platform-and-compat.yml

name: Platform & Compat
on:
  workflow_call:
    inputs:
      ref:
        description: Commit SHA or ref to test
        required: false
        type: string
      include_docker:
        description: Include Docker image build in this reusable test run
        required: false
        type: boolean
        default: true
  pull_request:
    branches:
      - main
  merge_group:
    branches:
      - main
    types:
      - checks_requested
  push:
    branches:
      - main

permissions:
  contents: read

concurrency:
  group: platform-and-compat-${{ github.event_name }}-${{ github.head_ref || github.ref }}
  cancel-in-progress: true

env:
  # Tests must never touch the real OS keychain (macOS Keychain auth dialog /
  # Linux Secret Service). Guarded by src/secrets/keychain.rs::os_keychain_suppressed:
  # cfg!(test) covers unit tests; this covers integration/e2e that link the
  # non-cfg(test) library.
  IRONCLAW_DISABLE_OS_KEYCHAIN: "1"

jobs:
  changes:
    name: Detect code changes
    runs-on: ubuntu-latest
    outputs:
      docs_only: ${{ steps.non_diff.outputs.docs_only || steps.diff.outputs.docs_only }}
      has_core_code: ${{ steps.non_diff.outputs.has_core_code || steps.diff.outputs.has_core_code }}
      has_engine_replay_risk: ${{ steps.non_diff.outputs.has_engine_replay_risk || steps.diff.outputs.has_engine_replay_risk }}
      has_runtime_heavy_risk: ${{ steps.non_diff.outputs.has_runtime_heavy_risk || steps.diff.outputs.has_runtime_heavy_risk }}
      has_web_risk: ${{ steps.non_diff.outputs.has_web_risk || steps.diff.outputs.has_web_risk }}
      has_wasm_abi_risk: ${{ steps.non_diff.outputs.has_wasm_abi_risk || steps.diff.outputs.has_wasm_abi_risk }}
      has_telegram_risk: ${{ steps.non_diff.outputs.has_telegram_risk || steps.diff.outputs.has_telegram_risk }}
      has_slack_risk: ${{ steps.non_diff.outputs.has_slack_risk || steps.diff.outputs.has_slack_risk }}
      has_legacy_tests: ${{ steps.non_diff.outputs.has_legacy_tests || steps.diff.outputs.has_legacy_tests }}
    steps:
      - id: non_diff
        if: github.event_name != 'pull_request' && github.event_name != 'merge_group'
        run: |
          echo "docs_only=false" >> "$GITHUB_OUTPUT"
          echo "has_core_code=true" >> "$GITHUB_OUTPUT"
          echo "has_legacy_tests=true" >> "$GITHUB_OUTPUT"
          if [ "${{ github.event_name }}" = "workflow_call" ]; then
            echo "has_engine_replay_risk=true" >> "$GITHUB_OUTPUT"
          else
            echo "has_engine_replay_risk=false" >> "$GITHUB_OUTPUT"
          fi
          echo "has_runtime_heavy_risk=true" >> "$GITHUB_OUTPUT"
          # Keep deterministic full browser E2E in its own scheduled/manual
          # workflow. The merge queue runs only smoke coverage for web-risk
          # changes so queued merges remain fast.
          echo "has_web_risk=false" >> "$GITHUB_OUTPUT"
          echo "has_wasm_abi_risk=true" >> "$GITHUB_OUTPUT"
          echo "has_telegram_risk=true" >> "$GITHUB_OUTPUT"
          echo "has_slack_risk=true" >> "$GITHUB_OUTPUT"
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        if: github.event_name == 'pull_request' || github.event_name == 'merge_group'
        with:
          fetch-depth: 0
          persist-credentials: false
      - id: diff
        if: github.event_name == 'pull_request' || github.event_name == 'merge_group'
        env:
          BASE_SHA: ${{ github.event_name == 'pull_request' && github.event.pull_request.base.sha || github.event.merge_group.base_sha }}
          HEAD_SHA: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.sha }}
        run: |
          CHANGED_FILES="$(git diff --name-only "$BASE_SHA"..."$HEAD_SHA")"

          echo "Changed files:"
          if [ -n "$CHANGED_FILES" ]; then
            printf '%s\n' "$CHANGED_FILES"
          else
            echo "<none>"
          fi

          has_match() {
            printf '%s\n' "$CHANGED_FILES" | grep -Eq "$1"
          }

          printf '%s\n' "$CHANGED_FILES" | scripts/ci/classify-test-scope.sh >> "$GITHUB_OUTPUT"

          if has_match '^(crates/ironclaw_(common|engine|skills)/|src/(agent|auth|bridge|context|extensions|llm|orchestrator|secrets|skills|tools|worker|workspace)/|tests/fixtures/llm_traces/|tests/snapshots/|tests/support/replay_outcome\.rs$|tests/e2e_engine_v2\.rs$|tests/e2e_live\.rs$|tests/e2e_recorded_trace\.rs$|tests/e2e_advanced_traces\.rs$|tests/e2e_trace_.*\.rs$|Cargo\.toml$|\.github/workflows/(replay-gate|test|nightly-deep-ci)\.yml$)'; then
            echo "has_engine_replay_risk=true" >> "$GITHUB_OUTPUT"
          else
            echo "has_engine_replay_risk=false" >> "$GITHUB_OUTPUT"
          fi

          if has_match '^(crates/ironclaw_(common|safety|skills)/|src/(agent|auth|bridge|config|context|db|extensions|gate|history|hooks|orchestrator|ownership|pairing|safety|sandbox|secrets|setup|skills|tools|webhooks|worker|workspace)/|src/channels/channel\.rs$|src/channels/manager\.rs$|src/channels/relay/|src/channels/wasm/|channels-src/telegram/|migrations/|src/app\.rs$|src/main\.rs$|src/lib\.rs$|tests/telegram_auth_integration\.rs$|tests/e2e_thread_scheduling\.rs$|\.github/workflows/(test|nightly-deep-ci)\.yml$)'; then
            echo "has_runtime_heavy_risk=true" >> "$GITHUB_OUTPUT"
          else
            echo "has_runtime_heavy_risk=false" >> "$GITHUB_OUTPUT"
          fi

          if has_match '^(src/(auth|bridge|extensions|ownership|pairing|secrets|webhooks|workspace)/|src/channels/web/|crates/ironclaw_gateway/|src/channels/attachments\.rs$|tests/e2e/|tests/fixtures/gateway_traces/|tests/test-pages/|scripts/check_gateway_boundaries\.py$|\.github/workflows/(e2e|test|nightly-deep-ci)\.yml$)'; then
            echo "has_web_risk=true" >> "$GITHUB_OUTPUT"
          else
            echo "has_web_risk=false" >> "$GITHUB_OUTPUT"
          fi

          if has_match '^(wit/|crates/ironclaw_common/|crates/ironclaw_first_party_extensions/assets/.*/(manifest\.toml|wasm-src/)|src/(channels/wasm|extensions|registry|tools/mcp|tools/wasm)/|channels-src/|tools-src/|registry/|scripts/build-wasm-extensions\.sh$|scripts/check-version-bumps\.sh$|tests/wit_compat\.rs$|tests/wasm_channel_integration\.rs$|tests/e2e_wasm_.*|Cargo\.toml$|Cargo\.lock$|\.github/workflows/(test|nightly-deep-ci)\.yml$)'; then
            echo "has_wasm_abi_risk=true" >> "$GITHUB_OUTPUT"
          else
            echo "has_wasm_abi_risk=false" >> "$GITHUB_OUTPUT"
          fi

          if has_match '^(channels-src/telegram/|src/channels/wasm/|tests/telegram_auth_integration\.rs$|tests/e2e_telegram_message_routing\.rs$|tests/e2e/scenarios/test_telegram_.*|\.github/workflows/(test|nightly-deep-ci)\.yml$)'; then
            echo "has_telegram_risk=true" >> "$GITHUB_OUTPUT"
          else
            echo "has_telegram_risk=false" >> "$GITHUB_OUTPUT"
          fi

          if has_match '^(channels-src/slack/|src/channels/wasm/|tests/slack_auth_integration\.rs$|\.github/workflows/(test|nightly-deep-ci)\.yml$)'; then
            echo "has_slack_risk=true" >> "$GITHUB_OUTPUT"
          else
            echo "has_slack_risk=false" >> "$GITHUB_OUTPUT"
          fi

  matrix-config:
    name: Configure matrix
    runs-on: ubuntu-latest
    outputs:
      test_matrix: ${{ steps.set.outputs.test_matrix }}
      windows_matrix: ${{ steps.set.outputs.windows_matrix }}
    steps:
      - id: set
        run: |
          FULL='[{"name":"all-features","flags":"--no-default-features --features postgres,libsql,html-to-markdown,bedrock,import"},{"name":"default","flags":""},{"name":"libsql-only","flags":"--no-default-features --features libsql"}]'
          SLIM='[{"name":"all-features","flags":"--no-default-features --features postgres,libsql,html-to-markdown,bedrock,import"}]'

          if [ "${{ github.event_name }}" = "pull_request" ] || [ "${{ github.event_name }}" = "merge_group" ]; then
            echo "test_matrix=${SLIM}" >> "$GITHUB_OUTPUT"
            echo "windows_matrix=${SLIM}" >> "$GITHUB_OUTPUT"
          else
            echo "test_matrix=${FULL}" >> "$GITHUB_OUTPUT"
            echo "windows_matrix=${FULL}" >> "$GITHUB_OUTPUT"
          fi

  hooks-parity-tests:
    name: Hooks Predicate-Backend Parity Tests
    needs: changes
    if: needs.changes.outputs.docs_only != 'true' && needs.changes.outputs.has_legacy_tests == 'true' && needs.changes.outputs.has_core_code == 'true'
    runs-on: ubuntu-latest
    timeout-minutes: 20
    services:
      postgres:
        image: pgvector/pgvector:pg16
        env:
          POSTGRES_USER: postgres
          POSTGRES_PASSWORD: postgres
          POSTGRES_DB: ironclaw_test
        ports:
          - 5432:5432
        options: >-
          --health-cmd "pg_isready -U postgres"
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5
    env:
      CARGO_PROFILE_DEV_DEBUG: 0
      CARGO_PROFILE_TEST_DEBUG: 0
      DATABASE_URL: postgres://postgres:postgres@localhost/ironclaw_test
      # Turn a missing/unreachable Postgres into a HARD failure so the full
      # cross-backend matrix (in-memory + libSQL + Postgres) cannot skip-pass.
      IRONCLAW_REQUIRE_POSTGRES: "1"
    steps:
      - name: Checkout repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          ref: ${{ inputs.ref || github.sha }}
          persist-credentials: false
      - name: Install Rust
        uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
      - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
        with:
          key: hooks-parity
          # Keep saves to protected-branch and merge_group runs so the ~10 GB
          # repo cache LRU is seeded by shared states, not arbitrary PR branches.
          save-if: ${{ (github.event_name == 'push' && github.ref == 'refs/heads/main') || github.event_name == 'merge_group' }}
      # Full parity matrix across all three backends: --features postgres
      # compiles the Postgres leg, --features integration adds the multi-host
      # adversarial suite, and IRONCLAW_REQUIRE_POSTGRES=1 (set above) makes the
      # Postgres leg mandatory. The libSQL leg always runs (embedded temp-file).
      - name: Run hooks parity matrix + multi-host adversarial suite (all backends)
        run: |
          timeout --signal=INT --kill-after=30s 15m \
            cargo test -p ironclaw_hooks_parity --features postgres,integration -- --nocapture

  windows-build:
    name: Windows Build (${{ matrix.name }})
    needs: [changes, matrix-config]
    if: needs.changes.outputs.docs_only != 'true' && needs.changes.outputs.has_legacy_tests == 'true' && (github.event_name == 'push' || github.event_name == 'workflow_call')
    runs-on: windows-latest
    strategy:
      fail-fast: false
      matrix:
        include: ${{ fromJSON(needs.matrix-config.outputs.windows_matrix) }}
    steps:
      - name: Checkout repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          ref: ${{ inputs.ref || github.sha }}
          persist-credentials: false
      - name: Install Rust
        uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
      - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
        with:
          key: windows-${{ matrix.name }}
          save-if: ${{ github.event_name == 'push' && github.ref == 'refs/heads/main' }}
      - name: Check compilation
        run: cargo check --all --benches --tests --examples ${{ matrix.flags }}

  wasm-wit-compat:
    name: WASM WIT Compatibility
    needs: changes
    if: >
      needs.changes.outputs.docs_only != 'true' &&
      needs.changes.outputs.has_legacy_tests == 'true' &&
      (github.event_name == 'push' || github.event_name == 'workflow_call' || needs.changes.outputs.has_wasm_abi_risk == 'true')
    runs-on: ubuntu-latest
    timeout-minutes: 30
    env:
      CARGO_PROFILE_DEV_DEBUG: 0
      CARGO_PROFILE_TEST_DEBUG: 0
    steps:
      - name: Checkout repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          ref: ${{ inputs.ref || github.sha }}
          persist-credentials: false
      - name: Free disk space
        run: |
          df -h /
          sudo rm -rf /usr/share/dotnet /usr/local/lib/android /opt/ghc
          df -h /
      - name: Install Rust
        uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
        with:
          targets: wasm32-wasip2
      - name: Install Node.js for WebUI bundle builds
        uses: actions/setup-node@60edb5dd545a775178f52524783378180af0d1f8 # v4
        with:
          node-version: "22"
          cache: "npm"
          cache-dependency-path: crates/ironclaw_webui_v2_static/frontend/package-lock.json
      - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
        with:
          key: wasm-extensions
          # Keep saves to protected-branch and merge_group runs so the ~10 GB
          # repo cache LRU is seeded by shared states, not arbitrary PR branches.
          save-if: ${{ (github.event_name == 'push' && github.ref == 'refs/heads/main') || github.event_name == 'merge_group' }}
      - name: Install cargo-component
        uses: ./.github/actions/install-cargo-component
      - name: Build all WASM extensions against current WIT
        run: ./scripts/build-wasm-extensions.sh
      - name: Instantiation test (host linker compatibility)
        run: |
          timeout --signal=INT --kill-after=30s 20m \
            cargo test --all-features --test wit_compat -- --nocapture

  bench-compile:
    name: Benchmark Compilation
    needs: changes
    if: >
      needs.changes.outputs.docs_only != 'true' &&
      needs.changes.outputs.has_legacy_tests == 'true' &&
      (github.event_name == 'push' || github.event_name == 'workflow_call') &&
      needs.changes.outputs.has_core_code == 'true'
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          ref: ${{ inputs.ref || github.sha }}
          persist-credentials: false
      - name: Install Rust
        uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
      - name: Install Node.js for WebUI bundle builds
        uses: actions/setup-node@60edb5dd545a775178f52524783378180af0d1f8 # v4
        with:
          node-version: "22"
          cache: "npm"
          cache-dependency-path: crates/ironclaw_webui_v2_static/frontend/package-lock.json
      - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
        with:
          key: bench
          save-if: ${{ github.event_name == 'push' && github.ref == 'refs/heads/main' }}
      - name: Compile benchmarks
        run: cargo bench --all-features --no-run

  docker-build:
    name: Docker Build
    needs: changes
    if: >
      needs.changes.outputs.docs_only != 'true' &&
      needs.changes.outputs.has_legacy_tests == 'true' &&
      (github.event_name == 'push' || (github.event_name == 'workflow_call' && inputs.include_docker))
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          ref: ${{ inputs.ref || github.sha }}
          persist-credentials: false
      - name: Build Docker image
        run: docker build --target runtime -t ironclaw-test:ci .
      - name: Build Reborn Docker image
        run: docker build -f Dockerfile.reborn -t ironclaw-reborn-test:ci .

  version-check:
    name: Version Bump Check
    runs-on: ubuntu-latest
    needs: changes
    if: >
      (github.event_name == 'pull_request' || github.event_name == 'merge_group') &&
      needs.changes.outputs.docs_only != 'true' &&
      needs.changes.outputs.has_legacy_tests == 'true'
    permissions:
      contents: read
      pull-requests: read
      issues: read
    steps:
      - name: Checkout repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          ref: ${{ inputs.ref || github.sha }}
          persist-credentials: false
          fetch-depth: 0
      - name: Resolve version-check skip labels
        id: skip_labels
        env:
          GH_TOKEN: ${{ github.token }}
          REPO: ${{ github.repository }}
          BASE_SHA: ${{ github.event_name == 'pull_request' && github.event.pull_request.base.sha || github.event.merge_group.base_sha }}
          HEAD_SHA: ${{ inputs.ref || github.sha }}
          PR_LABELS: ${{ github.event_name == 'pull_request' && join(github.event.pull_request.labels.*.name, ',') || '' }}
        run: |
          if [ "${{ github.event_name }}" = "pull_request" ]; then
            echo "labels=${PR_LABELS}" >> "$GITHUB_OUTPUT"
            echo "allow_skip=true" >> "$GITHUB_OUTPUT"
            exit 0
          fi

          COMPARE_JSON="$(gh api "repos/${REPO}/compare/${BASE_SHA}...${HEAD_SHA}")"
          PR_NUMBERS="$(
            printf '%s' "$COMPARE_JSON" | jq -r '.commits[].sha' \
            | while read -r sha; do
                [ -n "$sha" ] || continue
                gh api "repos/${REPO}/commits/${sha}/pulls" \
                  -H "Accept: application/vnd.github+json" \
                  --jq '.[].number' 2>/dev/null || true
              done \
            | awk 'NF && !seen[$0]++'
          )"

          PR_COUNT="$(printf '%s\n' "$PR_NUMBERS" | awk 'NF' | wc -l | tr -d ' ')"
          if [ "${PR_COUNT}" != "1" ]; then
            echo "labels=" >> "$GITHUB_OUTPUT"
            echo "allow_skip=false" >> "$GITHUB_OUTPUT"
            exit 0
          fi

          LABELS="$(
            printf '%s\n' "$PR_NUMBERS" \
            | while read -r pr; do
                [ -n "$pr" ] || continue
                gh api "repos/${REPO}/issues/${pr}" --jq '.labels[].name' 2>/dev/null || true
              done \
            | awk 'NF && !seen[$0]++'
          )"

          if [ -n "$LABELS" ]; then
            echo "labels=$(printf '%s\n' "$LABELS" | paste -sd, -)" >> "$GITHUB_OUTPUT"
          else
            echo "labels=" >> "$GITHUB_OUTPUT"
          fi
          echo "allow_skip=true" >> "$GITHUB_OUTPUT"
      - name: Check version bumps for changed extensions
        env:
          PR_LABELS: ${{ steps.skip_labels.outputs.labels }}
          GITHUB_BASE_REF: ${{ github.event_name == 'pull_request' && github.event.pull_request.base.ref || github.event_name == 'merge_group' && github.event.merge_group.base_ref || '' }}
          ALLOW_SKIP_VERSION_CHECK: ${{ steps.skip_labels.outputs.allow_skip }}
        run: ./scripts/check-version-bumps.sh