devcontainer-ci.yml

name: Dev Container CI

on:
  push:
    branches: [main]
    paths:
      - '.devcontainer/**'
      - '.github/workflows/**'

  pull_request:
    branches: [main]
    paths:
      - '.devcontainer/**'
      - '.github/workflows/**'

permissions:
  contents: read

# Cancel in-progress runs for the same branch/PR
concurrency:
  group: ci-${{ github.ref }}
  cancel-in-progress: true

jobs:
  # ─────────────────────────────────────────────────────────────────
  # Job 1: Detect what changed (runs in <5 seconds)
  # ─────────────────────────────────────────────────────────────────
  detect-changes:
    name: Detect Changes
    runs-on: ubuntu-latest
    outputs:
      infrastructure: ${{ steps.filter.outputs.infrastructure }}
      runtime: ${{ steps.filter.outputs.runtime }}
      docs: ${{ steps.filter.outputs.docs }}
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Detect changed files
        uses: dorny/paths-filter@v3
        id: filter
        with:
          filters: |
            infrastructure:
              - '.devcontainer/post-create-cmd.sh'
              - '.devcontainer/start-hermes.sh'
              - '.devcontainer/self-check.sh'
              - '.devcontainer/devcontainer.json'
              - '.github/workflows/**'
            runtime:
              - '.devcontainer/skills/**'
              - '.devcontainer/wiki/**'
              - '.devcontainer/mnemon/**'
              - '.devcontainer/memories/**'
              - '.devcontainer/.hermes.md'
              - '.devcontainer/codespace-cleanup.sh'
            docs:
              - 'README.md'
              - '*.md'

  # ─────────────────────────────────────────────────────────────────
  # Job 2: Full build + smoke test (only if infrastructure changed)
  # ─────────────────────────────────────────────────────────────────
  full-build:
    name: Build & Smoke Test
    needs: detect-changes
    if: needs.detect-changes.outputs.infrastructure == 'true'
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '24'

      - name: run post-create-cmd.sh
        run: bash ./.devcontainer/post-create-cmd.sh

      - name: run start-hermes.sh
        run: bash ./.devcontainer/start-hermes.sh

      - name: Smoke Test
        run: |
          bash ./.devcontainer/self-check.sh
          echo "Smoke test passed!"

      - name: Mnemon Integration Test
        run: |
          set -euo pipefail
          TEST_NAME="ci-mnemon-$(date +%s)-$$"
          echo "=== Mnemon Integration Test: $TEST_NAME ==="

          echo "[1/3] Hermes remembers via mnemon_remember..."
          hermes chat -q "my name is $TEST_NAME, remember this in mnemon" \
            || { echo "FAIL: Hermes failed"; exit 1; }

          echo "[2/3] mnemon recall via CLI..."
          mnemon recall "$TEST_NAME" --limit 5 2>&1 | grep -q "$TEST_NAME" \
            || { echo "FAIL: mnemon recall did not find $TEST_NAME"; exit 1; }

          echo "[3/3] Claude retrieves via mnemon..."
          CLAUDE_OUTPUT=$( \
            $HOME/.local/bin/claude --dangerously-skip-permissions -p \
            "Use mnemon recall to find my name. Reply with ONLY the name." 2>&1) || true
          echo "Claude: $CLAUDE_OUTPUT"
          echo "$CLAUDE_OUTPUT" | grep -q "$TEST_NAME" \
            || { echo "FAIL: Claude did not return $TEST_NAME"; }

          echo "=== ALL MNEMON CHECKS PASSED ==="

      # ── Collect logs on failure ──────────────────────────────────────
      - name: Collect diagnostic logs
        if: failure()
        run: |
          mkdir -p /tmp/failure-logs

          # Service logs (written to /tmp by start scripts)
          cp /tmp/modelrelay.log   /tmp/failure-logs/ 2>/dev/null || true
          cp /tmp/omniroute.log    /tmp/failure-logs/ 2>/dev/null || true
          cp /tmp/ollama.log       /tmp/failure-logs/ 2>/dev/null || true
          cp /tmp/ollama-pull.log  /tmp/failure-logs/ 2>/dev/null || true

          # Hermes logs
          cp ~/.hermes/logs/gateway.log   /tmp/failure-logs/ 2>/dev/null || true
          cp ~/.hermes/logs/dashboard.log /tmp/failure-logs/ 2>/dev/null || true

          # System diagnostics
          ps aux > /tmp/failure-logs/ps-aux.txt 2>&1 || true
          ss -tlnp > /tmp/failure-logs/ss-tlnp.txt 2>&1 || netstat -tlnp > /tmp/failure-logs/netstat-tlnp.txt 2>&1 || true

          echo "=== Collected logs ==="
          ls -la /tmp/failure-logs/

      - name: Upload logs on failure
        if: failure()
        uses: actions/upload-artifact@v4
        with:
          name: failure-logs-${{ github.run_id }}
          path: /tmp/failure-logs/
          if-no-files-found: warn

  # ─────────────────────────────────────────────────────────────────
  # Job 3: Lint & validation (for docs + runtime changes)
  # ─────────────────────────────────────────────────────────────────
  lint-check:
    name: Lint & Validate
    needs: detect-changes
    if: |
      needs.detect-changes.outputs.docs == 'true' ||
      needs.detect-changes.outputs.runtime == 'true'
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '24'

      - name: Run local CI lint check script
        run: |
          # Install markdownlint-cli (required by script)
          npm install -g markdownlint-cli
          # Run the canonical validation script
          bash .devcontainer/skills/ci-lint-check/scripts/ci_lint_check.sh