ci.yml

name: CI

on:
  push:
    branches: [master]
  pull_request:

jobs:
  check:
    name: ${{ matrix.os }} / node ${{ matrix.node }}
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        # Windows is a first-class target: the netsh/PowerShell/dumpcap paths
        # only ever run there, and several defects were Windows-only.
        os: [ubuntu-latest, windows-latest]
        node: [20, 22]
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: ${{ matrix.node }}
          cache: npm
      - run: npm ci
      - run: npm run lint
      - run: npm run build
      - run: npm test

  package:
    name: packaging smoke test
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: 20
          cache: npm
      - run: npm ci
      - run: npm run build

      # `npm pack` (below) does not apply the same package.json normalization
      # `npm publish` does. That gap let a real bug through: npm 11 silently
      # *drops* a bin entry with a leading "./" instead of just stripping the
      # prefix (npm 10 did that; only a warning). `npm publish --dry-run`
      # applies the real normalization without uploading, so any correction
      # notice here means the source file isn't canonical and would publish
      # something different from what's committed.
      - name: Reject any publish-time auto-correction of package.json
        run: |
          out="$(npm publish --workspace etherfind --dry-run 2>&1)"
          echo "$out"
          if echo "$out" | grep -q "npm auto-corrected"; then
            echo "::error::npm would rewrite packages/cli/package.json at publish time — fix the source file, don't rely on npm's normalization."
            exit 1
          fi

      # Pack the CLI and install the tarball into a throwaway project. The
      # package is fully self-contained (core/ink/react are bundled), so a
      # missing "files" entry or a leaked runtime dependency fails here rather
      # than after `npm publish`.
      - name: Pack CLI
        run: |
          mkdir -p /tmp/tarballs
          npm pack --workspace etherfind --pack-destination /tmp/tarballs
          ls -l /tmp/tarballs

      - name: Install from tarball and run the CLI
        run: |
          mkdir -p /tmp/smoke && cd /tmp/smoke
          npm init -y > /dev/null
          npm install /tmp/tarballs/etherfind-*.tgz --no-audit --no-fund
          ./node_modules/.bin/etherfind --version
          ./node_modules/.bin/etherfind --help
          node -e "const p=require('/tmp/smoke/node_modules/etherfind/package.json'); if (Object.keys(p.dependencies||{}).length) { console.error('published package must have no runtime dependencies'); process.exit(1); }"

      # The simulated backend exercises the full state machine end to end
      # without any capture privileges or real hardware.
      - name: Simulated end-to-end run
        run: |
          cd /tmp/smoke
          ./node_modules/.bin/etherfind --simulate --json | tee run.ndjson
          grep -q '"event":"final"' run.ndjson
          grep -q '"ok":true' run.ndjson

      # --version, --help and --simulate --json above never load ink, so they
      # missed a real bug: the published 0.1.0 crashed with "Dynamic require
      # of assert is not supported" the moment a real terminal reached
      # `await import("ink")`. This forces that import path against the
      # tarball's own dist/cli.js.
      - name: Check the interactive TUI import path
        run: node packages/cli/scripts/verify-tui-import.mjs /tmp/smoke/node_modules/etherfind/dist/cli.js