ci.yml

name: CI

on:
  pull_request:
    branches: [main]
  push:
    branches: [main]
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: ci-${{ github.ref }}
  cancel-in-progress: true

jobs:
  autofix:
    name: Autofix (lint & format)
    if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork == false
    runs-on: withakay-selfhosted-arm
    timeout-minutes: 10
    permissions:
      contents: write
    outputs:
      pushed: ${{ steps.push_fixes.outputs.pushed }}
    steps:
      - name: Generate GitHub App token
        id: app_token
        uses: actions/create-github-app-token@v2
        with:
          app-id: ${{ secrets.ITO_CI_APP_ID }}
          private-key: ${{ secrets.ITO_CI_APP_PRIVATE_KEY }}

      - name: Checkout PR branch
        uses: actions/checkout@v4
        with:
          ref: ${{ github.head_ref }}
          # Use App token so pushes trigger new workflow runs
          token: ${{ steps.app_token.outputs.token }}
          fetch-depth: 2

      # Skip if the last commit was already an autofix commit (prevent loops)
      - name: Check for autofix loop
        id: loop_check
        run: |
          LAST_AUTHOR="$(git log -1 --format='%an')"
          if [[ "$LAST_AUTHOR" == "github-actions[bot]" ]]; then
            echo "skip=true" >> "$GITHUB_OUTPUT"
            echo "Last commit was from autofix bot — skipping to prevent loop."
          else
            echo "skip=false" >> "$GITHUB_OUTPUT"
          fi

      - name: Install build-essential
        if: steps.loop_check.outputs.skip != 'true'
        uses: ./.github/actions/cache-apt-pkgs
        with:
          packages: build-essential

      - name: Setup toolchain (mise)
        if: steps.loop_check.outputs.skip != 'true'
        uses: jdx/mise-action@v3

      - name: Install Rust components (rustfmt)
        if: steps.loop_check.outputs.skip != 'true'
        run: |
          set -eu
          mise install
          mise trust
          TOOLCHAIN="$(rustup show active-toolchain | awk '{print $1}')"
          rustup component add --toolchain "$TOOLCHAIN" rustfmt

      # --- File hygiene fixes (matching .editorconfig & .pre-commit-config.yaml) ---

      - name: Fix line endings (CRLF -> LF)
        if: steps.loop_check.outputs.skip != 'true'
        run: |
          # Convert CRLF to LF for all text files, respecting .gitattributes
          # (git handles .bat/.cmd/.ps1 CRLF via .gitattributes at checkout/commit)
          git ls-files -z | xargs -0 -P4 -I{} \
            sh -c 'file --mime "{}" | grep -q "text/" && sed -i "s/\r$//" "{}" || true'

      - name: Fix trailing whitespace
        if: steps.loop_check.outputs.skip != 'true'
        run: |
          # Trim trailing whitespace from all tracked text files EXCEPT:
          #   - *.md files (editorconfig: trailing whitespace = line breaks)
          #   - tests/** (editorconfig: snapshot files may need trailing WS)
          # But DO trim tests/**/*.rs and tests/**/*.js (editorconfig overrides)
          git ls-files -z | while IFS= read -r -d '' f; do
            # Skip binary files
            file --mime "$f" | grep -q "text/" || continue

            # Skip markdown files
            case "$f" in *.md) continue ;; esac

            # Skip tests/** unless it's a .rs or .js file
            case "$f" in
              tests/*)
                case "$f" in *.rs|*.js) ;; *) continue ;; esac
                ;;
            esac

            # Trim trailing whitespace
            sed -i 's/[[:space:]]*$//' "$f"
          done

      - name: Fix missing final newline
        if: steps.loop_check.outputs.skip != 'true'
        run: |
          # Ensure every tracked text file ends with a newline
          git ls-files -z | while IFS= read -r -d '' f; do
            [ -f "$f" ] || continue
            file --mime "$f" | grep -q "text/" || continue
            # Add newline if file is non-empty and missing one
            if [ -s "$f" ] && [ "$(tail -c1 "$f" | wc -l)" -eq 0 ]; then
              echo "" >> "$f"
            fi
          done

      - name: Format JSON files
        if: steps.loop_check.outputs.skip != 'true'
        run: |
          # Pretty-format JSON files (2-space indent, no key sorting)
          # Matches: pretty-format-json --autofix --indent=2 --no-sort-keys
          git ls-files -z '*.json' ':!tests/**' | while IFS= read -r -d '' f; do
            [ -f "$f" ] || continue
            python3 -c "
          import json, sys
          with open('$f', 'r') as fh:
              data = json.load(fh)
          with open('$f', 'w') as fh:
              json.dump(data, fh, indent=2, sort_keys=False)
              fh.write('\n')
          " 2>/dev/null || true
          done

      # --- Rust formatting ---

      - name: Rust fmt (autofix)
        if: steps.loop_check.outputs.skip != 'true'
        run: cargo fmt --all

      # --- Generated artifacts ---

      - name: Update config schema artifact
        if: steps.loop_check.outputs.skip != 'true'
        run: |
          # Keep schemas/ito-config.schema.json in sync with the code.
          # If this changes the working tree, the commit step below will push it.
          make config-schema

      # --- Commit and push if anything changed ---

      - name: Commit and push fixes
        id: push_fixes
        if: steps.loop_check.outputs.skip != 'true'
        env:
          GIT_AUTHOR_NAME: "github-actions[bot]"
          GIT_AUTHOR_EMAIL: "41898282+github-actions[bot]@users.noreply.github.com"
          GIT_COMMITTER_NAME: "github-actions[bot]"
          GIT_COMMITTER_EMAIL: "41898282+github-actions[bot]@users.noreply.github.com"
        run: |
          if git diff --quiet && git diff --staged --quiet; then
            echo "No changes to commit — tree is clean."
            echo "pushed=false" >> "$GITHUB_OUTPUT"
            exit 0
          fi

          git add -A
          git commit -m "ci: autofix lint, formatting, and generated artifacts

          Automated fixes applied by CI:
          - Line endings (CRLF -> LF)
          - Trailing whitespace
          - Final newlines
          - JSON formatting
          - Rust formatting (cargo fmt)
          - Regenerated config schema (schemas/ito-config.schema.json)"

          git push
          echo "pushed=true" >> "$GITHUB_OUTPUT"
          echo "::notice::Autofix pushed changes — a new CI run will validate the fixed code."

  test:
    name: Shipping defaults — test
    needs: [autofix]
    # Run when autofix is skipped (push to main, workflow_dispatch) or succeeded
    # without pushing. If autofix pushed, a new CI run handles checks instead.
    if: |
      always()
      && (needs.autofix.result == 'success' || needs.autofix.result == 'skipped')
      && needs.autofix.outputs.pushed != 'true'
    #runs-on: withakay-selfhosted
    runs-on: withakay-selfhosted-arm
    timeout-minutes: 20

    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Install build-essential
        uses: ./.github/actions/cache-apt-pkgs
        with:
          packages: build-essential

      - name: Setup toolchain (mise)
        uses: jdx/mise-action@v3

      - name: Cache Rust dependencies
        uses: Swatinem/rust-cache@v2
        with:
          workspaces: . -> target
          shared-key: ci-test-linux
          save-if: ${{ github.ref == 'refs/heads/main' }}

      - name: Cache Rust dependencies
        uses: Swatinem/rust-cache@v2
        with:
          workspaces: . -> target

      - name: Print environment diagnostics
        run: |
          mise install
          mise trust
          rustc -V
          cargo -V

      - name: Test shipping CLI defaults
        env:
          CARGO_REGISTRIES_CRATES_IO_PROTOCOL: sparse
        run: make test

      - name: Assert standard dependency boundary
        run: make release-feature-check

      - name: Verify default iteration and migration surfaces
        run: |
          cargo test -p ito-cli --test feature_unavailable
          cargo test -p ito-cli --test migrate_to_main_instruction

  experimental_test:
    name: Experimental all-features — test
    needs: [autofix]
    if: |
      always()
      && (needs.autofix.result == 'success' || needs.autofix.result == 'skipped')
      && needs.autofix.outputs.pushed != 'true'
    runs-on: withakay-selfhosted-arm
    timeout-minutes: 25

    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Install build-essential
        uses: ./.github/actions/cache-apt-pkgs
        with:
          packages: build-essential

      - name: Setup toolchain (mise)
        uses: jdx/mise-action@v3

      - name: Cache Rust dependencies
        uses: Swatinem/rust-cache@v2
        with:
          workspaces: . -> target
          shared-key: ci-test-experimental
          save-if: ${{ github.ref == 'refs/heads/main' }}

      - name: Print environment diagnostics
        run: |
          mise install
          mise trust
          rustc -V
          cargo -V

      - name: Test backend and coordination implementations
        env:
          CARGO_REGISTRIES_CRATES_IO_PROTOCOL: sparse
        run: make test-experimental

  lint:
    name: Shipping defaults — lint and docs
    needs: [autofix]
    if: |
      always()
      && (needs.autofix.result == 'success' || needs.autofix.result == 'skipped')
      && needs.autofix.outputs.pushed != 'true'
    # runs-on: withakay-selfhosted
    runs-on: withakay-selfhosted-arm
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Install build-essential
        uses: ./.github/actions/cache-apt-pkgs
        with:
          packages: build-essential

      - name: Setup toolchain (mise)
        uses: jdx/mise-action@v3

      - name: Install Rust components (rustfmt, clippy, rust-docs)
        run: |
          set -eu
          mise install
          mise trust
          TOOLCHAIN="$(rustup show active-toolchain | awk '{print $1}')"
          rustup component add --toolchain "$TOOLCHAIN" rustfmt clippy rust-docs

      - name: Cache Rust dependencies
        uses: Swatinem/rust-cache@v2
        with:
          workspaces: . -> target
          shared-key: ci-lint
          save-if: ${{ github.ref == 'refs/heads/main' }}

      - name: Cache Rust dependencies
        uses: Swatinem/rust-cache@v2
        with:
          workspaces: . -> target

      - name: Verify config schema artifact is current
        run: |
          make config-schema-check

      - name: Lint shipping CLI defaults
        run: make lint

      - name: Rust docs (warnings denied)
        run: make docs

  experimental_lint:
    name: Experimental all-features — lint and docs
    needs: [autofix]
    if: |
      always()
      && (needs.autofix.result == 'success' || needs.autofix.result == 'skipped')
      && needs.autofix.outputs.pushed != 'true'
    runs-on: withakay-selfhosted-arm
    timeout-minutes: 15

    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Install build-essential
        uses: ./.github/actions/cache-apt-pkgs
        with:
          packages: build-essential

      - name: Setup toolchain (mise)
        uses: jdx/mise-action@v3

      - name: Install Rust components (rustfmt, clippy, rust-docs)
        run: |
          set -eu
          mise install
          mise trust
          TOOLCHAIN="$(rustup show active-toolchain | awk '{print $1}')"
          rustup component add --toolchain "$TOOLCHAIN" rustfmt clippy rust-docs

      - name: Cache Rust dependencies
        uses: Swatinem/rust-cache@v2
        with:
          workspaces: . -> target
          shared-key: ci-lint-experimental
          save-if: ${{ github.ref == 'refs/heads/main' }}

      - name: Lint experimental all-features workspace
        run: make lint-experimental

      - name: Build experimental all-features docs
        run: make docs-experimental

  feature_matrix:
    name: Independent feature matrix
    needs: [autofix]
    if: |
      always()
      && (needs.autofix.result == 'success' || needs.autofix.result == 'skipped')
      && needs.autofix.outputs.pushed != 'true'
    runs-on: withakay-selfhosted-arm
    timeout-minutes: 45

    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Install build-essential
        uses: ./.github/actions/cache-apt-pkgs
        with:
          packages: build-essential

      - name: Setup toolchain (mise)
        uses: jdx/mise-action@v3

      - name: Install Rust components (clippy)
        run: |
          set -eu
          mise install
          mise trust
          TOOLCHAIN="$(rustup show active-toolchain | awk '{print $1}')"
          rustup component add --toolchain "$TOOLCHAIN" clippy

      - name: Cache Rust dependencies
        uses: Swatinem/rust-cache@v2
        with:
          workspaces: . -> target
          shared-key: ci-feature-matrix
          save-if: ${{ github.ref == 'refs/heads/main' }}

      - name: Check, test, and lint all feature combinations
        run: make feature-matrix-check

  arch_guardrails:
    name: Architecture Guardrails
    needs: [autofix]
    if: |
      always()
      && (needs.autofix.result == 'success' || needs.autofix.result == 'skipped')
      && needs.autofix.outputs.pushed != 'true'
    # runs-on: withakay-selfhosted
    runs-on: withakay-selfhosted-arm
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Install build-essential
        uses: ./.github/actions/cache-apt-pkgs
        with:
          packages: build-essential

      - name: Setup toolchain (mise)
        uses: jdx/mise-action@v3

      - name: Cache Rust dependencies
        uses: Swatinem/rust-cache@v2
        with:
          workspaces: . -> target
          shared-key: ci-arch-guardrails
          save-if: ${{ github.ref == 'refs/heads/main' }}

      - name: Cache Rust dependencies
        uses: Swatinem/rust-cache@v2
        with:
          workspaces: . -> target

      - name: Print environment diagnostics
        run: |
          mise install
          mise trust
          rustc -V
          cargo -V

      - name: Run architecture guardrails
        run: make arch-guardrails

      - name: Install cargo-deny
        uses: taiki-e/install-action@cargo-deny

      - name: Run cargo-deny (license/advisory checks)
        run: cargo deny check

  docs:
    name: Shipping defaults — docs site
    runs-on: withakay-selfhosted-arm
    timeout-minutes: 15
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Install build-essential
        uses: ./.github/actions/cache-apt-pkgs
        with:
          packages: build-essential

      - name: Setup toolchain (mise)
        uses: jdx/mise-action@v3

      - name: Install Rust components (rust-docs)
        run: |
          set -eu
          mise install
          mise trust
          TOOLCHAIN="$(rustup show active-toolchain | awk '{print $1}')"
          rustup component add --toolchain "$TOOLCHAIN" rust-docs

      - name: Cache Rust dependencies
        uses: Swatinem/rust-cache@v2
        with:
          workspaces: . -> target
          shared-key: ci-docs
          save-if: ${{ github.ref == 'refs/heads/main' }}

      - name: Build docs site
        run: |
          make docs-site-check

  powershell:
    name: PowerShell Scripts (parse)
    needs: [autofix]
    if: |
      always()
      && (needs.autofix.result == 'success' || needs.autofix.result == 'skipped')
      && needs.autofix.outputs.pushed != 'true'
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Parse scripts/install.ps1
        run: |
          pwsh -NoProfile -Command '$t=@();$e=@();[System.Management.Automation.Language.Parser]::ParseFile("scripts/install.ps1",[ref]$t,[ref]$e) | Out-Null; if ($e.Count -gt 0) { $e | Format-List -Property Message,Extent | Out-String; exit 1 } else { "OK: scripts/install.ps1 parsed cleanly" }'

  required-checks-pr:
    name: All checks passed
    # runs-on: ubuntu-latest
    runs-on: withakay-selfhosted-arm
    needs: [autofix, test, experimental_test, lint, experimental_lint, feature_matrix, arch_guardrails, docs, powershell]
    if: always() && github.event_name == 'pull_request'
    steps:
      - name: Verify all checks passed
        run: |
          # If autofix pushed, downstream jobs were intentionally skipped.
          # A new CI run will validate the fixed code — this run is superseded.
          if [[ "${{ needs.autofix.outputs.pushed }}" == "true" ]]; then
            echo "Autofix pushed changes — deferring checks to the new CI run."
            exit 0
          fi

          if [[ "${{ needs.test.result }}" != "success" ]]; then
            echo "Shipping-default test job failed"
            exit 1
          fi
          if [[ "${{ needs.experimental_test.result }}" != "success" ]]; then
            echo "Experimental all-features test job failed"
            exit 1
          fi
          if [[ "${{ needs.lint.result }}" != "success" ]]; then
            echo "Shipping-default lint job failed"
            exit 1
          fi
          if [[ "${{ needs.experimental_lint.result }}" != "success" ]]; then
            echo "Experimental all-features lint job failed"
            exit 1
          fi
          if [[ "${{ needs.feature_matrix.result }}" != "success" ]]; then
            echo "Independent feature matrix job failed"
            exit 1
          fi
          if [[ "${{ needs.arch_guardrails.result }}" != "success" ]]; then
            echo "Architecture guardrails job failed"
            exit 1
          fi
          if [[ "${{ needs.docs.result }}" != "success" ]]; then
            echo "Docs job failed"
            exit 1
          fi
          if [[ "${{ needs.powershell.result }}" != "success" ]]; then
            echo "PowerShell job failed"
            exit 1
          fi
          echo "All required checks passed!"

  required-checks-main:
    name: All checks passed
    # runs-on: withakay-selfhosted
    runs-on: withakay-selfhosted-arm
    needs: [test, experimental_test, lint, experimental_lint, feature_matrix, arch_guardrails, docs, powershell]
    if: always() && github.event_name != 'pull_request'
    steps:
      - name: Verify all checks passed
        run: |
          if [[ "${{ needs.test.result }}" != "success" ]]; then
            echo "Shipping-default test job failed"
            exit 1
          fi
          if [[ "${{ needs.experimental_test.result }}" != "success" ]]; then
            echo "Experimental all-features test job failed"
            exit 1
          fi
          if [[ "${{ needs.lint.result }}" != "success" ]]; then
            echo "Shipping-default lint job failed"
            exit 1
          fi
          if [[ "${{ needs.experimental_lint.result }}" != "success" ]]; then
            echo "Experimental all-features lint job failed"
            exit 1
          fi
          if [[ "${{ needs.feature_matrix.result }}" != "success" ]]; then
            echo "Independent feature matrix job failed"
            exit 1
          fi
          if [[ "${{ needs.arch_guardrails.result }}" != "success" ]]; then
            echo "Architecture guardrails job failed"
            exit 1
          fi
          if [[ "${{ needs.docs.result }}" != "success" ]]; then
            echo "Docs job failed"
            exit 1
          fi
          if [[ "${{ needs.powershell.result }}" != "success" ]]; then
            echo "PowerShell job failed"
            exit 1
          fi
          echo "All required checks passed!"