: 10
          - lane: component
            timeout-minutes: 15
          - lane: domain
            timeout-minutes: 15
          - lane: composition
            timeout-minutes: 25
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - uses: ./.github/actions/setup-python-tests
        with:
          python-version: "3.12"
      - uses: ./.github/actions/run-test-lane
        with:
          lane: ${{ matrix.lane }}
          junit-artifact: junit-python-${{ matrix.lane }}-3.12
          coverage-artifact: coverage-data-python-${{ matrix.lane }}
          coverage-file: .coverage.python-${{ matrix.lane }}

  boundaries:
    name: boundaries (${{ matrix.lane }})
    runs-on: ubuntu-latest
    timeout-minutes: 25
    strategy:
      fail-fast: false
      matrix:
        lane: [process, mcp]
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - uses: ./.github/actions/setup-python-tests
        with:
          python-version: "3.12"
      - uses: ./.github/actions/run-test-lane
        with:
          lane: ${{ matrix.lane }}
          junit-artifact: junit-${{ matrix.lane }}-3.12
          coverage-artifact: coverage-data-${{ matrix.lane }}
          coverage-file: .coverage.${{ matrix.lane }}

  wheel:
    name: wheel (Python ${{ matrix.python-version }})
    needs: [static]
    runs-on: ubuntu-latest
    timeout-minutes: 10
    strategy:
      fail-fast: false
      matrix:
        python-version: ["3.12", "3.13"]
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: ${{ matrix.python-version }}
      - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
        with:
          version: "0.11.28"
      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: dist
          path: dist
      - name: Install and start the built wheel
        run: |
          wheel="$(find dist -maxdepth 1 -name '*.whl' -print -quit)"
          test -n "$wheel"
          environment="$RUNNER_TEMP/jacobian-wheel-${{ matrix.python-version }}"
          uv venv --python "${{ matrix.python-version }}" "$environment"
          uv pip install --python "$environment/bin/python" \
            --only-binary :all: "$wheel"
          "$environment/bin/jacobian" --help
          "$environment/bin/jacobian-mcp" --help
          "$environment/bin/jacobian" run integer.compute.gcd \
            --json '{"left":"84","right":"30"}'
      - if: matrix.python-version == '3.13'
        uses: ./.github/actions/setup-python-tests
        with:
          python-version: "3.13"
      - if: matrix.python-version == '3.13'
        run: make test-compatibility
        env:
          PYTEST_ARGS: --junitxml=pytest.xml

  lean:
    name: Lean Runtime
    # Full Lean is the merge-group/main gate. Pull requests skip it so
    # intermediate commits are not blocked for the ~14 minute specialist suite.
    # Enable GitHub merge queue on main; otherwise Lean only runs after a
    # push to main.
    if: github.event_name != 'pull_request'
    runs-on: ubuntu-latest
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: Prepare Lean test environment
        uses: ./.github/actions/setup-lean
      - run: make test-lean

  coverage:
    name: Coverage
    if: ${{ always() }}
    needs: [python, boundaries]
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - name: Require python and boundary lanes
        env:
          PYTHON_RESULT: ${{ needs.python.result }}
          BOUNDARIES_RESULT: ${{ needs.boundaries.result }}
        run: |
          test "$PYTHON_RESULT" = success
          test "$BOUNDARIES_RESULT" = success
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - uses: ./.github/actions/setup-python-tests
        with:
          python-version: "3.12"
      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          pattern: coverage-data-*
          path: coverage-data
          merge-multiple: true
      - run: uv run --locked coverage combine coverage-data
      - run: uv run --locked coverage report --fail-under=50 | tee coverage-report.txt
        shell: bash -o pipefail {0}
      - run: uv run --locked coverage xml
      - name: Publish coverage summary
        run: |
          {
            echo "## Coverage Report"
            echo ""
            echo '```'
            cat coverage-report.txt
            echo '```'
          } >> "$GITHUB_STEP_SUMMARY"
      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: coverage-3.12
          path: coverage.xml

  required:
    name: required
    if: ${{ always() }}
    needs: [static, python, boundaries, wheel, coverage, lean]
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
      - name: Require static python boundaries wheel coverage and selected specialist lanes
        env:
          EVENT_NAME: ${{ github.event_name }}
          STATIC_RESULT: ${{ needs.static.result }}
          PYTHON_RESULT: ${{ needs.python.result }}
          BOUNDARIES_RESULT: ${{ needs.boundaries.result }}
          WHEEL_RESULT: ${{ needs.wheel.result }}
          COVERAGE_RESULT: ${{ needs.coverage.result }}
          LEAN_RESULT: ${{ needs.lean.result }}
        run: |
          test "$STATIC_RESULT" = success
          test "$PYTHON_RESULT" = success
          test "$BOUNDARIES_RESULT" = success
          test "$WHEEL_RESULT" = success
          test "$COVERAGE_RESULT" = success
          if [ "$EVENT_NAME" = pull_request ]; then
            test "$LEAN_RESULT" = skipped || test "$LEAN_RESULT" = success
          else
            test "$LEAN_RESULT" = success
          fi