ci.yml

name: ci

env:
  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true

on:
  push:
    branches:
      - main
  pull_request:
  workflow_dispatch:

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: read

jobs:
  js-checks:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Setup pnpm
        uses: pnpm/action-setup@v5
        with:
          version: 10.18.2

      - name: Setup Node
        uses: actions/setup-node@v6
        with:
          node-version: 24
          cache: pnpm
          cache-dependency-path: pnpm-lock.yaml

      - name: Restore check caches
        uses: actions/cache@v5
        with:
          path: |
            node_modules/.cache/tsc
            .build
            dist
          key: ${{ runner.os }}-oss-checks-${{ hashFiles('pnpm-lock.yaml', 'package.json', 'tsconfig*.json', 'packages/**/tsconfig.json', 'packages/**/package.json') }}
          restore-keys: |
            ${{ runner.os }}-oss-checks-

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Verify
        run: pnpm verify:fast

      - name: Verify fast plan coverage
        run: pnpm verify:fast:plan-check

  demo-checks:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Setup pnpm
        uses: pnpm/action-setup@v5
        with:
          version: 10.18.2

      - name: Setup Node
        uses: actions/setup-node@v6
        with:
          node-version: 24
          cache: pnpm
          cache-dependency-path: pnpm-lock.yaml

      - name: Restore check caches
        uses: actions/cache@v5
        with:
          path: |
            node_modules/.cache/tsc
            .build
            dist
          key: ${{ runner.os }}-oss-checks-${{ hashFiles('pnpm-lock.yaml', 'package.json', 'tsconfig*.json', 'packages/**/tsconfig.json', 'packages/**/package.json') }}
          restore-keys: |
            ${{ runner.os }}-oss-checks-

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Demo and local payment dogfood
        run: |
          pnpm demos:check
          pnpm x402:dogfood:local

      - name: Heavy graph Vitest
        run: pnpm test:heavy:graph

  rust-checks:
    runs-on: ubuntu-latest
    env:
      CARGO_INCREMENTAL: "0"
    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Setup Node
        uses: actions/setup-node@v6
        with:
          node-version: 24

      - name: Setup Rust
        uses: dtolnay/rust-toolchain@stable
        with:
          components: rustfmt, clippy

      - name: Setup Rust nightly
        uses: dtolnay/rust-toolchain@nightly
        with:
          components: rustfmt, clippy

      - name: Install Rust test and advisory tools
        uses: taiki-e/install-action@v2
        with:
          # Prebuilt binaries instead of compiling from source on every cache miss.
          # cargo-public-api is snapshot-sensitive; keep this in sync with
          # scripts/check-rust-kernel-parity.mjs.
          tool: cargo-nextest,cargo-deny,cargo-public-api@0.51.0

      - name: Cargo cache
        # Same Rust-aware cache the cloud workflow uses for oss/crates: keys on the
        # lockfile and rustc version and prunes stale artifacts, so the target tree
        # does not bloat the cache (it grew to ~183GB locally under the old scheme).
        uses: Swatinem/rust-cache@v2
        with:
          workspaces: crates

      - name: Rust checks
        working-directory: crates
        run: |
          cargo fmt --all --check
          cargo clippy --workspace --all-targets --all-features -- -D warnings
          cargo nextest run --workspace --all-features --no-fail-fast
          # nextest does not run doctests; keep this gated (currently zero doctests)
          # so an added doctest cannot slip through uncovered.
          cargo test --workspace --all-features --doc
          cargo package -p runx-cli --list

      - name: License boundary guard
        run: |
          node scripts/check-license-edges.mjs --check manifest-complete
          node scripts/check-license-edges.mjs --check identifiers
          cargo metadata --manifest-path crates/Cargo.toml --format-version 1 | node scripts/check-license-edges.mjs --check edges
          cargo test --manifest-path crates/Cargo.toml -p runx-runtime --all-features --test integration -- license_boundary

      - name: Cargo policy
        run: cargo deny --manifest-path crates/Cargo.toml check bans licenses sources

      - name: Rust public API snapshot
        run: node scripts/check-rust-kernel-parity.mjs --api-only

  authoring-smoke:
    # Drift guard: scaffold -> harness end to end. Reds the build the moment the
    # `runx new` native scaffold breaks (broken templates, harness regressions),
    # so the authoring path can never silently rot. Native skills carry no npm
    # deps and no build step, so this is scaffold then harness, nothing else.
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v6
      - name: Setup Node
        uses: actions/setup-node@v6
        with:
          node-version: 24
      - name: Setup Rust
        uses: dtolnay/rust-toolchain@stable
      - name: Cargo cache
        uses: Swatinem/rust-cache@v2
        with:
          workspaces: crates
      - name: Build runx
        working-directory: crates
        run: cargo build -p runx-cli
      - name: Scaffold and harness
        env:
          RUNX_RECEIPT_SIGN_KID: ci-authoring-smoke
          RUNX_RECEIPT_SIGN_ED25519_SEED_BASE64: QkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkI=
          RUNX_RECEIPT_SIGN_ISSUER_TYPE: hosted
        run: |
          set -euo pipefail
          RUNX="$GITHUB_WORKSPACE/crates/target/debug/runx"
          "$RUNX" new authoring-smoke --directory "$RUNNER_TEMP/authoring-smoke"
          "$RUNX" harness "$RUNNER_TEMP/authoring-smoke" --json

  checks:
    runs-on: ubuntu-latest
    needs:
      - js-checks
      - demo-checks
      - rust-checks
      - authoring-smoke
    steps:
      - name: Done
        run: echo "All CI lanes passed."