ci.yml

name: CI

on:
  push:
    branches:
      - main
    tags:
      - "v*"
  pull_request:

permissions:
  contents: read

concurrency:
  group: ci-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  test:
    name: Python ${{ matrix.python }} / JDK ${{ matrix.java }} / ${{ matrix.os }}
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: ubuntu-latest
            python: "3.9"
            java: "11"
          - os: ubuntu-latest
            python: "3.13"
            java: "11"
          - os: ubuntu-latest
            python: "3.14"
            java: "21"
          - os: macos-latest
            python: "3.13"
            java: "21"
          - os: windows-latest
            python: "3.13"
            java: "21"

    steps:
      - uses: actions/checkout@v5
      - uses: actions/setup-python@v6
        with:
          python-version: ${{ matrix.python }}
          cache: pip
      - uses: actions/setup-java@v5
        with:
          distribution: temurin
          java-version: ${{ matrix.java }}
      - name: Install package
        if: runner.os != 'Windows'
        run: python -m pip install .
      - name: Install package in an isolated Windows environment
        if: runner.os == 'Windows'
        shell: pwsh
        run: |
          $venv = Join-Path $env:RUNNER_TEMP "repomin-test-venv"
          python -m venv $venv
          $venvPython = Join-Path $venv "Scripts\python.exe"
          & $venvPython -m pip install --disable-pip-version-check --no-deps $env:GITHUB_WORKSPACE
          if ($LASTEXITCODE -ne 0) {
            throw "Checkout installation failed"
          }
          "REPOMIN_TEST_PYTHON=$venvPython" | Out-File -FilePath $env:GITHUB_ENV -Append
          (Split-Path -Parent $venvPython) | Out-File -FilePath $env:GITHUB_PATH -Append
      - name: Run Windows quick-start smoke
        if: runner.os == 'Windows'
        shell: pwsh
        run: |
          & "$env:GITHUB_WORKSPACE\scripts\check_windows_quickstart.ps1" `
            -Python $env:REPOMIN_TEST_PYTHON
      - name: Validate PowerShell completion
        if: runner.os == 'Windows'
        shell: pwsh
        run: |
          $script = (python -m repomin completion powershell) -join "`n"
          if ($LASTEXITCODE -ne 0) {
            throw "PowerShell completion generation failed"
          }
          if ($script -notmatch 'Register-ArgumentCompleter') {
            throw "PowerShell completion output is missing its registration command"
          }
          Invoke-Expression $script
      - name: Run tests
        run: python -m unittest discover -s tests -v

  offline-benchmarks:
    name: Offline benchmarks
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5
      - uses: actions/setup-python@v6
        with:
          python-version: "3.13"
      - name: Run network-free benchmarks
        run: python3 benchmarks/run_offline.py --json-output benchmark-results.json
      - name: Upload benchmark summary
        uses: actions/upload-artifact@v6
        with:
          name: offline-benchmark-results
          path: benchmark-results.json
          if-no-files-found: error

  action-smoke:
    name: GitHub Action smoke test
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5
      - name: Run local ReproMin action
        id: repomin
        uses: ./
        with:
          source: benchmarks/input-controls
          command: python3 reproduce.py
          exit-code: "7"
          adapter: none
          source-reducer: none
          ignore: |
            removable-a.txt
            removable-b.txt
          ignore-path: nested/deep-noise.txt
          keep: keep-me.txt
          text-file: exit-sentinel.txt
          gitignore: true
          gitignore-recursive: true
          max-attempts: "100"
          max-duration: "120"
          step-summary: true
          artifact-name: action-smoke
      - name: Check action outputs
        shell: bash
        env:
          EXPECTED_PAYLOAD_PREFIX: ${{ runner.temp }}/repomin-result-
          ACTUAL_PAYLOAD: ${{ steps.repomin.outputs.payload-path }}
          ACTUAL_REPORT: ${{ steps.repomin.outputs.report-path }}
          ACTUAL_METADATA: ${{ steps.repomin.outputs.metadata-path }}
          ACTUAL_ARTIFACT: ${{ steps.repomin.outputs.artifact-name }}
          ACTUAL_SCHEMA: ${{ steps.repomin.outputs.report-schema-version }}
          ACTUAL_SOURCE_FILES: ${{ steps.repomin.outputs.source-files }}
          ACTUAL_SOURCE_BYTES: ${{ steps.repomin.outputs.source-bytes }}
          ACTUAL_OUTPUT_FILES: ${{ steps.repomin.outputs.output-files }}
          ACTUAL_OUTPUT_BYTES: ${{ steps.repomin.outputs.output-bytes }}
          ACTUAL_HOLDOUT: ${{ steps.repomin.outputs.holdout-status }}
          ACTUAL_ORACLE: ${{ steps.repomin.outputs.oracle-mode }}
          ACTUAL_FILE_RETENTION: ${{ steps.repomin.outputs.file-retention-ratio }}
          ACTUAL_BYTE_RETENTION: ${{ steps.repomin.outputs.byte-retention-ratio }}
          ACTUAL_FINGERPRINT_MODE: ${{ steps.repomin.outputs.payload-fingerprint-mode }}
          ACTUAL_FINGERPRINT_VERIFIED: ${{ steps.repomin.outputs.payload-fingerprint-verified }}
          ACTUAL_SUMMARY_PATH: ${{ steps.repomin.outputs.step-summary-path }}
        run: |
          set -euo pipefail
          [[ "$ACTUAL_PAYLOAD" == "$EXPECTED_PAYLOAD_PREFIX"* ]]
          [[ "$ACTUAL_REPORT" == "$ACTUAL_PAYLOAD.repomin/report.json" ]]
          [[ "$ACTUAL_METADATA" == "$ACTUAL_PAYLOAD.repomin" ]]
          [[ "$ACTUAL_ARTIFACT" == "action-smoke" ]]
          [[ "$ACTUAL_SCHEMA" == "1" ]]
          [[ "$ACTUAL_SOURCE_FILES" =~ ^[0-9]+$ ]]
          [[ "$ACTUAL_SOURCE_BYTES" =~ ^[0-9]+$ ]]
          [[ "$ACTUAL_OUTPUT_FILES" =~ ^[0-9]+$ ]]
          [[ "$ACTUAL_OUTPUT_BYTES" =~ ^[0-9]+$ ]]
          [[ "$ACTUAL_HOLDOUT" == "not_requested" ]]
          [[ "$ACTUAL_ORACLE" == "exit_code" ]]
          [[ "$ACTUAL_FILE_RETENTION" =~ ^[0-9]+(\.[0-9]+)?$ ]]
          [[ "$ACTUAL_BYTE_RETENTION" =~ ^[0-9]+(\.[0-9]+)?$ ]]
          [[ "$ACTUAL_FINGERPRINT_MODE" == "exact" ]]
          [[ "$ACTUAL_FINGERPRINT_VERIFIED" == "true" ]]
      - name: Check privacy-safe step summary
        shell: bash
        env:
          SUMMARY_PATH: ${{ steps.repomin.outputs.step-summary-path }}
        run: |
          set -euo pipefail
          [[ -n "$SUMMARY_PATH" && -f "$SUMMARY_PATH" ]]
          grep -F '# ReproMin validation summary' "$SUMMARY_PATH"
          grep -F '| `summary_schema_version` | `2` |' "$SUMMARY_PATH"
          grep -F '| `oracle_mode` | `exit_code` |' "$SUMMARY_PATH"
          ! grep -F 'reproduce.py' "$SUMMARY_PATH"
          ! grep -F 'PRIVATE_MATCH_SENTINEL' "$SUMMARY_PATH"
          ! grep -F 'PRIVATE_ENV_NAME' "$SUMMARY_PATH"
      - name: Download and validate action artifact
        uses: actions/download-artifact@v8
        with:
          name: action-smoke
          path: action-smoke-download
      - name: Check downloaded payload and report
        shell: bash
        run: |
          set -euo pipefail
          report=$(find action-smoke-download -type f -path '*/repomin-result-*.repomin/report.json' -print -quit)
          payload=$(find action-smoke-download -type d -name 'repomin-result-*' ! -name '*.repomin' -print -quit)
          if [[ -z "$report" || -z "$payload" ]]; then
            echo "action artifact did not contain payload and report directories" >&2
            find action-smoke-download -print >&2
            exit 1
          fi
          repomin report validate "$report" --payload "$payload" --json
          [[ -f "$payload/keep-me.txt" ]]
          [[ -f "$payload/exit-sentinel.txt" ]]
          [[ ! -s "$payload/exit-sentinel.txt" ]]
          python - "$report" <<'PY'
          import json
          import sys

          with open(sys.argv[1], encoding="utf-8") as stream:
              execution = json.load(stream)["execution"]
          assert execution["keep_paths"] == ["keep-me.txt"]
          assert execution["text_files"] == ["exit-sentinel.txt"]
          assert execution["max_attempts"] == 100
          assert execution["max_duration_seconds"] == 120.0
          PY

      - name: Prepare Python exception oracle fixture
        shell: bash
        run: |
          mkdir action-python-exception-fixture
          cat > action-python-exception-fixture/reproduce.py <<'PY'
          from pathlib import Path


          def target_failure():
              raise ValueError("payment failed")


          def fallback_failure():
              raise ValueError("payment failed")


          if Path("required.txt").is_file():
              target_failure()
          else:
              fallback_failure()
          PY
          printf 'keep\n' > action-python-exception-fixture/required.txt
          printf 'remove\n' > action-python-exception-fixture/unused.txt
          cat > action-python-exception-fixture/.repomin.json <<'JSON'
          {
            "schema_version": 1,
            "failure": {
              "command": "python3 reproduce.py",
              "match": "ValueError",
              "signature": "python_exception"
            },
            "execution": {
              "jobs": 1
            },
            "sampling": {
              "baseline_runs": 2,
              "candidate_runs": 1
            },
            "reduction": {
              "adapter": "none",
              "source_reducer": "none",
              "max_attempts": 100
            },
            "inputs": {
              "keep_paths": ["required.txt"]
            }
          }
          JSON
      - name: Run local ReproMin action with a Python exception oracle
        id: repomin_exception
        uses: ./
        with:
          source: action-python-exception-fixture
          config: action-python-exception-fixture/.repomin.json
          step-summary: true
          artifact-name: action-exception-smoke
      - name: Check exception signature output and payload
        shell: bash
        env:
          ACTUAL_ORACLE: ${{ steps.repomin_exception.outputs.oracle-mode }}
          PAYLOAD_PATH: ${{ steps.repomin_exception.outputs.payload-path }}
          REPORT_PATH: ${{ steps.repomin_exception.outputs.report-path }}
          SUMMARY_PATH: ${{ steps.repomin_exception.outputs.step-summary-path }}
        run: |
          set -euo pipefail
          [[ "$ACTUAL_ORACLE" == "python_exception" ]]
          [[ -f "$PAYLOAD_PATH/reproduce.py" ]]
          [[ -f "$PAYLOAD_PATH/required.txt" ]]
          [[ ! -e "$PAYLOAD_PATH/unused.txt" ]]
          repomin report validate "$REPORT_PATH" --payload "$PAYLOAD_PATH" --json
          grep -F '| `oracle_mode` | `python_exception` |' "$SUMMARY_PATH"
          ! grep -F 'ValueError' "$SUMMARY_PATH"
          ! grep -F 'payment failed' "$SUMMARY_PATH"
          python - "$REPORT_PATH" <<'PY'
          import json
          import sys

          with open(sys.argv[1], encoding="utf-8") as stream:
              report = json.load(stream)
          failure_spec = report["failure_spec"]
          assert failure_spec["match"] == "ValueError"
          assert failure_spec["java_exception"] is False
          assert failure_spec["python_exception"] is True
          assert failure_spec["process_failure"] is False
          signature = report["python_exception_signature"]
          assert signature["class"] == "ValueError"
          assert signature["message"] == "payment failed"
          assert signature["frames"][0].endswith(":target_failure")
          assert all("fallback_failure" not in frame for frame in signature["frames"])
          PY
      - name: Prepare Java exception oracle fixture
        shell: bash
        run: |
          mkdir action-java-exception-fixture
          cat > action-java-exception-fixture/reproduce.py <<'PY'
          from pathlib import Path
          import sys


          print(
              "java.lang.NoSuchMethodError: demo.Target.missing()",
              file=sys.stderr,
          )
          if Path("required.txt").is_file():
              print("    at demo.Target.run(Target.java:42)", file=sys.stderr)
          else:
              print("    at demo.Fallback.run(Fallback.java:9)", file=sys.stderr)
          raise SystemExit(1)
          PY
          printf 'keep\n' > action-java-exception-fixture/required.txt
          printf 'remove\n' > action-java-exception-fixture/unused.txt
      - name: Run local ReproMin action with a Java exception oracle
        id: repomin_java_exception
        uses: ./
        with:
          source: action-java-exception-fixture
          command: python3 reproduce.py
          match: NoSuchMethodError
          java-exception: "true"
          adapter: none
          source-reducer: none
          artifact-name: action-java-exception-smoke
      - name: Check Java exception signature output and payload
        shell: bash
        env:
          ACTUAL_ORACLE: ${{ steps.repomin_java_exception.outputs.oracle-mode }}
          PAYLOAD_PATH: ${{ steps.repomin_java_exception.outputs.payload-path }}
          REPORT_PATH: ${{ steps.repomin_java_exception.outputs.report-path }}
        run: |
          set -euo pipefail
          [[ "$ACTUAL_ORACLE" == "java_exception" ]]
          [[ -f "$PAYLOAD_PATH/reproduce.py" ]]
          [[ -f "$PAYLOAD_PATH/required.txt" ]]
          [[ ! -e "$PAYLOAD_PATH/unused.txt" ]]
          repomin report validate "$REPORT_PATH" --payload "$PAYLOAD_PATH" --json
          python - "$REPORT_PATH" <<'PY'
          import json
          import sys

          with open(sys.argv[1], encoding="utf-8") as stream:
              report = json.load(stream)
          failure_spec = report["failure_spec"]
          assert failure_spec["match"] == "NoSuchMethodError"
          assert failure_spec["java_exception"] is True
          assert failure_spec["python_exception"] is False
          assert failure_spec["process_failure"] is False
          signature = report["java_exception_signature"]
          assert signature["class"] == "java.lang.NoSuchMethodError"
          assert signature["message"] == "demo.Target.missing()"
          assert signature["frames"] == ["demo.Target.run"]
          PY

  quality:
    name: Packaging and static checks
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5
      - uses: actions/setup-python@v6
        with:
          python-version: "3.13"
          cache: pip
      - uses: actions/setup-java@v5
        with:
          distribution: temurin
          java-version: "11"
      - name: Install build tools
        run: python -m pip install build coverage ruff twine
      - name: Run contributor preflight (static and documentation checks)
        run: python scripts/check_contribution.py --skip-tests
      - name: Report test coverage
        run: |
          PYTHONPATH=src python -m coverage run --branch -m unittest discover -s tests
          python -m coverage report --show-missing
          python -m coverage xml -o coverage.xml
      - name: Upload coverage report
        uses: actions/upload-artifact@v6
        with:
          name: coverage-report
          path: coverage.xml
          if-no-files-found: error
      - name: Build wheel and source distribution
        run: python -m build
      - name: Check distribution metadata
        run: python -m twine check dist/*
      - name: Validate release artifacts
        shell: bash
        run: |
          version=$(PYTHONPATH=src python -c 'import repomin; print(repomin.__version__)')
          python scripts/check_release_artifacts.py \
            --tag "v$version" \
            "dist/repomin-$version-py3-none-any.whl" \
            "dist/repomin-$version.tar.gz"
      - name: Upload distributions
        uses: actions/upload-artifact@v6
        with:
          name: distributions
          path: dist/*
          if-no-files-found: error

  installed-distribution:
    name: Installed ${{ matrix.label }}
    needs: quality
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        include:
          - label: wheel
            pattern: "*.whl"
          - label: source distribution
            pattern: "*.tar.gz"
    steps:
      - uses: actions/checkout@v5
      - uses: actions/setup-python@v6
        with:
          python-version: "3.13"
          cache: pip
      - uses: actions/setup-java@v5
        with:
          distribution: temurin
          java-version: "11"
      - name: Download distributions
        uses: actions/download-artifact@v8
        with:
          name: distributions
          path: dist
      - name: Test installed ${{ matrix.label }}
        shell: bash
        env:
          DISTRIBUTION_LABEL: ${{ matrix.label }}
          DISTRIBUTION_PATTERN: ${{ matrix.pattern }}
        run: |
          set -euo pipefail

          distributions=("$GITHUB_WORKSPACE"/dist/$DISTRIBUTION_PATTERN)
          if [[ ${#distributions[@]} -ne 1 || ! -f "${distributions[0]}" ]]; then
            echo "expected exactly one $DISTRIBUTION_LABEL in dist/" >&2
            exit 1
          fi

          venv="$RUNNER_TEMP/repomin-installed-venv"
          run_dir="$RUNNER_TEMP/repomin-installed-tests"
          python -m venv "$venv"
          mkdir "$run_dir"
          "$venv/bin/python" -m pip install --no-cache-dir "${distributions[0]}"

          cd "$run_dir"
          "$venv/bin/repomin" --help >/dev/null
          expected_version=$("$venv/bin/python" -c 'import repomin; print("repomin " + repomin.__version__)')
          version_output=$("$venv/bin/repomin" --version)
          if [[ "$version_output" != "$expected_version" ]]; then
            echo "unexpected installed $DISTRIBUTION_LABEL version: $version_output" >&2
            exit 1
          fi
          "$venv/bin/python" -I - <<'PY'
          from pathlib import Path
          import sys

          import repomin

          package_path = Path(repomin.__file__).resolve()
          environment_path = Path(sys.prefix).resolve()
          try:
              package_path.relative_to(environment_path)
          except ValueError:
              raise SystemExit(
                  f"repomin imported outside isolated environment: {package_path}"
              )
          print(f"testing installed package at {package_path}")
          PY
          "$venv/bin/python" -I -m unittest discover \
            -s "$GITHUB_WORKSPACE/tests" -v