ci.yml

name: CI

# Backlog §D1: gate every pull request. Jobs reuse the same scripts a
# developer runs locally, exactly like release.yml does, so CI never becomes a
# separate build path that can drift from the documented workflow.

on:
  pull_request:
  push:
    branches: [main]
  schedule:
    # Nightly slot for the macOS E2E suite, which needs a GUI session and
    # mutates com.headless.app user defaults.
    - cron: "0 6 * * *"
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: ci-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true

jobs:
  static:
    name: Static checks
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@v7
        with:
          fetch-depth: 0
      - name: Install zsh
        run: sudo apt-get update && sudo apt-get install -y --no-install-recommends zsh
      - name: Shell syntax
        run: |
          set -eu
          status=0
          for script in $(git ls-files '*.sh'); do
            case "$(head -n 1 "$script")" in
              *zsh*) checker="zsh -n" ;;
              *bash*) checker="bash -n" ;;
              *) checker="sh -n" ;;
            esac
            if ! $checker "$script"; then
              echo "syntax error: $script" >&2
              status=1
            fi
          done
          exit "$status"
      - name: QA evidence checksums
        # docs/qa/evidence is the only binary media allowed in git; prove the
        # committed bundle still matches its manifest.
        run: cd docs/qa/evidence && sha256sum -c SHA256SUMS
      - name: Whitespace
        if: github.event_name == 'pull_request'
        run: git diff --check "origin/${{ github.base_ref }}...HEAD"

  runtime:
    name: Agent runtime suite
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@v7
      - uses: pnpm/action-setup@v6
      - uses: actions/setup-node@v7
        with:
          node-version: 24
          cache: pnpm
      - run: pnpm install --frozen-lockfile --filter @headless/app
      - name: Context pruning suite
        run: pnpm test:runtime

  npm-launcher:
    name: npm launcher
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@v7
      - uses: pnpm/action-setup@v6
      - uses: actions/setup-node@v7
        with:
          node-version: 22
          cache: pnpm
      - run: pnpm install --frozen-lockfile --filter @lockintime/headless
      - run: pnpm --filter @lockintime/headless test
      - name: Verify published package contents
        working-directory: packages/headless-npm
        run: npm pack --dry-run

  python-sdk:
    name: Python SDK (${{ matrix.os }}, ${{ matrix.python }})
    runs-on: ${{ matrix.os }}
    timeout-minutes: 15
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, macos-latest]
        python: ["3.11", "3.12", "3.13", "3.14"]
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
        with:
          python-version: ${{ matrix.python }}
          cache: pip
          cache-dependency-path: packages/headless-python/pyproject.toml
      - name: Install Python SDK development tools
        working-directory: packages/headless-python
        run: python -m pip install -e '.[dev]'
      - name: Verify generated protocol contract
        working-directory: packages/headless-python
        run: python scripts/generate.py --check
      - name: Format and lint
        working-directory: packages/headless-python
        run: |
          ruff check .
          ruff format --check .
      - name: Static typing
        working-directory: packages/headless-python
        run: mypy
      - name: Unit and lifecycle tests
        working-directory: packages/headless-python
        run: pytest
      - name: Build and verify exact package contents
        working-directory: packages/headless-python
        run: |
          python -m build
          python scripts/verify_package.py

  protocol:
    name: Protocol suite
    runs-on: ubuntu-latest
    timeout-minutes: 30
    container: swift:6.1-bookworm
    steps:
      - uses: actions/checkout@v7
      - name: Prepare SwiftPM exclude paths
        # Package.swift excludes build/ and Headless.app from the host target;
        # Dockerfile.linux creates them for the same reason.
        run: mkdir -p apps/headless/build apps/headless/Headless.app
      - name: Protocol and security tests
        run: ./apps/headless/test.sh

  web:
    name: Web app
    runs-on: ubuntu-latest
    timeout-minutes: 20
    steps:
      - uses: actions/checkout@v7
      - uses: pnpm/action-setup@v6
      - uses: actions/setup-node@v7
        with:
          node-version: 24
          cache: pnpm
      - run: pnpm install --frozen-lockfile --filter @headless/web
      - run: pnpm --filter @headless/web lint
      - run: pnpm --filter @headless/web build
      - name: Install Chromium for responsive checks
        run: pnpm --filter @headless/web exec playwright install --with-deps chromium
      - name: Responsive command directory
        run: pnpm --filter @headless/web test:browser

  linux-e2e:
    name: Linux E2E (Docker)
    runs-on: ubuntu-latest
    timeout-minutes: 45
    steps:
      - uses: actions/checkout@v7
      - name: Sandboxed Chromium E2E
        run: ./apps/headless/Tests/linux-docker.sh
      - name: Upload QA evidence
        if: always()
        uses: actions/upload-artifact@v7
        with:
          name: linux-e2e-evidence
          path: apps/headless/build/qa-evidence
          if-no-files-found: ignore
          retention-days: 7

  macos:
    name: macOS build and protocol suite
    runs-on: macos-latest
    timeout-minutes: 45
    steps:
      - uses: actions/checkout@v7
      - uses: pnpm/action-setup@v6
      - uses: actions/setup-node@v7
        with:
          node-version: 22
          cache: pnpm
      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
        with:
          python-version: "3.14"
          cache: pip
          cache-dependency-path: packages/headless-python/pyproject.toml
      - run: pnpm install --frozen-lockfile --filter @lockintime/headless
      - name: Build app
        run: ./apps/headless/build.sh
      - name: Protocol and security tests
        run: ./apps/headless/test.sh
      - name: Build TypeScript SDK
        run: pnpm --filter @lockintime/headless build
      - name: Swift CLI to TypeScript SDK integration
        env:
          HEADLESS_TEST_CLI: ${{ github.workspace }}/apps/headless/Headless.app/Contents/Resources/bin/headless
          HEADLESS_TEST_HOST: ${{ github.workspace }}/apps/headless/Headless.app/Contents/MacOS/Headless
        run: node packages/headless-npm/test/macos-swift-integration.mjs
      - name: Install Python SDK
        run: python -m pip install ./packages/headless-python
      - name: Swift CLI to Python SDK integration
        env:
          HEADLESS_TEST_CLI: ${{ github.workspace }}/apps/headless/Headless.app/Contents/Resources/bin/headless
          HEADLESS_TEST_HOST: ${{ github.workspace }}/apps/headless/Headless.app/Contents/MacOS/Headless
        run: python packages/headless-python/tests/swift_integration.py

  macos-e2e:
    name: macOS E2E (WKWebView)
    # Opens real windows and mutates com.headless.app user defaults, so it runs
    # nightly, on demand, or on a pull request labelled macos-e2e.
    if: >-
      github.event_name == 'schedule' ||
      github.event_name == 'workflow_dispatch' ||
      contains(github.event.pull_request.labels.*.name, 'macos-e2e')
    runs-on: macos-latest
    timeout-minutes: 60
    steps:
      - uses: actions/checkout@v7
      - name: Install FFmpeg
        run: brew install ffmpeg
      - name: Build app
        run: ./apps/headless/build.sh
      - name: E2E
        run: zsh ./apps/headless/Tests/macos-e2e.sh