ci.yml

name: CI

on:
  push:
    branches: [ main, develop ]
  # 'moe/**' included so stacked agent PRs (base = another moe/* branch)
  # get full CI instead of only the unfiltered smoke/e2e workflows.
  pull_request:
    branches: [ main, develop, 'moe/**' ]

jobs:
  test:
    name: Test
    runs-on: ubuntu-latest
    strategy:
      matrix:
        go-version: ['1.25']

    steps:
    - uses: actions/checkout@v4

    - name: Set up Go
      uses: actions/setup-go@v6
      with:
        go-version: ${{ matrix.go-version }}
        cache: false

    - name: Drop local replace directives (CI uses published modules)
      run: |
        go mod edit -dropreplace github.com/cordum-io/cap/v2
        go mod tidy

    - name: Run tests
      run: go test -v -race -coverprofile=coverage.out -covermode=atomic ./...

    - name: Upload coverage to Codecov
      uses: codecov/codecov-action@e79a6962e0d4c0c17b229090214935d2e33f8354 # v6.0.1
      with:
        files: ./coverage.out
        flags: unittests
        name: codecov-umbrella

    # Benchmarks + their storage step are advisory (continue-on-error).
    # They're informational performance tracking, not a correctness
    # gate — flakes (e.g. occasional benchmark panics on shared CI
    # runners, or the action's gh-pages auto-push tripping on a dirty
    # working tree after `> benchmark_raw.txt` creates an untracked
    # file) should not block merges. The benchmark-action writes to a
    # separate gh-pages branch, so skipping a run has no impact on
    # code correctness.
    - name: Run benchmarks
      continue-on-error: true
      run: |
        go test -run=^$ -bench=. -benchmem ./... > benchmark_raw.txt
        # Keep only valid Go benchmark output lines (results + header).
        # This avoids log interleaving that can corrupt benchmark-action parsing.
        grep -E '^(Benchmark[^[:space:]]+[[:space:]]+[0-9]+[[:space:]]+[0-9.]+[[:space:]]+ns/op|goos:|goarch:|pkg:|cpu:)' benchmark_raw.txt > benchmark.txt || true
        cat benchmark.txt

    - name: Check benchmark output
      id: benchmark_check
      continue-on-error: true
      run: |
        if [ -f benchmark.txt ] && grep -q '^Benchmark' benchmark.txt; then
          echo "has_benchmark=true" >> $GITHUB_OUTPUT
        else
          echo "has_benchmark=false" >> $GITHUB_OUTPUT
        fi

    - name: Store benchmark result
      uses: benchmark-action/github-action-benchmark@52576c92bccf6ac60c8223ec7eb2565637cae9ba # v1
      continue-on-error: true
      if: github.ref == 'refs/heads/main' && steps.benchmark_check.outputs.has_benchmark == 'true'
      with:
        tool: 'go'
        output-file-path: benchmark.txt
        github-token: ${{ secrets.GITHUB_TOKEN }}
        auto-push: true

  integration-tests:
    name: Integration Tests
    runs-on: ubuntu-latest
    timeout-minutes: 25

    steps:
    - uses: actions/checkout@v4

    - name: Set up Go
      uses: actions/setup-go@v6
      with:
        go-version: '1.25'
        cache: false

    - name: Drop local replace directives (CI uses published modules)
      run: |
        go mod edit -dropreplace github.com/cordum-io/cap/v2
        go mod tidy

    - name: Run integration-tagged tests
      run: go test -v -tags=integration -timeout 10m ./...

  lint:
    name: Lint
    runs-on: ubuntu-latest
    timeout-minutes: 10

    steps:
    - uses: actions/checkout@v4

    - name: Set up Go
      uses: actions/setup-go@v6
      with:
        go-version: '1.25'
        cache: false

    - name: Drop local replace directives (CI uses published modules)
      run: |
        go mod edit -dropreplace github.com/cordum-io/cap/v2
        go mod tidy

    - name: Repo-root build
      run: go build ./...

    - name: Repo-root vet
      run: go vet ./...

    - name: golangci-lint
      uses: golangci/golangci-lint-action@82606bf257cbaff209d206a39f5134f0cfbfd2ee # v9.2.1
      with:
        version: v2.11.4
        args: --timeout=5m

    - name: Lint shell scripts for secret leaks
      run: bash tools/scripts/lint_no_secret_log.sh

    - name: Self-test the secret/shell-exec lint guard
      run: bash tools/scripts/lint_no_secret_log.test.sh

  dashboard-test:
    name: Dashboard Tests
    runs-on: ubuntu-latest
    timeout-minutes: 10

    permissions:
      contents: read
      # Required for the Phase 5d (task-50bbfd7d) bundle-size PR comment.
      # Comment is posted only on pull_request events; main pushes still
      # build + run the size parser but skip the comment step.
      pull-requests: write

    steps:
    - uses: actions/checkout@v4

    - name: Set up pnpm
      uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4
      with:
        version: 9.15.9
        run_install: false

    - name: Set up Node
      uses: actions/setup-node@v5
      with:
        node-version-file: dashboard/.nvmrc
        cache: pnpm
        cache-dependency-path: dashboard/pnpm-lock.yaml

    - name: Check dashboard dependency hygiene (EDGE-074)
      run: bash tools/scripts/check_dashboard_deps.sh

    - name: Install dashboard dependencies
      working-directory: dashboard
      run: pnpm install --frozen-lockfile

    - name: Check API codegen drift
      working-directory: dashboard
      run: pnpm run check-api-codegen

    - name: Lint dashboard
      working-directory: dashboard
      run: pnpm run lint

    - name: Lint dashboard accessibility
      working-directory: dashboard
      run: pnpm run lint:a11y

    - name: Typecheck dashboard (noUnusedLocals + noUnusedParameters gate, task-dd1a5934)
      working-directory: dashboard
      run: pnpm exec tsc --noEmit

    - name: Run dashboard tests
      working-directory: dashboard
      run: |
        mkdir -p test-results
        pnpm exec vitest run --reporter=junit --outputFile=./test-results/vitest.xml

    - name: Upload dashboard test results
      if: always()
      uses: actions/upload-artifact@v7
      with:
        name: dashboard-vitest-results
        path: dashboard/test-results/vitest.xml

    # Phase 5d (task-50bbfd7d) — production build + bundle-size soft gate.
    # Build runs AFTER vitest so build failures don't mask test failures.
    - name: Build dashboard
      working-directory: dashboard
      run: pnpm run build

    - name: Compute bundle-size report
      working-directory: dashboard
      run: node scripts/parse-bundle-stats.mjs > "$RUNNER_TEMP/bundle-stats.md"

    - name: Upload bundle visualizer artifact
      if: always()
      uses: actions/upload-artifact@v7
      with:
        name: dashboard-bundle-stats
        path: |
          dashboard/dist/stats.html
          ${{ runner.temp }}/bundle-stats.md
        retention-days: 14

    - name: Find existing bundle-size comment
      if: github.event_name == 'pull_request'
      id: find-bundle-size-comment
      uses: peter-evans/find-comment@3eae4d37986fb5a8592848f6a574fdf654e61f9e # v3
      with:
        issue-number: ${{ github.event.pull_request.number }}
        comment-author: "github-actions[bot]"
        body-includes: "<!-- bundle-size-report -->"

    - name: Post bundle-size comment to PR
      if: github.event_name == 'pull_request'
      uses: peter-evans/create-or-update-comment@e8674b075228eee787fea43ef493e45ece1004c9 # v5.0.0
      with:
        issue-number: ${{ github.event.pull_request.number }}
        comment-id: ${{ steps.find-bundle-size-comment.outputs.comment-id }}
        body-path: ${{ runner.temp }}/bundle-stats.md
        edit-mode: replace

  lhci-login:
    name: Lighthouse CI (/login)
    runs-on: ubuntu-latest
    timeout-minutes: 15
    if: github.event_name == 'pull_request'
    permissions:
      contents: read
      pull-requests: write

    steps:
    - uses: actions/checkout@v4

    - name: Set up pnpm
      uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4
      with:
        version: 9.15.9
        run_install: false

    - name: Set up Node
      uses: actions/setup-node@v5
      with:
        node-version-file: dashboard/.nvmrc
        cache: pnpm
        cache-dependency-path: dashboard/pnpm-lock.yaml

    - name: Install dashboard dependencies
      working-directory: dashboard
      run: pnpm install --frozen-lockfile

    - name: Build dashboard for preview
      working-directory: dashboard
      run: pnpm run build

    - name: Run Lighthouse CI against /login (warn-only)
      id: lhci
      working-directory: dashboard
      continue-on-error: true
      run: pnpm run lhci

    - name: Comment Lighthouse scores on PR
      if: always() && steps.lhci.outcome != 'skipped'
      uses: actions/github-script@v7
      with:
        script: |
          const fs = require('fs');
          const path = require('path');
          const lhciDir = '.lighthouseci';
          const dashboardDir = 'dashboard';
          const marker = '<!-- lighthouse-login-report -->';
          let body = `${marker}\n### Lighthouse CI — \`/login\`\n\n`;
          try {
            const manifestPath = path.join(dashboardDir, lhciDir, 'manifest.json');
            const manifest = JSON.parse(fs.readFileSync(manifestPath, 'utf8'));
            const median = manifest.find(m => m.isRepresentativeRun) || manifest[0];
            if (!median) {
              body += '_No representative run found in manifest._\n';
            } else {
              const summary = median.summary || {};
              const fmt = v => (v == null ? 'n/a' : Math.round(v * 100));
              body += '| Category | Score |\n|---|---|\n';
              body += `| Performance | ${fmt(summary.performance)} |\n`;
              body += `| Accessibility | ${fmt(summary.accessibility)} |\n`;
              body += `| Best Practices | ${fmt(summary['best-practices'])} |\n`;
              body += `| SEO | ${fmt(summary.seo)} |\n\n`;
              if (median.url) body += `Run URL: ${median.url}\n`;
            }
            body += `\n_Soft thresholds (warn-only): perf ≥ 70, a11y ≥ 90, best-practices ≥ 85. Authenticated-flow lhci is filed as a follow-up task._`;
          } catch (e) {
            body += `_Lighthouse CI artifacts unavailable: ${e.message}_`;
          }
          const { owner, repo } = context.repo;
          const issue_number = context.payload.pull_request.number;
          const comments = await github.paginate(github.rest.issues.listComments, {
            owner,
            repo,
            issue_number,
            per_page: 100,
          });
          const existing = comments.find(comment => comment.body?.includes(marker));
          if (existing) {
            await github.rest.issues.updateComment({
              owner,
              repo,
              comment_id: existing.id,
              body,
            });
          } else {
            await github.rest.issues.createComment({ owner, repo, issue_number, body });
          }

    - name: Upload lhci artifacts
      if: always()
      uses: actions/upload-artifact@v7
      with:
        name: lhci-login-results
        path: dashboard/.lighthouseci/

  security:
    name: Security Scan
    runs-on: ubuntu-latest
    timeout-minutes: 15
    permissions:
      contents: read          # checkout
      security-events: write  # upload-sarif to the code-scanning API

    steps:
    - uses: actions/checkout@v4

    - name: Set up Go
      uses: actions/setup-go@v6
      with:
        go-version: '1.25'
        cache: false

    - name: Drop local replace directives (CI uses published modules)
      run: |
        go mod edit -dropreplace github.com/cordum-io/cap/v2
        go mod tidy

    - name: Install gosec
      env:
        GOFLAGS: ""
        GOTOOLCHAIN: local
      run: go install github.com/securego/gosec/v2/cmd/gosec@v2.22.4

    # gosec runs once per Go module (cmd+core live in the root module; the
    # shipped SDK is a separate module). `./sdk/...` from the root module
    # matches nothing, so each module is scanned with its own scoped patterns.
    # -no-fail keeps these steps green; the "Fail on gosec findings" gate below
    # is the single place that fails the job, so SARIF still uploads on failure.
    - name: Run gosec (core platform + CLIs)
      env:
        GOFLAGS: ""
        GOTOOLCHAIN: local
      run: gosec -no-fail -fmt sarif -out gosec-core.sarif -exclude-dir=vendor ./cmd/... ./core/...

    - name: Run gosec (Go SDK)
      working-directory: sdk
      env:
        GOFLAGS: ""
        GOTOOLCHAIN: local
      run: gosec -no-fail -fmt sarif -out ../gosec-sdk.sarif -exclude-dir=vendor ./client/... ./runtime/...

    - name: Sanitize SARIF
      # Strip rule relationship metadata and generated-protobuf (.pb.go)
      # results (noise, not actionable). The SDK SARIF paths are relative to
      # the sdk/ module dir, so prefix them back to repo-root for the Security
      # tab. The gate counts the sanitized set.
      run: |
        sanitize() { # $1=in $2=out $3=uri-prefix(optional)
          jq --arg p "${3:-}" '
            (.runs[]?.tool.driver.rules[]? |= del(.relationships))
            | (.runs[]?.results |= ((. // []) | map(select(
                ([.locations[]?.physicalLocation.artifactLocation.uri // ""] | any(endswith(".pb.go"))) | not
              ))))
            | (if $p != "" then (.runs[]?.results[]?.locations[]?.physicalLocation.artifactLocation.uri |= ($p + .)) else . end)
          ' "$1" > "$2"
        }
        sanitize gosec-core.sarif gosec-core.cleaned.sarif ""
        sanitize gosec-sdk.sarif  gosec-sdk.cleaned.sarif  "sdk/"

    # Core keeps the default analysis category so the pre-existing gosec alerts
    # uploaded under it are auto-resolved when they disappear from the SARIF.
    - name: Upload SARIF (core)
      if: always() && hashFiles('gosec-core.cleaned.sarif') != ''
      uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4
      with:
        sarif_file: gosec-core.cleaned.sarif

    - name: Upload SARIF (sdk)
      if: always() && hashFiles('gosec-sdk.cleaned.sarif') != ''
      uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4
      with:
        sarif_file: gosec-sdk.cleaned.sarif
        category: gosec-sdk

    - name: Fail on gosec findings
      run: |
        total=$(jq -s '[.[].runs[].results[]] | length' gosec-core.cleaned.sarif gosec-sdk.cleaned.sarif)
        echo "gosec findings after sanitize: $total"
        if [ "$total" -gt 0 ]; then
          echo "::error::gosec reported $total finding(s); see the Security tab (categories: default + gosec-sdk)"
          jq -r '.runs[]?.results[]? | "  \(.ruleId) \(.locations[0].physicalLocation.artifactLocation.uri):\(.locations[0].physicalLocation.region.startLine // 0)"' gosec-core.cleaned.sarif gosec-sdk.cleaned.sarif || true
          exit 1
        fi

  build:
    name: Build
    runs-on: ubuntu-latest

    steps:
    - uses: actions/checkout@v4

    - name: Set up Go
      uses: actions/setup-go@v6
      with:
        go-version: '1.25'
        cache: false

    - name: Drop local replace directives (CI uses published modules)
      run: |
        go mod edit -dropreplace github.com/cordum-io/cap/v2
        go mod tidy

    - name: Build all binaries
      run: |
        mkdir -p bin
        go build -v -o bin/ ./cmd/...

    - name: Verify binaries
      run: |
        for binary in bin/*; do
          echo "Built $binary"
          if [ ! -x "$binary" ] || [ ! -s "$binary" ]; then
            echo "Binary not executable or empty: $binary"
            exit 1
          fi
        done

  quickstart-env-sharing:
    name: Quickstart Env Sharing
    runs-on: ubuntu-latest
    needs: [build]
    timeout-minutes: 15

    steps:
    - uses: actions/checkout@v4

    - name: Set up Go
      uses: actions/setup-go@v6
      with:
        go-version: '1.25'

    - name: Generate TLS certificates
      run: |
        go run ./cmd/cordumctl generate-certs --dir ./certs
        chmod -R a+rX ./certs

    - name: Build compose images
      run: docker compose build
      env:
        CORDUM_API_KEY: quickstart-env-sharing-build-key
        REDIS_PASSWORD: quickstart-env-sharing-build-redis

    - name: Run quickstart env-sharing test
      run: bash tools/scripts/quickstart_env_sharing_test.sh
      env:
        CORDUM_INTEGRATION: "1"
        CORDUM_QUICKSTART_ENV_SHARING_MODE: live

    - name: Dump debug logs on failure
      if: failure()
      run: |
        export CORDUM_API_KEY="${CORDUM_API_KEY:-quickstart-env-sharing-debug-key}"
        export REDIS_PASSWORD="${REDIS_PASSWORD:-quickstart-env-sharing-debug-redis}"
        echo "=== Docker service logs (last 80 lines each) ==="
        for svc in scheduler workflow-engine api-gateway safety-kernel nats redis; do
          echo "--- $svc ---"
          docker compose logs --tail=80 --no-color "$svc" 2>/dev/null || true
        done

    - name: Tear down services
      if: always()
      run: |
        export CORDUM_API_KEY="${CORDUM_API_KEY:-quickstart-env-sharing-teardown-key}"
        export REDIS_PASSWORD="${REDIS_PASSWORD:-quickstart-env-sharing-teardown-redis}"
        docker compose down -v

  openapi:
    name: OpenAPI Validate
    runs-on: ubuntu-latest
    timeout-minutes: 10

    steps:
    - uses: actions/checkout@v4
      with:
        fetch-depth: 0

    - name: Set up Go
      uses: actions/setup-go@v6
      with:
        go-version: '1.25'
        cache: false

    - name: Install oasdiff
      run: go install github.com/oasdiff/oasdiff@v1.11.7

    - name: Mark allow-breaking if commit message requests it
      id: allow_breaking
      # On pull_request events, checkout@v4 creates a synthetic merge commit
      # so `git log -1` reads the merge message rather than the contributor's
      # commit. Inspect the contributor commit (HEAD^2 on PR merges, HEAD
      # otherwise) so the allow-breaking-openapi marker actually takes effect.
      run: |
        TARGET_REF="HEAD"
        if [[ "${{ github.event_name }}" == "pull_request" ]] && git rev-parse --verify HEAD^2 >/dev/null 2>&1; then
          TARGET_REF="HEAD^2"
        fi
        if git log -1 --pretty=%B "$TARGET_REF" | grep -q 'allow-breaking-openapi'; then
          echo "OPENAPI_ALLOW_BREAKING=1" >> "$GITHUB_ENV"
          echo "::notice::allow-breaking-openapi marker found on $TARGET_REF; oasdiff will not fail on breaking changes"
        fi

    - name: Validate OpenAPI
      run: make openapi-validate
      env:
        OPENAPI_BASE_REF: origin/${{ github.base_ref || 'main' }}