ci.yml

name: CI

on:
  push:
    # train/** runs the same checks on a train branch before it is fast-forwarded
    # onto master; required status checks on master are satisfied by that run.
    branches: [master, main, "train/**"]
  # This private-source drift leg runs only on the default branch's scheduled
  # workflow revision, never against untrusted branch code.
  schedule:
    - cron: "17 3 * * *"

env:
  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true

# Pipeline shape on every push to master/main:
#
#   check-plugin, check-pi-plugin                          (unit tests + lint + typecheck, parallel)
#                  ↓
#   e2e-opencode, e2e-pi                                   (Docker install + smoke, parallel — gated by unit)
#                  ↓
#   e2e-host-opencode, e2e-host-pi                         (host behavior suite from packages/e2e-tests, parallel — gated by Docker)
#
# Two e2e layers cover different concerns:
#   - Docker e2e: fresh-install smoke (plugin loads, doctor clean, one mock turn writes DB rows
#     under cortexkit path with right harness). Catches packaging / install-flow regressions.
#   - Host e2e: behavior suite with byte-level wire assertions, multi-turn cache stability,
#     historian publish behavior, tag-owner collision, synthetic todowrite, cross-harness memory,
#     etc. Spawns real `opencode serve` / Pi subprocesses against an embedded mock provider.
#     Catches cache-stability + correctness regressions that the smoke layer cannot see.
#
# Docker e2e was previously in a separate workflow (e2e-docker.yml). Folding it here means
# every master/main push exercises the full unit → Docker → host gauntlet. The
# scheduled Rust hermetic drift leg additionally checks the current private sibling
# sources; it never runs on untrusted branch code.

jobs:
  check-plugin:
    name: Check (plugin)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5

      - uses: oven-sh/setup-bun@v2
        with:
          bun-version: latest

      # node:sqlite (the Pi / OpenCode-Desktop SQLite backend) is only reachable
      # under Node, not Bun. Node 24 also strips the smoke script's inline TS.
      - uses: actions/setup-node@v4
        with:
          node-version: "24"

      - name: Install dependencies
        run: bun install --frozen-lockfile

      - name: TypeScript typecheck
        run: bun run typecheck

      - name: Lint
        run: bun run lint

      - name: Build
        run: bun run build

      - name: Check compiled TUI freshness
        run: bun run --cwd packages/plugin check:tui-compiled

      - name: Test
        run: bun run test

      # Exercise the node:sqlite branch of shared/sqlite.ts under REAL Node —
      # bun test only covers the bun:sqlite branch, so the transaction() shim,
      # readonly→readOnly mapping, and the array-bind normalization (#151) would
      # otherwise ship unverified on Pi/Desktop.
      - name: Smoke (node:sqlite backend)
        run: node packages/plugin/scripts/smoke-node-sqlite.ts

      # The smart-note QuickJS sandbox loads a ~1MB WASM. `bun test` runs it from
      # src (wasm resolves via node_modules), so it cannot catch a BUNDLING break
      # where the wasm isn't embedded in dist. This bundles sandbox-runner exactly
      # like the package build and runs a real check against the bundle.
      - name: Smoke (smart-note wasm bundle)
        run: bun packages/plugin/scripts/smoke-smartnote-wasm.ts

      # The raw-TSX ./tui entry imports @opentui/solid's JSX runtime. `bun test`
      # never imports it, so a missing/mismatched OpenTUI or Solid dep (as broke
      # on OpenCode 1.17.10's OpenTUI 0.4.2 bump) ships a TUI that won't load.
      # Import the entry the way OpenCode loads the ./tui export to catch it.
      - name: Smoke (TUI entry import)
        run: bun packages/plugin/scripts/smoke-tui-import.ts

      # The dev-path import above cannot catch packaging breaks: OpenTUI's Solid
      # transform skips node_modules sources, so only a packed PROD install
      # exercises the resolution path OpenCode's plugin cache uses (v0.31.1
      # shipped without runtime deps and passed every dev-path check).
      - name: Smoke (TUI packaged install import)
        run: bun packages/plugin/scripts/smoke-tui-pack-install.ts

      # Tokenizer loading is lazy, so an import-only smoke misses resolution
      # failures. Pack + npm-install prod deps, then exercise an estimate from a
      # compiled Bun host matching OpenCode's /$bunfs/root runtime.
      - name: Smoke (tokenizer packaged install estimate)
        run: bun packages/plugin/scripts/smoke-tokenizer-pack-install.ts

  check-pi-plugin:
    name: Check (pi-plugin)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5

      - uses: oven-sh/setup-bun@v2
        with:
          bun-version: latest

      - name: Install dependencies
        run: bun install --frozen-lockfile

      - name: TypeScript typecheck
        run: bun run --cwd packages/pi-plugin typecheck

      - name: Lint
        run: bun run --cwd packages/pi-plugin lint

      - name: Build
        run: bun run --cwd packages/pi-plugin build

      - name: Test
        run: bun run --cwd packages/pi-plugin test

  check-dashboard:
    name: Check (dashboard)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5

      - uses: oven-sh/setup-bun@v2
        with:
          bun-version: latest

      - name: Install dependencies
        run: bun install --frozen-lockfile

      # Frontend-only checks (no Rust/Tauri needed). The key gate is the test
      # step, which runs config-parity.test.ts — it fails the build if the
      # plugin config schema gains/renames/removes a field the dashboard's
      # ConfigEditor coverage manifest doesn't account for, so the form can't
      # silently drift out of sync with the schema again.
      - name: TypeScript typecheck
        run: bun run --cwd packages/dashboard typecheck

      - name: Lint
        run: bun run --cwd packages/dashboard lint

      - name: Test
        run: bun run --cwd packages/dashboard test

      - name: Build (frontend)
        run: bun run --cwd packages/dashboard build

  e2e-opencode:
    name: E2E (OpenCode, Docker)
    runs-on: ubuntu-latest
    needs: [check-plugin]
    timeout-minutes: 25
    steps:
      - uses: actions/checkout@v5
      - uses: oven-sh/setup-bun@v2
        with:
          bun-version: latest

      - name: Install workspace deps
        run: bun install --frozen-lockfile

      - name: Build OpenCode plugin
        run: bun run --cwd packages/plugin build

      - name: Build CLI
        # The CLI is its own package (@cortexkit/magic-context) since
        # v0.16.1; Dockerfile.opencode COPYs packages/cli/dist/ in.
        run: bun run --cwd packages/cli build

      - name: Build E2E image
        run: |
          docker build \
            --platform linux/amd64 \
            -f tests/docker/Dockerfile.opencode \
            -t mc-e2e-opencode \
            .

      - name: Run E2E
        run: docker run --rm --platform linux/amd64 mc-e2e-opencode

  e2e-pi:
    name: E2E (Pi, Docker)
    runs-on: ubuntu-latest
    needs: [check-pi-plugin]
    timeout-minutes: 25
    steps:
      - uses: actions/checkout@v5
      - uses: oven-sh/setup-bun@v2
        with:
          bun-version: latest

      - name: Install workspace deps
        run: bun install --frozen-lockfile

      - name: Build Pi plugin
        run: bun run --cwd packages/pi-plugin build

      - name: Build CLI
        # The CLI moved to its own package (@cortexkit/magic-context) in
        # v0.16.1. Dockerfile.pi COPYs packages/cli/dist/ in for the
        # `magic-context doctor --harness pi` test invocation.
        run: bun run --cwd packages/cli build

      - name: Build E2E image
        # The Pi Dockerfile installs runtime deps fresh inside the image
        # (better-sqlite3 builds against linux/amd64), so no host-side
        # `npm install` is needed.
        run: |
          docker build \
            --platform linux/amd64 \
            -f tests/docker/Dockerfile.pi \
            -t mc-e2e-pi \
            .

      - name: Run E2E
        run: docker run --rm --platform linux/amd64 mc-e2e-pi

  e2e-omp:
    name: E2E (Oh My Pi, real Docker)
    runs-on: ubuntu-latest
    needs: [check-pi-plugin]
    timeout-minutes: 25
    steps:
      - uses: actions/checkout@v5
      - uses: oven-sh/setup-bun@v2
        with:
          bun-version: latest

      - name: Install workspace deps
        run: bun install --frozen-lockfile

      - name: Build Pi-compatible plugin and OMP argv renderer
        run: |
          bun run --cwd packages/pi-plugin build
          bun run --cwd packages/pi-plugin build:e2e-argv

      - name: Build CLI
        run: bun run --cwd packages/cli build

      - name: Build real OMP E2E image
        run: |
          docker build \
            --platform linux/amd64 \
            -f tests/docker/Dockerfile.omp \
            -t mc-e2e-omp \
            .

      - name: Run real OMP install and session smoke
        run: docker run --rm --platform linux/amd64 mc-e2e-omp

  e2e-host-opencode:
    name: E2E (OpenCode, host behavior)
    runs-on: ubuntu-latest
    # Gated on Docker e2e: no point exercising the deep behavior suite if
    # the simpler install+smoke path is broken.
    needs: [e2e-opencode]
    timeout-minutes: 40
    steps:
      - uses: actions/checkout@v5

      - uses: oven-sh/setup-bun@v2
        with:
          bun-version: latest

      - name: Install workspace deps
        run: bun install --frozen-lockfile

      # Install opencode the same way the Docker image does — the host
      # suite spawns `opencode serve` from PATH.
      - name: Install opencode
        # Float to LATEST (no --version) so CI exercises the opencode version
        # users actually run and catches upstream breakage as it ships — not at
        # our release time. (A fixed pin previously hid opencode 1.16's
        # post-overflow change, commit 7e09660c3, until release; the
        # overflow-recovery host test is now version-agnostic.) Trade-off: a
        # known-bad upstream release can turn CI red for unrelated PRs — if that
        # happens, temporarily re-pin with `--version X.Y.Z` here until it's
        # resolved upstream.
        run: |
          curl -fsSL https://opencode.ai/install | bash
          echo "$HOME/.opencode/bin" >> "$GITHUB_PATH"

      - name: Verify opencode on PATH
        run: opencode --version

      - name: Build OpenCode plugin
        # Host tests spawn `opencode serve` with a file:// plugin
        # specifier pointing at packages/plugin/, so dist must exist.
        run: bun run --cwd packages/plugin build

      # Strip inherited NODE_ENV=test so the spawned opencode subprocess
      # gets the same logging + runtime behavior as a normal local run
      # (documented in CONTRIBUTING / project memory).
      #
      # Per-test (and per-hook) timeout bumped to 300s: the first test file
      # Bun loads on a cold GitHub-hosted runner pays the dependency-resolution
      # + opencode-binary cold-start cost in its `beforeAll(TestHarness.create)`,
      # which can exceed Bun's 120s default. Subsequent files run in 5-10s.
      - name: Run host e2e suite (OpenCode tests only)
        env:
          NODE_ENV: ""
          MC_E2E_MODE: ts
        run: |
          # The mode validator independently checks tests/**/*.test.ts and
          # derives this OpenCode list. Rust is intentionally absent from PR and
          # ordinary master CI because it requires private ../commons and
          # ../subconscious source. The scheduled hosted drift job below covers
          # that private-source lane; never add it to pull_request.
          cd packages/e2e-tests
          files=$(bun scripts/validate-mode-manifest.ts --mode ts --harness opencode | tr '\n' ' ')
           echo "Running OpenCode host tests from mode manifest: $files"
           # shellcheck disable=SC2086 # The repository-controlled file list must expand into Bun arguments.
           bun test --timeout 600000 $files
          # This oracle is outside the manifest's tests/**/*.test.ts inventory.
          bun test --timeout 600000 src/cache-analysis.test.ts

  e2e-host-pi:
    name: E2E (Pi, host behavior)
    runs-on: ubuntu-latest
    needs: [e2e-pi]
    timeout-minutes: 40
    steps:
      - uses: actions/checkout@v5

      - uses: oven-sh/setup-bun@v2
        with:
          bun-version: latest

      # Pi tests resolve the Pi binary via createRequire against
      # @earendil-works/pi-coding-agent, which is a workspace dep of
      # packages/pi-plugin. `bun install` brings it in.
      - name: Install workspace deps
        run: bun install --frozen-lockfile

      # pi-cross-harness.test.ts spawns BOTH a Pi runner and an OpenCode
      # serve to verify cross-harness memory sharing, so this job needs
      # opencode on PATH too. Float to LATEST like the OpenCode host job
      # (see that step for the rationale + re-pin escape hatch).
      - name: Install opencode
        run: |
          curl -fsSL https://opencode.ai/install | bash
          echo "$HOME/.opencode/bin" >> "$GITHUB_PATH"

      - name: Verify opencode on PATH
        run: opencode --version

      - name: Build Pi plugin
        run: bun run --cwd packages/pi-plugin build

      # pi-cross-harness also instantiates the OpenCode harness, which
      # spawns `opencode serve` with a file:// plugin specifier pointing
      # at packages/plugin/. That dist must exist.
      - name: Build OpenCode plugin
        run: bun run --cwd packages/plugin build

      # Per-test timeout bumped to 300s for the same cold-start reason as
      # the OpenCode host job. Pi historian publish path also crosses an
      # HTTP boundary into the mock provider, which is slower on shared
      # runners than on local hardware.
      - name: Run host e2e suite (Pi tests from mode manifest)
        env:
          NODE_ENV: ""
          MC_E2E_MODE: ts
        run: |
          cd packages/e2e-tests
          files=$(bun scripts/validate-mode-manifest.ts --mode ts --harness pi | tr '\n' ' ')
           echo "Running Pi host tests from mode manifest: $files"
           # shellcheck disable=SC2086 # The repository-controlled file list must expand into Bun arguments.
           bun test --timeout 600000 $files

  rust-e2e-preflight:
    name: Rust hermetic E2E drift credential preflight
    # Scheduled workflows use the default branch. This prevents the private-source
    # App token from being exposed to untrusted branch code.
    if: ${{ github.event_name == 'schedule' }}
    runs-on: ubuntu-latest
    permissions:
      contents: read
    outputs:
      enabled: ${{ steps.credentials.outputs.enabled }}
    steps:
      - id: credentials
        name: Report private-source credential state
        env:
          CK_CI_APP_ID: ${{ secrets.CK_CI_APP_ID }}
          CK_CI_APP_PRIVATE_KEY: ${{ secrets.CK_CI_APP_PRIVATE_KEY }}
        shell: bash
        run: |
          set -euo pipefail
          missing_secrets=()
          [[ -n "$CK_CI_APP_ID" ]] || missing_secrets+=("CK_CI_APP_ID")
          [[ -n "$CK_CI_APP_PRIVATE_KEY" ]] || missing_secrets+=("CK_CI_APP_PRIVATE_KEY")

          if (( ${#missing_secrets[@]} > 0 )); then
            missing_prerequisite="$(IFS=','; echo "${missing_secrets[*]}")"
            echo "enabled=false" >> "$GITHUB_OUTPUT"
            echo "::warning title=Rust hermetic E2E skipped::Missing prerequisite: Actions secret(s) ${missing_prerequisite}. Configure the cortexkit-ci GitHub App secrets documented in .github/RUST_E2E_CI.md."
            {
              echo "## Rust hermetic E2E drift"
              echo "SKIPPED: Missing prerequisite: Actions secret(s) ${missing_prerequisite}."
            } >> "$GITHUB_STEP_SUMMARY"
            echo "Rust hermetic E2E drift is SKIPPED: cortexkit-ci GitHub App secrets are absent. This scheduled run does not claim the Rust suite passed."
          else
            echo "enabled=true" >> "$GITHUB_OUTPUT"
            echo "Rust hermetic E2E credentials are available for the hosted drift runner."
          fi

  e2e-rust-hermetic:
    name: E2E (Rust hermetic drift)
    # This job uses private sibling source with a scoped cortexkit-ci GitHub App
    # token. It must remain scheduled-only and never run on untrusted branch code.
    if: ${{ needs.rust-e2e-preflight.outputs.enabled == 'true' }}
    runs-on: ubuntu-latest
    needs: [e2e-host-opencode, e2e-host-pi, rust-e2e-preflight]
    timeout-minutes: 120
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@v5

      - uses: dtolnay/rust-toolchain@stable

      - uses: oven-sh/setup-bun@v2
        with:
          bun-version: latest

      - name: Create scoped cortexkit-ci GitHub App token
        id: cortexkit-ci-token
        uses: actions/create-github-app-token@v1
        with:
          app-id: ${{ secrets.CK_CI_APP_ID }}
          private-key: ${{ secrets.CK_CI_APP_PRIVATE_KEY }}
          owner: cortexkit
          repositories: subconscious,commons

      - name: Check out commons
        uses: actions/checkout@v5
        with:
          repository: cortexkit/commons
          token: ${{ steps.cortexkit-ci-token.outputs.token }}
          path: ../commons
          persist-credentials: false

      - name: Check out subconscious
        uses: actions/checkout@v5
        with:
          repository: cortexkit/subconscious
          token: ${{ steps.cortexkit-ci-token.outputs.token }}
          path: ../subconscious
          persist-credentials: false

      - name: Record private sibling revisions
        shell: bash
        run: |
          set -euo pipefail
          commons_sha="$(git -C "$GITHUB_WORKSPACE/../commons" rev-parse HEAD)"
          subconscious_sha="$(git -C "$GITHUB_WORKSPACE/../subconscious" rev-parse HEAD)"
          summary="Rust hermetic sibling checkouts: commons=${commons_sha}; subconscious=${subconscious_sha}"
          echo "$summary"
          echo "$summary" >> "$GITHUB_STEP_SUMMARY"

      - name: Derive hermetic Cargo cache key
        id: cargo-cache-key
        shell: bash
        run: |
          set -euo pipefail
          digest="$(sha256sum Cargo.lock ../commons/Cargo.lock ../subconscious/Cargo.lock | sha256sum | awk '{print $1}')"
          echo "key=rust-hermetic-${RUNNER_OS}-${RUNNER_ARCH}-${digest}" >> "$GITHUB_OUTPUT"

      - name: Restore ck-subc and ckdev-mc-e2e Cargo target cache
        uses: actions/cache@v4
        with:
          path: packages/e2e-tests/.cache/rust-e2e-cargo-target
          key: ${{ steps.cargo-cache-key.outputs.key }}

      - name: Install workspace dependencies
        run: bun install --frozen-lockfile

      - name: Install OpenCode
        run: |
          curl -fsSL https://opencode.ai/install | bash
          echo "$HOME/.opencode/bin" >> "$GITHUB_PATH"

      - name: Verify OpenCode on PATH
        run: opencode --version

      - name: Build OpenCode plugin
        run: bun run --cwd packages/plugin build

      - name: Build ck-subc and ckdev-mc-e2e, then run Rust hermetic e2e
        run: scripts/run-rust-hermetic-e2e.sh