ci.yml

name: CI

on:
  pull_request:
    types: [opened, synchronize, reopened, ready_for_review, converted_to_draft, labeled]
  workflow_dispatch:
  schedule:
    # Daily full Linux/macOS regression at 11:17 Asia/Shanghai (03:17 UTC).
    # Normal PRs retain affected checks and Draft execution policy.
    - cron: "17 3 * * *"

concurrency:
  # Unrelated labels must neither cancel validation nor replace its check result.
  group: ci-${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}-${{ github.event_name == 'pull_request' && github.event.action == 'labeled' && github.event.label.name != 'full-ci' && github.run_id || 'validation' }}
  cancel-in-progress: ${{ github.event_name != 'pull_request' || github.event.action != 'labeled' || github.event.label.name == 'full-ci' }}

permissions:
  contents: read

env:
  CI: "true"

jobs:
  scope:
    name: Determine CI scope
    if: github.event_name != 'pull_request' || github.event.action != 'labeled' || github.event.label.name == 'full-ci'
    runs-on: ubuntu-latest
    timeout-minutes: 5
    outputs:
      execution-tier: ${{ steps.policy.outputs.execution-tier }}
      mode: ${{ steps.classify.outputs.mode }}
      packages: ${{ steps.classify.outputs.packages }}
      test-packages: ${{ steps.classify.outputs.test-packages }}
      typecheck-packages: ${{ steps.classify.outputs.typecheck-packages }}
      daemon: ${{ steps.classify.outputs.daemon }}
      web: ${{ steps.classify.outputs.web }}
    steps:
      - name: Check out repository without retained credentials
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        with:
          fetch-depth: 0
          persist-credentials: false

      - name: Set up Node.js
        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1
        with:
          node-version: 22.22.1

      - name: Select execution tier without narrowing the PR diff
        id: policy
        shell: bash
        run: |
          set -euo pipefail
          execution_tier="$(node scripts/ci/execution-policy.mjs --event-file "$GITHUB_EVENT_PATH")"
          printf 'execution-tier=%s\n' "$execution_tier" >> "$GITHUB_OUTPUT"
          printf 'CI execution tier: **%s**\n' "$execution_tier" >> "$GITHUB_STEP_SUMMARY"

      - name: Classify changed files
        id: classify
        shell: bash
        env:
          BASE_SHA: ${{ github.event.pull_request.base.sha }}
          FORCE_FULL: ${{ contains(github.event.pull_request.labels.*.name, 'full-ci') || (github.event.action == 'labeled' && github.event.label.name == 'full-ci') }}
        run: |
          set -euo pipefail
          if [[ "$GITHUB_EVENT_NAME" == "pull_request" ]]; then
            scope_json="$(node scripts/ci/classify-scope.mjs \
              --event="$GITHUB_EVENT_NAME" \
              --base="$BASE_SHA" \
              --head=HEAD \
              --force-full="$FORCE_FULL")"
          else
            scope_json="$(node scripts/ci/classify-scope.mjs --event="$GITHUB_EVENT_NAME")"
          fi
          echo "Scope: $scope_json"
          printf 'Changed-file scope: `%s`\n' "$scope_json" >> "$GITHUB_STEP_SUMMARY"
          SCOPE_JSON="$scope_json" node --input-type=module <<'NODE' >> "$GITHUB_OUTPUT"
          const scope = JSON.parse(process.env.SCOPE_JSON);
          const outputs = {
            mode: scope.mode,
            packages: JSON.stringify(scope.packages),
            "test-packages": JSON.stringify(scope.testPackages),
            "typecheck-packages": JSON.stringify(scope.typecheckPackages),
            daemon: String(scope.daemon),
            web: String(scope.web),
          };
          for (const [key, value] of Object.entries(outputs)) console.log(`${key}=${value}`);
          NODE

  common-fast:
    name: Common checks (fast lane)
    needs: scope
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - name: Check out repository without retained credentials
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        with:
          fetch-depth: 0
          persist-credentials: false

      - name: Set up Node.js
        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1
        with:
          node-version: 22.22.1

      - name: Check Markdown links
        run: node scripts/check-markdown-links.mjs

      - name: Check public repository safety
        run: node scripts/check-public-repo-safety.mjs

      - name: Check scanner boundaries, execution policy, classification, and platform CI gates
        run: node --test scripts/check-public-repo-safety.test.mjs scripts/ci/*.test.mjs scripts/native-execution-engines/verify-codex.test.mjs

      - name: Scan Git history for secrets
        if: needs.scope.outputs.execution-tier == 'complete' && needs.scope.outputs.mode != 'docs'
        run: >-
          docker run --rm
          -v "$GITHUB_WORKSPACE:/repo:ro"
          zricethezav/gitleaks@sha256:c00b6bd0aeb3071cbcb79009cb16a60dd9e0a7c60e2be9ab65d25e6bc8abbb7f
          git --no-banner --no-color --redact=100
          --log-opts=HEAD
          --config /repo/.gitleaks.toml
          --gitleaks-ignore-path /repo/.gitleaksignore
          --timeout 600
          /repo

      - name: Check pull request whitespace
        if: github.event_name == 'pull_request'
        run: git diff --check "${{ github.event.pull_request.base.sha }}...HEAD"

      - name: Check pushed or scheduled commit whitespace
        if: github.event_name != 'pull_request'
        run: git diff-tree --check --no-commit-id -r HEAD

  dependency-policy:
    name: Dependency policy and security checks
    needs: scope
    if: needs.scope.outputs.execution-tier == 'complete' && needs.scope.outputs.mode != 'docs'
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - name: Check out repository without retained credentials
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        with:
          fetch-depth: 0
          persist-credentials: false

      - name: Set up pnpm
        uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413
        with:
          version: 10.0.0
          run_install: false

      - name: Set up Node.js
        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1
        with:
          node-version: 22.22.1
          cache: pnpm

      - name: Install locked dependencies
        shell: bash
        run: |
          set -euo pipefail
          corepack enable
          corepack pnpm install --frozen-lockfile --prefer-offline

      - name: Check production dependency update policy
        run: node --test scripts/production-dependency-policy.test.mjs

      - name: Check dependency license policy
        run: corepack pnpm check:licenses

      - name: Check patched dependency security regressions
        run: corepack pnpm check:dependency-security

  build:
    name: Build selected package graph once
    needs: scope
    if: needs.scope.outputs.execution-tier == 'complete' && needs.scope.outputs.mode != 'docs'
    runs-on: ubuntu-latest
    timeout-minutes: 25
    env:
      SELECTED_PACKAGES: ${{ needs.scope.outputs.packages }}
    steps:
      - name: Check out repository without retained credentials
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        with:
          fetch-depth: 0
          persist-credentials: false

      - name: Set up pnpm
        uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413
        with:
          version: 10.0.0
          run_install: false

      - name: Set up Node.js
        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1
        with:
          node-version: 22.22.1
          cache: pnpm

      - name: Install locked dependencies
        shell: bash
        run: |
          set -euo pipefail
          corepack enable
          corepack pnpm install --frozen-lockfile --prefer-offline

      - name: Set up the pinned image codec toolchain
        run: rustup toolchain install 1.97.1 --profile minimal

      - name: Build selected graph without nested package builds
        env:
          RUSTUP_TOOLCHAIN: 1.97.1
        run: node scripts/ci/run-packages.mjs --task=build:ci --packages="$SELECTED_PACKAGES" --closure=true

      - name: Test bounded image codec contracts
        if: needs.scope.outputs.daemon == 'true'
        env:
          RUSTUP_TOOLCHAIN: 1.97.1
        run: corepack pnpm --filter @ling-stack/daemon test:image-sanitizer

      - name: Check real source daemon lifecycle and fresh-workspace doctor on Linux
        if: contains(needs.scope.outputs.packages, '"@ling-stack/cli"')
        working-directory: packages/cli
        run: node --test test/daemon-lifecycle.test.mjs

      - name: Install browser for production Web smoke
        if: needs.scope.outputs.web == 'true'
        working-directory: apps/web
        run: corepack pnpm exec playwright install --with-deps chromium --only-shell

      - name: Check production Web QA regressions on Linux
        if: needs.scope.outputs.web == 'true'
        working-directory: apps/web
        env:
          LING_PLAYWRIGHT_PREVIEW: "1"
          LING_PLAYWRIGHT_REUSE_SERVER: "0"
          LING_CAPTURE_UI2_EVIDENCE: "1"
        run: >-
          corepack pnpm exec playwright test
          e2e/ui2-shell-feedback-permission.spec.ts e2e/ui2-settings-skill-library.spec.ts
          e2e/ui2-teammate-management-skills.spec.ts e2e/ui2-council-members.spec.ts
          --grep 'without a configured model|full access confirmation|built-in skill timestamps|Chinese built-in skill|Chinese QA member'
          --reporter=line

      - name: Preserve Linux production Web smoke evidence
        if: always() && needs.scope.outputs.web == 'true'
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9
        with:
          name: ci-linux-source-web-smoke
          if-no-files-found: error
          retention-days: 7
          path: apps/web/test-results/**

      - name: Upload reusable build outputs
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9
        with:
          name: ci-dist
          if-no-files-found: error
          retention-days: 1
          path: |
            packages/*/dist/**
            apps/web/dist/**
            apps/chrome-extension/dist/**

  typecheck:
    name: Typecheck selected packages
    needs: [scope, build]
    if: ${{ !cancelled() && needs.scope.outputs.execution-tier == 'complete' && needs.scope.outputs.mode != 'docs' && needs.build.result == 'success' }}
    runs-on: ubuntu-latest
    timeout-minutes: 20
    env:
      SELECTED_PACKAGES: ${{ needs.scope.outputs.typecheck-packages }}
    steps:
      - name: Check out repository without retained credentials
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        with:
          fetch-depth: 1
          persist-credentials: false

      - name: Set up pnpm
        uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413
        with:
          version: 10.0.0
          run_install: false

      - name: Set up Node.js
        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1
        with:
          node-version: 22.22.1
          cache: pnpm

      - name: Install locked dependencies
        shell: bash
        run: |
          set -euo pipefail
          corepack enable
          corepack pnpm install --frozen-lockfile --prefer-offline

      - name: Download reusable build outputs
        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333
        with:
          name: ci-dist
          path: .

      - name: Typecheck selected packages without rebuilding dependencies
        run: node scripts/ci/run-packages.mjs --task=typecheck:ci --packages="$SELECTED_PACKAGES"

  unit-tests:
    name: Unit tests and Web checks
    needs: [scope, build]
    if: ${{ !cancelled() && needs.scope.outputs.execution-tier == 'complete' && needs.scope.outputs.mode != 'docs' && needs.build.result == 'success' }}
    runs-on: ubuntu-latest
    timeout-minutes: 25
    env:
      SELECTED_PACKAGES: ${{ needs.scope.outputs.test-packages }}
      WEB_SELECTED: ${{ needs.scope.outputs.web }}
    steps:
      - name: Check out repository without retained credentials
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        with:
          fetch-depth: 1
          persist-credentials: false

      - name: Set up pnpm
        uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413
        with:
          version: 10.0.0
          run_install: false

      - name: Set up Node.js
        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1
        with:
          node-version: 22.22.1
          cache: pnpm

      - name: Install locked dependencies
        shell: bash
        run: |
          set -euo pipefail
          corepack enable
          corepack pnpm install --frozen-lockfile --prefer-offline

      - name: Download reusable build outputs
        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333
        with:
          name: ci-dist
          path: .

      - name: Run selected unit tests without rebuilding dependencies
        run: node scripts/ci/run-packages.mjs --task=test:ci --packages="$SELECTED_PACKAGES" --exclude='["@ling-stack/daemon"]'

      - name: Check Web architecture and UI rules
        if: env.WEB_SELECTED == 'true'
        run: corepack pnpm --filter @ling-stack/web lint

      - name: Check translations
        if: env.WEB_SELECTED == 'true'
        run: corepack pnpm --filter @ling-stack/web check:i18n

  daemon-tests:
    name: Daemon tests (shard ${{ matrix.shard }})
    needs: [scope, build]
    if: ${{ !cancelled() && needs.scope.outputs.execution-tier == 'complete' && needs.scope.outputs.daemon == 'true' && needs.build.result == 'success' }}
    # Full discovery is unchanged: original Darwin-only positive cases must
    # execute on the real Host, not skip or weaken the production platform gate.
    runs-on: macos-26
    # Run 39274142315 reached 1,584 passing tests in shard 1 before the 25m
    # job limit cancelled it while tests were still progressing. Include setup
    # and room for the remaining files without changing discovery or isolation.
    timeout-minutes: 40
    strategy:
      fail-fast: false
      matrix:
        shard: [0, 1, 2, 3]
    steps:
      - name: Check out repository without retained credentials
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        with:
          fetch-depth: 1
          persist-credentials: false

      - name: Set up pnpm
        uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413
        with:
          version: 10.0.0
          run_install: false

      - name: Set up Node.js
        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1
        with:
          node-version: 22.22.1
          cache: pnpm

      - name: Install locked dependencies
        shell: bash
        run: |
          set -euo pipefail
          corepack enable
          corepack pnpm install --frozen-lockfile --prefer-offline

      - name: Download reusable build outputs
        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333
        with:
          name: ci-dist
          path: .

      # ci-dist comes from Ubuntu; native codecs must be rebuilt on this macOS host.
      - name: Build the host image codec
        env:
          RUSTUP_TOOLCHAIN: 1.97.1
        run: |
          rustup toolchain install 1.97.1 --profile minimal
          corepack pnpm --filter @ling-stack/daemon build:image-sanitizer

      - name: Run isolated daemon shard
        run: node scripts/ci/daemon-test-shard.mjs --shard=${{ matrix.shard }} --shard-count=4

      - name: Collect fixed OS bootstrap source for review only
        if: always()
        run: node scripts/ci/macos-bootstrap-diagnostic.mjs > "${{ runner.temp }}/macos-bootstrap-diagnostic.json"

      - name: Preserve bootstrap observation without granting profile support
        if: always()
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9
        with:
          name: ci-macos-bootstrap-shard-${{ matrix.shard }}
          if-no-files-found: warn
          retention-days: 1
          path: ${{ runner.temp }}/macos-bootstrap-diagnostic.json

  daemon-linux-contracts:
    name: Linux restricted-command fail-closed contracts
    needs: [scope, build]
    if: ${{ !cancelled() && needs.scope.outputs.execution-tier == 'complete' && needs.scope.outputs.daemon == 'true' && needs.build.result == 'success' }}
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - name: Check out repository without retained credentials
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        with:
          fetch-depth: 1
          persist-credentials: false

      - name: Set up pnpm
        uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413
        with:
          version: 10.0.0
          run_install: false

      - name: Set up Node.js
        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1
        with:
          node-version: 22.22.1
          cache: pnpm

      - name: Install locked dependencies
        shell: bash
        run: |
          set -euo pipefail
          corepack enable
          corepack pnpm install --frozen-lockfile --prefer-offline

      - name: Download reusable build outputs
        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333
        with:
          name: ci-dist
          path: .

      - name: Require real Linux rejection without effects or raw Host fallback
        working-directory: packages/daemon
        run: node --test --test-concurrency=1 test/restricted-command-linux.contract.mjs test/restricted-command-dispatch.test.mjs

  restricted-command-macos:
    name: Real macOS helper and Seatbelt smoke
    needs: [scope, build]
    if: ${{ !cancelled() && needs.scope.outputs.execution-tier == 'complete' && needs.scope.outputs.daemon == 'true' && needs.build.result == 'success' }}
    # actions/runner-images documents macos-26 as arm64, not the Intel/large image.
    # This is standalone helper evidence, not reviewed packaged issuer certification.
    runs-on: macos-26
    timeout-minutes: 25
    steps:
      - name: Check out repository without retained credentials
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        with:
          fetch-depth: 1
          persist-credentials: false

      - name: Set up pnpm
        uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413
        with:
          version: 10.0.0
          run_install: false

      - name: Set up Node.js
        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1
        with:
          node-version: 22.22.1
          cache: pnpm

      - name: Install locked dependencies
        shell: bash
        run: |
          set -euo pipefail
          corepack enable
          corepack pnpm install --frozen-lockfile --prefer-offline

      - name: Download reusable build outputs
        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333
        with:
          name: ci-dist
          path: .

      - name: Require the actual arm64 macOS Host and fixed Seatbelt backend
        shell: bash
        run: |
          set -euo pipefail
          node --input-type=module <<'NODE'
          import assert from 'node:assert/strict';
          import { execFileSync } from 'node:child_process';
          import { release } from 'node:os';
          import { readMacosSandboxBackendIdentity } from './packages/daemon/dist/runtime/sandbox/macos-sandbox-backend.js';
          assert.equal(process.platform, 'darwin');
          assert.equal(process.arch, 'arm64');
          const osVersion = execFileSync('/usr/bin/sw_vers', ['-productVersion'], { encoding: 'utf8' }).trim();
          assert.ok(Number.parseInt(osVersion, 10) >= 26, 'This CI lane requires macOS 26 or newer.');
          const backend = readMacosSandboxBackendIdentity();
          assert.equal(backend.kind, 'macos_seatbelt');
          console.log(JSON.stringify({ platform: process.platform, arch: process.arch, osVersion, kernel: release(), backend: backend.kind }));
          NODE

      - name: Prepare the pinned native build inputs
        shell: bash
        run: |
          set -euo pipefail
          rustup toolchain install 1.97.1 --profile minimal --component rustfmt
          rustup target add --toolchain 1.97.1 aarch64-apple-darwin
          rustup run 1.97.1 cargo fetch --locked --manifest-path native/sandbox/Cargo.toml

      - name: Build a fresh helper and run real Host and channel isolation smoke
        shell: bash
        run: |
          set -euo pipefail
          # build.mjs exclusively creates --out; never pre-create or reuse it.
          ling_native_output="$RUNNER_TEMP/ling-native-evidence"
          node native/sandbox/scripts/build.mjs --target aarch64-apple-darwin --out "$ling_native_output"
          node native/sandbox/tests/host-input-read-smoke.mjs "$ling_native_output/ling-sandbox-runner"
          node native/sandbox/tests/restricted-command-dispatch-smoke.mjs "$ling_native_output/ling-sandbox-runner"
          node packages/daemon/test/restricted-command-launch-unknown.contract.mjs "$ling_native_output/ling-sandbox-runner"
          node native/sandbox/tests/channel-command-smoke.mjs "$ling_native_output/ling-sandbox-runner"

      - name: Preserve native build diagnostics without certifying the packaged issuer
        if: always()
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9
        with:
          name: ci-restricted-command-native-evidence
          if-no-files-found: warn
          retention-days: 1
          path: |
            ${{ runner.temp }}/ling-native-evidence/manifest.json
            ${{ runner.temp }}/ling-native-evidence/logs/**

      - name: Collect fixed OS bootstrap source for review only
        if: always()
        run: node scripts/ci/macos-bootstrap-diagnostic.mjs > "${{ runner.temp }}/macos-bootstrap-diagnostic.json"

      - name: Preserve bootstrap observation without granting profile support
        if: always()
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9
        with:
          name: ci-macos-bootstrap-native
          if-no-files-found: warn
          retention-days: 1
          path: ${{ runner.temp }}/macos-bootstrap-diagnostic.json

  quality:
    name: ${{ github.event_name == 'pull_request' && github.event.action == 'labeled' && github.event.label.name != 'full-ci' && 'CI label event (no validation)' || 'Typecheck, unit tests, and Web build' }}
    needs: [scope, common-fast, dependency-policy, build, typecheck, unit-tests, daemon-tests, daemon-linux-contracts, restricted-command-macos]
    if: always()
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
      - name: Check out quality policy without retained credentials
        if: github.event_name != 'pull_request' || github.event.action != 'labeled' || github.event.label.name == 'full-ci'
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        with:
          fetch-depth: 1
          persist-credentials: false

      - name: Set up Node.js
        if: github.event_name != 'pull_request' || github.event.action != 'labeled' || github.event.label.name == 'full-ci'
        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1
        with:
          node-version: 22.22.1

      - name: Require every applicable CI lane to pass
        env:
          IGNORED_LABEL_EVENT: ${{ github.event_name == 'pull_request' && github.event.action == 'labeled' && github.event.label.name != 'full-ci' }}
          EXECUTION_TIER: ${{ needs.scope.outputs.execution-tier }}
          SCOPE_MODE: ${{ needs.scope.outputs.mode }}
          SCOPE_RESULT: ${{ needs.scope.result }}
          COMMON_RESULT: ${{ needs.common-fast.result }}
          DEPENDENCY_RESULT: ${{ needs.dependency-policy.result }}
          BUILD_RESULT: ${{ needs.build.result }}
          TYPECHECK_RESULT: ${{ needs.typecheck.result }}
          UNIT_RESULT: ${{ needs.unit-tests.result }}
          DAEMON_RESULT: ${{ needs.daemon-tests.result }}
          LINUX_CONTRACT_RESULT: ${{ needs.daemon-linux-contracts.result }}
          MACOS_NATIVE_RESULT: ${{ needs.restricted-command-macos.result }}
          DAEMON_SELECTED: ${{ needs.scope.outputs.daemon }}
        shell: bash
        run: |
          set -euo pipefail
          if [[ "${IGNORED_LABEL_EVENT:-false}" == "true" ]]; then
            echo "Unrelated label event; no validation check result is replaced."
            exit 0
          fi
          node scripts/ci/execution-policy.mjs --check-quality