ci.yml

name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

# Cancel in-progress runs when a new commit is pushed to the same PR
concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true

permissions:
  contents: read
  pull-requests: read

# Optional repo/org variables for runner migration:
# - RUNNER_DEFAULT_LABEL=blacksmith-2vcpu-ubuntu-2404
# - RUNNER_LARGE_LABEL=blacksmith-8vcpu-ubuntu-2404
jobs:
  changes:
    runs-on: ${{ vars.RUNNER_DEFAULT_LABEL || 'ubuntu-latest' }}
    timeout-minutes: 5
    outputs:
      kilocode_backend: ${{ steps.filter.outputs.kilocode_backend }}
      cloud_agent_next: ${{ steps.filter.outputs.cloud_agent_next }}
      workspace_matrix: ${{ steps.workspaces.outputs.matrix }}
    steps:
      - uses: useblacksmith/checkout@41cdeedae8edb2e684ba22896a5fd2a3cb85db6b # v1
        with:
          fetch-depth: 0

      - name: Setup pnpm
        uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v4.4.0

      - name: Setup Node
        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
        with:
          node-version-file: '.nvmrc'

      - name: Detect changes
        id: filter
        uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1
        with:
          filters: |
            kilocode_backend:
              - 'apps/web/src/**'
              - 'apps/web/.env'
              - 'apps/web/.env.test'
              - 'apps/web/.env.development.local.example'
              - '.env.local.example'
              - 'apps/web/package.json'
              - 'apps/web/tsconfig.json'
              - 'apps/web/tsconfig.*.json'
              - 'apps/web/next.config.mjs'
              - 'apps/web/jest.config.ts'
              - 'apps/web/postcss.config.mjs'
              - 'apps/web/sentry.*'
              - 'packages/db/**'
              - 'packages/encryption/**'
              - 'packages/trpc/**'
              - 'packages/worker-utils/**'
              - 'services/deploy-infra/builder/**'
              - 'package.json'
              - 'pnpm-lock.yaml'
            cloud_agent_next:
              - 'services/cloud-agent-next/**'
      - name: Detect changed workspaces with tests
        id: workspaces
        run: |
          matrix=$(scripts/changed-workspaces.sh --exclude services/cloud-agent-next --exclude apps/web)
          echo "matrix=$matrix" >> "$GITHUB_OUTPUT"

  typecheck:
    needs: changes
    runs-on: ${{ vars.RUNNER_DEFAULT_LABEL || 'ubuntu-latest' }}
    timeout-minutes: 15
    steps:
      - uses: useblacksmith/checkout@41cdeedae8edb2e684ba22896a5fd2a3cb85db6b # v1
        with:
          lfs: true

      - name: Setup pnpm
        uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v4.4.0

      - name: Setup Node
        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
        with:
          node-version-file: '.nvmrc'
          cache: 'pnpm'

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Plugin shared-schemas sync check
        run: bash scripts/sync-plugin-shared.sh --check

      - name: Plugin openclaw peer-dep pin check
        run: bash scripts/check-plugin-openclaw-pin.sh

      - name: Typecheck
        run: scripts/typecheck-all.sh

  lint:
    needs: changes
    runs-on: ${{ vars.RUNNER_DEFAULT_LABEL || 'ubuntu-latest' }}
    timeout-minutes: 15
    steps:
      - uses: useblacksmith/checkout@41cdeedae8edb2e684ba22896a5fd2a3cb85db6b # v1
        with:
          lfs: true

      - name: Setup pnpm
        uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v4.4.0

      - name: Setup Node
        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
        with:
          node-version-file: '.nvmrc'
          cache: 'pnpm'

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Build trpc types
        run: pnpm --filter @kilocode/trpc run build

      - name: Lint
        run: scripts/lint-all.sh

  format-check:
    needs: changes
    runs-on: ${{ vars.RUNNER_DEFAULT_LABEL || 'ubuntu-latest' }}
    timeout-minutes: 15
    steps:
      - uses: useblacksmith/checkout@41cdeedae8edb2e684ba22896a5fd2a3cb85db6b # v1
        with:
          lfs: true

      - name: Setup pnpm
        uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v4.4.0

      - name: Setup Node
        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
        with:
          node-version-file: '.nvmrc'
          cache: 'pnpm'

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Format check
        run: |
          pnpm run format:check || {
            echo "::error::oxfmt formatting check failed. Please run 'pnpm run format' locally and commit the changes before pushing."
            exit 1
          }

  drizzle-check:
    needs: changes
    runs-on: ${{ vars.RUNNER_DEFAULT_LABEL || 'ubuntu-latest' }}
    timeout-minutes: 15
    steps:
      - uses: useblacksmith/checkout@41cdeedae8edb2e684ba22896a5fd2a3cb85db6b # v1
        with:
          lfs: true

      - name: Setup pnpm
        uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v4.4.0

      - name: Setup Node
        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
        with:
          node-version-file: '.nvmrc'
          cache: 'pnpm'

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Drizzle check
        run: pnpm drizzle check
        env:
          POSTGRES_URL: postgresql://unused:unused@localhost:5432/unused

  test:
    needs: [changes, typecheck, lint, format-check, drizzle-check]
    if: needs.changes.outputs.kilocode_backend == 'true'
    runs-on: ${{ vars.RUNNER_LARGE_LABEL || 'ubuntu-24.04-8core' }}
    timeout-minutes: 30

    services:
      postgres:
        image: pgvector/pgvector:pg16
        env:
          POSTGRES_HOST_AUTH_METHOD: trust
        options: >-
          --health-cmd pg_isready
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5
        ports:
          - 5432:5432
      redis:
        image: redis:7
        options: >-
          --health-cmd "redis-cli ping"
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5
      redis-http:
        image: hiett/serverless-redis-http:0.0.10
        env:
          SRH_MODE: env
          SRH_TOKEN: example_token
          SRH_CONNECTION_STRING: redis://redis:6379
        options: >-
          --health-cmd "wget -qO- http://127.0.0.1:80/ >/dev/null || exit 1"
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5
        ports:
          - 8079:80

    env:
      NODE_ENV: test
      POSTGRES_URL: postgresql://postgres:postgres@localhost:5432/postgres
      POSTGRES_CONNECT_TIMEOUT: 30000
      POSTGRES_MAX_QUERY_TIME: 30000
      UPSTASH_REDIS_REST_URL: http://localhost:8079
      UPSTASH_REDIS_REST_TOKEN: example_token
      JEST_MAX_WORKERS: 4

    steps:
      - uses: useblacksmith/checkout@41cdeedae8edb2e684ba22896a5fd2a3cb85db6b # v1
        with:
          lfs: true

      - name: Setup pnpm
        uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v4.4.0

      - name: Setup Node
        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
        with:
          node-version-file: '.nvmrc'
          cache: 'pnpm'

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Dependency cycle check
        run: pnpm run dependency-cycle-check

      - name: Run tests
        run: pnpm run test

      - name: Run builder Postgres repository tests
        run: pnpm --filter kilo-deploy-builder test:postgres

  build:
    needs: [changes, typecheck, lint, format-check, drizzle-check]
    if: needs.changes.outputs.kilocode_backend == 'true'
    runs-on: ${{ vars.RUNNER_LARGE_LABEL || 'ubuntu-24.04-8core' }}
    timeout-minutes: 30
    steps:
      - uses: useblacksmith/checkout@41cdeedae8edb2e684ba22896a5fd2a3cb85db6b # v1
        with:
          lfs: true

      - name: Setup pnpm
        uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v4.4.0

      - name: Setup Node
        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
        with:
          node-version-file: '.nvmrc'
          cache: 'pnpm'

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Cache Next.js build
        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
        with:
          path: |
            ~/.npm
            ${{ github.workspace }}/apps/web/.next/cache
          key: ${{ runner.os }}-nextjs-${{ hashFiles('**/pnpm-lock.yaml') }}-${{ hashFiles('**/*.js', '**/*.jsx', '**/*.ts', '**/*.tsx') }}
          restore-keys: |
            ${{ runner.os }}-nextjs-${{ hashFiles('**/pnpm-lock.yaml') }}-

      - name: Setup dummy build env
        working-directory: apps/web
        run: cp .env.test .env.production.local

      - name: Build application
        env:
          NODE_ENV: production
          VERCEL_ENV: production
          NEXTAUTH_URL: https://ci-build.invalid
          POSTGRES_URL: postgres://unused:unused@localhost:5432/unused
          UPSTASH_REDIS_REST_URL: https://redis.test.invalid
          UPSTASH_REDIS_REST_TOKEN: dummy-test-redis-token
          SENTRY_AUTH_TOKEN: ''
          NODE_OPTIONS: '--max-old-space-size=8192'
        run: pnpm run build

  cloud-agent-next:
    needs: [changes, typecheck, lint, format-check, drizzle-check]
    if: needs.changes.outputs.cloud_agent_next == 'true'
    runs-on: ${{ vars.RUNNER_LARGE_LABEL || 'ubuntu-24.04-8core' }}
    timeout-minutes: 15
    steps:
      - uses: useblacksmith/checkout@41cdeedae8edb2e684ba22896a5fd2a3cb85db6b # v1
        with:
          lfs: true
          ref: ${{ github.head_ref }}

      - name: Setup pnpm
        uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v4.4.0

      - name: Setup Node
        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
        with:
          node-version-file: '.nvmrc'
          cache: 'pnpm'

      - name: Setup Bun
        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
        with:
          bun-version: latest

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Build wrapper bundle
        working-directory: services/cloud-agent-next/wrapper
        run: bun run build.ts

      - name: Run cloud-agent-next tests
        run: pnpm --filter cloud-agent-next test:all

  workspace-tests:
    needs: [changes, typecheck, lint, format-check, drizzle-check]
    if: ${{ needs.changes.outputs.workspace_matrix != '[]' }}
    strategy:
      fail-fast: false
      matrix:
        workspace: ${{ fromJson(needs.changes.outputs.workspace_matrix) }}
    name: test (${{ matrix.workspace.name }})
    runs-on: ${{ vars.RUNNER_DEFAULT_LABEL || 'ubuntu-latest' }}
    timeout-minutes: 15
    steps:
      - uses: useblacksmith/checkout@41cdeedae8edb2e684ba22896a5fd2a3cb85db6b # v1
        with:
          lfs: true

      - name: Setup pnpm
        uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v4.4.0

      - name: Setup Node
        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
        with:
          node-version-file: '.nvmrc'
          cache: 'pnpm'

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Run tests
        run: pnpm --filter ${{ matrix.workspace.name }} test

  notify-main-failure:
    if: ${{ always() && github.ref == 'refs/heads/main' && contains(join(needs.*.result, ','), 'failure') }}
    needs:
      [typecheck, lint, format-check, drizzle-check, test, build, cloud-agent-next, workspace-tests]
    runs-on: ${{ vars.RUNNER_DEFAULT_LABEL || 'ubuntu-latest' }}
    timeout-minutes: 5
    steps:
      - name: Notify Slack
        continue-on-error: true
        uses: slackapi/slack-github-action@91efab103c0de0a537f72a35f6b8cda0ee76bf0a # v2.1.1
        with:
          webhook: ${{ secrets.DEPLOY_NOTIFY_SLACK_WEBHOOK_URL }}
          webhook-type: incoming-webhook
          payload: |
            {
              "blocks": [
                {
                  "type": "header",
                  "text": {
                    "type": "plain_text",
                    "text": ":red_circle: CI failed on main"
                  }
                },
                {
                  "type": "section",
                  "fields": [
                    {
                      "type": "mrkdwn",
                      "text": "*Commit:*\n<${{ github.server_url }}/${{ github.repository }}/commit/${{ github.sha }}|`${{ github.sha }}`>"
                    },
                    {
                      "type": "mrkdwn",
                      "text": "*Author:*\n${{ github.actor }}"
                    }
                  ]
                },
                {
                  "type": "context",
                  "elements": [
                    {
                      "type": "mrkdwn",
                      "text": "<${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}|View workflow run>"
                    }
                  ]
                }
              ]
            }