base.yml

on:
  pull_request:
    paths-ignore:
      - '.github/**'
      - 'docs/**'

name: Check, Build and Test

concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true

jobs:
  format:
    name: compat-rustfmt
    runs-on: [self-hosted]

    env:
      CARGO_TERM_COLOR: always

    steps:
      - name: Checkout repository
        uses: actions/checkout@v5
        with:
          submodules: recursive

      - name: Install nightly toolchain
        run: |
          rustup toolchain install nightly --profile minimal
          rustup component add rustfmt --toolchain nightly

      - name: Run rustfmt
        run: cargo +nightly fmt --all --check

  clippy:
    name: compat-clippy
    strategy:
      fail-fast: true

    runs-on: [self-hosted]
    env:
      CARGO_TERM_COLOR: always
      RUSTUP_TOOLCHAIN: stable
      LIBRA_SKIP_WEB_BUILD: "1"

    steps:
      - name: Checkout repository
        uses: actions/checkout@v5
        with:
          submodules: recursive

      - name: Setup Node.js
        uses: actions/setup-node@v5
        with:
          node-version: "22"

      - name: Enable pnpm
        run: |
          corepack enable
          corepack prepare pnpm@11.10.0 --activate

      - name: Run cargo clippy
        run: cargo clippy --all-targets --all-features -- -D warnings

  web-check:
    name: compat-web-check
    runs-on: [self-hosted]

    env:
      CARGO_TERM_COLOR: always

    steps:
      - name: Checkout repository
        uses: actions/checkout@v5
        with:
          submodules: recursive

      - name: Setup Node.js
        uses: actions/setup-node@v5
        with:
          node-version: "22"

      - name: Enable pnpm
        run: |
          corepack enable
          corepack prepare pnpm@11.10.0 --activate

      # The Rust crate's `build.rs` skips the web build whenever
      # `LIBRA_SKIP_WEB_BUILD=1` (set on every other job for speed). This
      # dedicated job re-asserts that the Next.js source still type-checks,
      # lints, and produces a clean static export so `web/out/` cannot
      # silently drift away from `WebAssets` in main. Per
      # docs/improvement/web.md Phase 5 verification.
      - name: Install web dependencies
        run: pnpm --dir web install --frozen-lockfile

      - name: Lint web
        run: pnpm --dir web lint

      - name: Test web
        run: pnpm --dir web test

      - name: Build web (static export → web/out/)
        run: pnpm --dir web build

      - name: Check web/out static export drift
        shell: bash
        run: |
          status="$(git status --porcelain -- web/out)"
          if [[ -n "$status" ]]; then
            echo "web/out has untracked, staged, or unstaged files after the static export build." >&2
            echo "Run 'pnpm --dir web build' locally and commit the updated web/out files." >&2
            printf '%s\n' "$status" >&2
            exit 1
          fi

  # plan-20260715 W3-15: Playwright real-browser main-chain against a
  # deterministic --web-only fake-provider runtime. Soft-skip is refused via
  # LIBRA_E2E_REQUIRE=1 (Checkpoint C completion evidence).
  compat-web-e2e:
    name: compat-web-e2e
    runs-on: [self-hosted]
    needs: []
    env:
      LIBRA_SKIP_WEB_BUILD: "1"
      LIBRA_E2E_REQUIRE: "1"
      LIBRA_E2E_PORT: "4410"
      LIBRA_E2E_BASE_URL: "http://127.0.0.1:4410"
      CARGO_TERM_COLOR: always

    steps:
      - name: Checkout repository
        uses: actions/checkout@v5
        with:
          submodules: recursive

      - name: Setup Node.js
        uses: actions/setup-node@v5
        with:
          node-version: "22"

      - name: Enable pnpm
        run: |
          corepack enable
          corepack prepare pnpm@11.10.0 --activate

      - name: Install web dependencies
        run: pnpm --dir web install --frozen-lockfile

      - name: Install Playwright Chromium
        run: pnpm --dir web exec playwright install --with-deps chromium

      - name: Build test-provider libra
        run: cargo build --features test-provider

      - name: Start deterministic Web runtime
        shell: bash
        run: |
          LIBRA_E2E_BIN="${GITHUB_WORKSPACE}/target/debug/libra" \
            ./web/e2e/scripts/start-deterministic-runtime.sh \
            >"${RUNNER_TEMP}/libra-e2e-runtime.log" 2>&1 &
          echo $! >"${RUNNER_TEMP}/libra-e2e-runtime.pid"
          for _ in $(seq 1 120); do
            if curl -fsS "${LIBRA_E2E_BASE_URL}/api/health" 2>/dev/null | grep -qx 'ok'; then
              echo "runtime ready"
              exit 0
            fi
            if ! kill -0 "$(cat "${RUNNER_TEMP}/libra-e2e-runtime.pid")" 2>/dev/null; then
              echo "runtime exited early:" >&2
              cat "${RUNNER_TEMP}/libra-e2e-runtime.log" >&2 || true
              exit 1
            fi
            sleep 1
          done
          echo "timed out waiting for /api/health" >&2
          cat "${RUNNER_TEMP}/libra-e2e-runtime.log" >&2 || true
          exit 1

      - name: Run Playwright e2e
        run: pnpm --dir web test:e2e

      - name: Stop deterministic Web runtime
        if: always()
        shell: bash
        run: |
          if [[ -f "${RUNNER_TEMP}/libra-e2e-runtime.pid" ]]; then
            kill "$(cat "${RUNNER_TEMP}/libra-e2e-runtime.pid")" 2>/dev/null || true
          fi

      - name: Upload Playwright artifacts on failure
        if: failure()
        uses: actions/upload-artifact@v4
        with:
          name: web-e2e-playwright
          path: |
            web/test-results/
            web/playwright-report/
            ${{ runner.temp }}/libra-e2e-runtime.log
          if-no-files-found: ignore

      - name: Clean Playwright local artifacts
        if: always()
        shell: bash
        run: rm -rf web/test-results web/playwright-report || true

  owner-liveness-macos:
    # plan-20260714 W1 (§C.9): the operation claim decides whether a control
    # action's owner is dead by proving it — boot id + PID namespace on Linux,
    # host UUID + boot time on macOS. The macOS branch has no other coverage,
    # and a failure there does not make claims unsafe, it makes them
    # unreclaimable: a killed command would hold its worktree's control slot
    # until the row is cleared by hand. These five tests are the proof that the
    # platform-specific reads work where they run.
    name: compat-owner-liveness-macos
    runs-on: macos-latest

    env:
      CARGO_TERM_COLOR: always
      LIBRA_SKIP_WEB_BUILD: 1

    steps:
      - name: Checkout repository
        uses: actions/checkout@v5
        with:
          submodules: recursive

      - name: Run the claim-owner liveness tests
        run: cargo test --lib -- claim_owner_tests --test-threads=1

  redundancy:
    name: compat-redundancy
    runs-on: [self-hosted]

    steps:
      - name: Checkout repository
        uses: actions/checkout@v5
        with:
          submodules: recursive

      - name: Run redundancy check
        run: |
          if [ ! -d third-party/rust/crates ]; then
            echo "✅ No third-party/rust/crates directory to check"
            exit 0
          fi

          x=$(find third-party/rust/crates -mindepth 2 -maxdepth 2 -type d -exec bash -c '
            n=$(find "$1" -maxdepth 1 -type f | wc -l)
            [ $n -gt 1 ]
          ' _ {} \; -print -quit | wc -l)
          if [ $x -gt 0 ]; then
            echo "❌ Redundant directories found"
            exit 1
          else
            echo "✅ All good"
            exit 0
          fi

  test:
    name: compat-offline-core

    runs-on: [self-hosted]

    # Below GitHub's 360-minute default so an overrun fails as a timeout with
    # the log intact, rather than being reaped at the platform cap.
    timeout-minutes: 350

    env:
      CARGO_TERM_COLOR: always
      RUSTUP_TOOLCHAIN: stable
      LIBRA_SKIP_WEB_BUILD: "1"
      CARGO_PROFILE_TEST_DEBUG: "0"
      CARGO_BUILD_JOBS: "1"
      # libtest runs each test in a thread with a 2 MiB stack. An unoptimized
      # async state machine — `switch::execute` and friends inline every
      # awaited future into one frame — does not fit, and the test process
      # ABORTS rather than failing. The real CLI runs those futures on the
      # 8 MiB main thread, so this is a harness limit, not a product one.
      RUST_MIN_STACK: "16777216"

    steps:
      - name: Checkout repository
        uses: actions/checkout@v5
        with:
          submodules: recursive

      - name: Setup Node.js
        uses: actions/setup-node@v5
        with:
          node-version: "22"

      - name: Enable pnpm
        run: |
          corepack enable
          corepack prepare pnpm@11.10.0 --activate

      - name: Ensure ripgrep is available
        shell: bash
        run: |
          if command -v rg >/dev/null 2>&1; then
            rg --version
            exit 0
          fi

          if [ "$(id -u)" -eq 0 ]; then
            SUDO=""
          elif command -v sudo >/dev/null 2>&1; then
            SUDO="sudo"
          else
            SUDO=""
          fi

          if command -v apt-get >/dev/null 2>&1; then
            $SUDO apt-get update
            $SUDO apt-get install -y ripgrep
          elif command -v dnf >/dev/null 2>&1; then
            $SUDO dnf install -y ripgrep
          elif command -v yum >/dev/null 2>&1; then
            $SUDO yum install -y ripgrep
          elif command -v brew >/dev/null 2>&1; then
            brew install ripgrep
          else
            cargo install ripgrep --locked
            echo "${HOME}/.cargo/bin" >> "$GITHUB_PATH"
          fi

          command -v rg
          rg --version

      - name: Check compatibility matrix drift
        run: cargo test --test compat_matrix_alignment compatibility_matrix_matches_cli_commands -- --exact

      - name: Run tests (L1 + L2 + L3)
        env:
          LIBRA_TEST_GITHUB_TOKEN: ${{ secrets.LIBRA_TEST_GITHUB_TOKEN }}
          LIBRA_TEST_GITHUB_NAMESPACE: ${{ secrets.LIBRA_TEST_GITHUB_NAMESPACE }}
          DEEPSEEK_API_KEY: ${{ secrets.DEEPSEEK_API_KEY }}
          LIBRA_D1_ACCOUNT_ID: ${{ secrets.LIBRA_D1_ACCOUNT_ID }}
          LIBRA_D1_API_TOKEN: ${{ secrets.LIBRA_D1_API_TOKEN }}
          LIBRA_D1_DATABASE_ID: ${{ secrets.LIBRA_D1_DATABASE_ID }}
          LIBRA_STORAGE_ENDPOINT: ${{ secrets.LIBRA_STORAGE_ENDPOINT }}
          LIBRA_STORAGE_BUCKET: ${{ secrets.LIBRA_STORAGE_BUCKET }}
          LIBRA_STORAGE_ACCESS_KEY: ${{ secrets.LIBRA_STORAGE_ACCESS_KEY }}
          LIBRA_STORAGE_SECRET_KEY: ${{ secrets.LIBRA_STORAGE_SECRET_KEY }}
        run: |
          set -euo pipefail
          # `cargo test --all` minus the `command_test` binary, which
          # `compat-offline-command` shards instead. That one target compiles
          # 150 modules (~2950 tests) into a SINGLE process, and roughly a
          # third of them serialize on the process-global cwd lock that every
          # `ChangeDirGuard` takes — so it runs at about one core regardless of
          # the machine. It went past the 360-minute cap the first time the lib
          # suite stopped failing early and cargo actually reached it.
          #
          # Coverage is unchanged: lib, bins and doctests run here, so does
          # every other integration target, and `command_test` runs there.
          #
          # Targets whose `required-features` are not enabled are dropped, not
          # named: `cargo test --all` SKIPS those silently, but naming one with
          # `--test` is a hard error. The later steps in this job run each of
          # them explicitly with the feature it needs.
          mapfile -t TARGETS < <(
            cargo metadata --no-deps --format-version 1 \
              | jq -r '.packages[]
                       | (.features.default // []) as $default
                       | .targets[]
                       | select(.kind[] == "test")
                       | select(.name != "command_test")
                       | select(((((."required-features") // []) - $default) | length) == 0)
                       | .name' \
              | sort -u
          )
          if [ "${#TARGETS[@]}" -lt 100 ]; then
            echo "::error::enumerated only ${#TARGETS[@]} integration targets; refusing to run a truncated suite"
            exit 1
          fi
          echo "running lib + bins + doctests + ${#TARGETS[@]} integration targets"
          ARGS=()
          for target in "${TARGETS[@]}"; do
            ARGS+=(--test "$target")
          done
          cargo test --lib --bins "${ARGS[@]}"
          cargo test --doc

      # Phase 6 — Local TUI Automation Control scenario suite (docs/improvement/agent.md Part C).
      # Without `--features test-provider` + `LIBRA_ENABLE_TEST_PROVIDER=1`, the scenarios
      # in tests/code_ui_scenarios.rs and tests/harness_self_test.rs short-circuit; CI
      # would silently skip them. `--test-threads=1` because each scenario spawns a
      # `libra code` subprocess that contends for 0600 control-token files and ports.
      #
      # docs/improvement/test.md Wave 1 + Wave 3 also require the SSE harness and
      # lease matrix to run under the same gate, otherwise CI silently skips every
      # `lease_case!()` / `sse_case!()` registration.
      - name: Run TUI automation scenarios
        env:
          LIBRA_ENABLE_TEST_PROVIDER: "1"
          # These scenarios validate the loopback browser against the real
          # embedded Next.js app, so the build.rs fallback stub is not valid here.
          LIBRA_SKIP_WEB_BUILD: "0"
        run: |
          cargo test --features test-provider \
            --test code_ui_scenarios \
            --test harness_self_test \
            --test code_codex_default_tui_test \
            --test code_ui_remote_lease_matrix \
            --test code_ui_remote_sse_matrix \
            -- --test-threads=1

      # lore.md 1.7: the OTLP wire test needs the feature compiled in
      # (required-features excludes it from the default `cargo test --all`).
      - name: Run OTLP telemetry wire test (--features otlp)
        env:
          LIBRA_SKIP_WEB_BUILD: "1"
        run: |
          cargo test --features otlp --test otlp_telemetry -- --test-threads=1

      # lore.md 2.7: keyring-backend plumbing over the in-process mock store
      # (debug builds only honor the mock env; headless-safe).
      - name: Run keyring auth backend test (--features keyring)
        env:
          LIBRA_SKIP_WEB_BUILD: "1"
        run: |
          cargo test --features keyring --test auth_keyring_backend -- --test-threads=1

      # plan-20260714 §A.11: auto-upgrade integration targets. Trust-root and
      # endpoint injection is compile-time only (the `test-upgrade` feature),
      # so a release build cannot alter the trust root even with LIBRA_TEST=1.
      - name: Run auto-upgrade tests (--features test-upgrade)
        env:
          LIBRA_SKIP_WEB_BUILD: "1"
          LIBRA_TEST: "1"
        run: |
          cargo test --features test-upgrade \
            --test upgrade_auto_test \
            --test upgrade_publish_contract_test -- --test-threads=1

      - name: Upload TUI scenario artifacts on failure
        if: failure()
        uses: actions/upload-artifact@v4
        with:
          name: code-ui-scenarios
          path: target/code-ui-scenarios/**
          if-no-files-found: ignore
          retention-days: 7

  # The `command_test` half of what `cargo test --all` used to do in one job.
  # See the note on compat-offline-core's test step for why it is split out:
  # the binary is lock-bound rather than CPU-bound, so the only thing that
  # shortens it is running it in more than one PROCESS. Shards are separate
  # jobs, so each gets its own cwd lock and they scale with the runner pool.
  command-tests:
    name: compat-offline-command

    runs-on: [self-hosted]

    timeout-minutes: 350

    strategy:
      # One shard failing must not cancel the others: the point of the split is
      # to see the whole binary's result in one run.
      fail-fast: false
      matrix:
        shard: [0, 1, 2, 3]

    env:
      CARGO_TERM_COLOR: always
      RUSTUP_TOOLCHAIN: stable
      LIBRA_SKIP_WEB_BUILD: "1"
      CARGO_PROFILE_TEST_DEBUG: "0"
      CARGO_BUILD_JOBS: "1"
      # See compat-offline-core: 2 MiB test threads cannot hold an
      # unoptimized async state machine, and the process aborts if one
      # overflows. `command::switch_test` needs a little over 2 MiB.
      RUST_MIN_STACK: "16777216"
      # Kept in one place so the matrix above and the partition below cannot
      # disagree — a mismatch would silently drop or double-run tests.
      SHARD_COUNT: "4"

    steps:
      - name: Checkout repository
        uses: actions/checkout@v5
        with:
          submodules: recursive

      - name: Setup Node.js
        uses: actions/setup-node@v5
        with:
          node-version: "22"

      - name: Enable pnpm
        run: |
          corepack enable
          corepack prepare pnpm@11.10.0 --activate

      - name: Run command_test shard ${{ matrix.shard }}
        env:
          LIBRA_TEST_GITHUB_TOKEN: ${{ secrets.LIBRA_TEST_GITHUB_TOKEN }}
          LIBRA_TEST_GITHUB_NAMESPACE: ${{ secrets.LIBRA_TEST_GITHUB_NAMESPACE }}
          DEEPSEEK_API_KEY: ${{ secrets.DEEPSEEK_API_KEY }}
          LIBRA_D1_ACCOUNT_ID: ${{ secrets.LIBRA_D1_ACCOUNT_ID }}
          LIBRA_D1_API_TOKEN: ${{ secrets.LIBRA_D1_API_TOKEN }}
          LIBRA_D1_DATABASE_ID: ${{ secrets.LIBRA_D1_DATABASE_ID }}
          LIBRA_STORAGE_ENDPOINT: ${{ secrets.LIBRA_STORAGE_ENDPOINT }}
          LIBRA_STORAGE_BUCKET: ${{ secrets.LIBRA_STORAGE_BUCKET }}
          LIBRA_STORAGE_ACCESS_KEY: ${{ secrets.LIBRA_STORAGE_ACCESS_KEY }}
          LIBRA_STORAGE_SECRET_KEY: ${{ secrets.LIBRA_STORAGE_SECRET_KEY }}
        run: |
          set -euo pipefail
          # Partition by ENUMERATED TEST NAME, not by module prefix. The modulo
          # split is exhaustive and disjoint by construction, so a renamed or
          # newly added test cannot silently fall out of every shard the way a
          # hand-maintained filter list would eventually let one do.
          cargo test --test command_test --no-run
          mapfile -t ALL < <(
            cargo test --test command_test -- --list --format terse \
              | sed -n 's/: test$//p' | sort
          )
          total=${#ALL[@]}
          if [ "$total" -lt 2000 ]; then
            echo "::error::enumerated only $total command tests; refusing to run a truncated shard"
            exit 1
          fi
          MINE=()
          for index in "${!ALL[@]}"; do
            if [ "$(( index % SHARD_COUNT ))" -eq "${{ matrix.shard }}" ]; then
              MINE+=("${ALL[$index]}")
            fi
          done
          echo "shard ${{ matrix.shard }} of $SHARD_COUNT: ${#MINE[@]} of $total tests"
          cargo test --test command_test -- --exact "${MINE[@]}"

  network-remotes:
    name: compat-network-remotes
    runs-on: [self-hosted]

    env:
      CARGO_TERM_COLOR: always
      RUSTUP_TOOLCHAIN: stable
      LIBRA_SKIP_WEB_BUILD: "1"
      CARGO_PROFILE_TEST_DEBUG: "0"
      CARGO_BUILD_JOBS: "1"

    steps:
      - name: Checkout repository
        uses: actions/checkout@v5
        with:
          submodules: recursive

      - name: Setup Node.js
        uses: actions/setup-node@v5
        with:
          node-version: "22"

      - name: Enable pnpm
        run: |
          corepack enable
          corepack prepare pnpm@11.10.0 --activate

      # Network-only test layer (`test-network` feature gate). Tests requiring outbound
      # network but no secrets are surfaced through this job; tests requiring real
      # credentials live behind `test-live-ai` / `test-live-cloud` and run only in
      # the `compat-live-*` (workflow_dispatch) jobs, which are intentionally not
      # GitHub required-checks.
      - name: Run network-remote tests
        run: cargo test --features test-network --test network_remotes_test -- --test-threads=1