ci.yml

name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

jobs:
  test:
    runs-on: ${{ matrix.os }}
    strategy:
      matrix:
        os: [ubuntu-latest, macos-latest]
        go-version: ['1.26']
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version-file: go.mod

      - name: Build
        run: go build -o gortex ./cmd/gortex/

      - name: Test
        run: go test -race -timeout=20m -coverprofile=coverage.out ./...

      - name: Upload coverage
        if: matrix.os == 'ubuntu-latest' && matrix.go-version == '1.26'
        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v6
        with:
          files: coverage.out
        continue-on-error: true

  build-windows:
    # CGO build smoke-test on native Windows. tree-sitter needs a C/C++
    # compiler — the GitHub windows runner ships mingw-w64 on PATH, so no
    # extra toolchain setup is required. `go build ./...` compiles every
    # production package; the focused agents and sidecar tests also exercise
    # Windows-only paths without opting into the unsupported full test suite.
    runs-on: windows-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version-file: go.mod

      - name: Build CLI
        run: go build -o gortex.exe ./cmd/gortex/

      - name: Build all packages
        run: go build ./...

      - name: Test Windows agent integrations
        run: go test -timeout=5m -count=1 ./internal/agents

      # Symlink confinement keeps out-of-repo files out of the index, and it
      # reads differently on Windows: a symlink reparse point maps to
      # ModeSymlink but a directory junction maps to ModeIrregular, and
      # evalSymlinks normalises path case where Unix does not. Verifying it
      # only on the linux/macos matrix would leave the platform whose
      # semantics differ most as the untested one.
      - name: Test symlink confinement
        run: go test -timeout=5m -count=1 ./internal/pathguard

      # Windows refuses to unlink an open file, so a leaked sidecar handle
      # pins its directory and fails the enclosing t.TempDir() cleanup. That
      # asymmetry is invisible on the linux/macos matrix, which is why this
      # one test runs here rather than only there.
      - name: Test sidecar handle release
        run: go test -timeout=5m -count=1 -run TestCloseSidecar ./internal/persistence

      # os.UserHomeDir reads %USERPROFILE% here and $HOME everywhere else, so
      # a test that isolates itself with HOME alone keeps resolving the real
      # profile on Windows — and writes to it. That is invisible to the
      # linux/macos matrix by construction, so the isolation helper and the
      # path resolver it protects have to be verified on this runner or not
      # at all.
      - name: Test user-state isolation
        run: go test -timeout=5m -count=1 ./internal/testenv ./internal/platform

      # Indexed paths are repoPrefix + '/' + the rest in native separators, so
      # on Windows a stored path reads `repo/dir\file.cs`. Every test for that
      # shape is a no-op on the linux/macos matrix — POSIX treats '\' as an
      # ordinary filename byte, so filepath.Clean and filepath.ToSlash both
      # leave the fixture untouched and the assertions pass with or without
      # the production fix. This runner is the only one where they can fail.
      - name: Test store path separator handling
        run: go test -timeout=5m -count=1 ./internal/graphpath

      - name: Test native-separator store path comparisons
        run: >
          go test -timeout=10m -count=1
          -run 'NativeSeparator|MixedSeparator|ImportAdjacency'
          ./internal/analysis ./internal/graph/store_sqlite
          ./internal/mcp ./internal/resolver

  build-linux-static:
    # The linux release ships a statically linked binary so it runs on any
    # distro (see .goreleaser.yml). That only holds while the code stays
    # link-clean under -static + netgo/osusergo — a new cgo dependency, or a
    # dep that needs a runtime dlopen, breaks it. The release-time build hook
    # catches that at tag time; this catches it on the PR that introduces it.
    #
    # ubuntu-latest is the same Ubuntu 24.04 / GCC 13 generation as the
    # goreleaser-cross image, so it reproduces the same GLIBCXX floor the
    # dynamic build used to inherit — without pulling that multi-GB image.
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version-file: go.mod

      - name: Build with the release link flags
        env:
          CGO_ENABLED: "1"
        run: |
          go build -tags netgo,osusergo,static_link \
            -ldflags '-s -w -extldflags "-static"' \
            -o gortex-static ./cmd/gortex/

      - name: Verify the binary is self-contained
        run: |
          file gortex-static
          sh scripts/verify-static-elf.sh gortex-static

      # The static-only code path (custom grammars declining instead of
      # dlopen'ing) is compiled out of every other job, so it needs its tests
      # run under the tag or they never execute anywhere.
      - name: Test the static-only code paths
        run: go test -count=1 -tags netgo,osusergo,static_link ./internal/parser/languages/

      - name: Run it where the dynamic build could not
        # debian:11 (glibc 2.31 / GLIBCXX_3.4.28) is the userland that reported
        # `GLIBCXX_3.4.32 not found`; alpine has no glibc at all. Exercise a
        # command that resolves the user's home dir and touches the net stack,
        # so a missing netgo/osusergo tag fails here rather than for a user.
        run: |
          set -euo pipefail
          for img in debian:11 alpine:3; do
            echo "== $img"
            docker run --rm -v "$PWD/gortex-static:/gortex:ro" "$img" /gortex version
            docker run --rm -v "$PWD/gortex-static:/gortex:ro" "$img" /gortex daemon status || true
          done

  lint:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version-file: go.mod

      - name: golangci-lint
        uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a # v9
        with:
          version: v2.11.4
          args: --timeout=10m

  build-onnx:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version-file: go.mod

      - name: Install ONNX Runtime
        run: |
          wget -q https://github.com/microsoft/onnxruntime/releases/download/v1.24.4/onnxruntime-linux-x64-1.24.4.tgz
          tar xzf onnxruntime-linux-x64-1.24.4.tgz
          sudo cp onnxruntime-linux-x64-1.24.4/lib/libonnxruntime.so* /usr/local/lib/
          sudo ldconfig

      - name: Build with ONNX tag
        run: go build -tags embeddings_onnx -o gortex-onnx ./cmd/gortex/

      - name: Build default (Hugot bundled — no tag)
        run: go build -o gortex-default ./cmd/gortex/

      - name: Install rust tokenizers library
        # hugot's XLA session uses the rust tokenizer, statically linked as
        # -ltokenizers, so the embeddings_gomlx XLA build needs libtokenizers.a
        # on the linker path. (The pure-Go default and the ONNX build do not.)
        run: |
          curl -fsSL https://github.com/daulet/tokenizers/releases/download/v1.27.0/libtokenizers.linux-amd64.tar.gz | tar -xz
          sudo cp libtokenizers.a /usr/lib/
          sudo cp libtokenizers.a /usr/local/lib/

      - name: Build with GoMLX + XLA tags
        run: go build -tags "embeddings_gomlx XLA" -o gortex-gomlx ./cmd/gortex/

      - name: Build with GoMLX tag only (compat — some docs/scripts still pass it alone)
        run: go build -tags embeddings_gomlx -o gortex-gomlx-noxla ./cmd/gortex/

  benchmark:
    runs-on: ubuntu-latest
    if: github.event_name == 'pull_request'
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version-file: go.mod

      - name: Run benchmarks
        run: go test -bench=. -benchmem -count=1 -benchtime=1s -timeout=20m ./internal/parser/languages/ ./internal/query/ ./internal/graph/