From 54d9d6f2bfb9ed4d5f4ba4ae41e71c6f8989782e Mon Sep 17 00:00:00 2001
From: Dan Kowalski <dkowalski@immersivefusion.com>
Date: Wed, 2 Sep 2026 23:59:35 -0400
Subject: [PATCH] ci: run tests and a packaging check on pull requests

The only workflow triggered on version tags, so nothing ran on a pull request.
PR #10 merged to main with zero automated checks, and the tests it added would
first have executed after a release tag, which is after the code had landed.

Adds a CI workflow on pull_request and pushes to main. Release packaging stays in
build.yml on tags only, so a pull request does not build all six platforms.

Alongside the tests it publishes one representative RID and asserts the output is
a single self-contained dcp that reaches its startup key check. A broken
single-file publish previously stayed invisible until a release was being cut.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 .github/workflows/ci.yml | 64 ++++++++++++++++++++++++++++++++++++++++
 1 file changed, 64 insertions(+)
 create mode 100644 .github/workflows/ci.yml

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 0000000..316c1e0
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,64 @@
+name: CI
+
+# Runs on every pull request and on pushes to main.
+# Release packaging stays in build.yml, which triggers on version tags only.
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: '10.0.x'
+
+      - name: Test
+        run: dotnet test src/IF.APM.App.MCP.slnx --configuration Release --verbosity normal
+
+  package:
+    # Publishing only ran at tag time, so a broken single-file publish stayed
+    # invisible until a release was already being cut. One representative RID
+    # here catches that on the pull request instead.
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: '10.0.x'
+
+      - name: Publish
+        run: >
+          dotnet publish src/IF.APM.App.MCP.Server/IF.APM.App.MCP.Server.csproj
+          --configuration Release
+          --runtime linux-x64
+          --self-contained true
+          -p:PublishSingleFile=true
+          -p:IncludeNativeLibrariesForSelfExtract=true
+          -p:EnableCompressionInSingleFile=true
+          -p:DebugType=none
+          --output ./publish
+
+      - name: Verify the published binary is a single self-contained dcp
+        run: |
+          test -f publish/dcp || { echo "expected publish/dcp"; ls -la publish; exit 1; }
+          extra=$(find publish -maxdepth 1 -type f ! -name dcp | wc -l)
+          if [ "$extra" -ne 0 ]; then
+            echo "publish output is not a single file:"
+            ls -la publish
+            exit 1
+          fi
+          chmod +x publish/dcp
+          # No API key here, so the server must fail on the key and nothing else.
+          output=$(./publish/dcp </dev/null 2>&1 || true)
+          echo "$output" | head -3
+          echo "$output" | grep -q "API Key was not provided" || {
+            echo "binary did not reach its startup key check"; exit 1; }