ci.yml

name: uDuck CI

on:
  workflow_dispatch:
  push:
    branches: [main, master]
  pull_request:
    branches: [main, master]

# Main pushes update one mutable index. Serialize them so a later run cannot
# overwrite the index with a view that was based on an older release state.
concurrency:
  group: uduck-evidence-${{ github.ref }}
  cancel-in-progress: false

permissions:
  contents: read

env:
  EVIDENCE_TAG: registry-evidence
  EVIDENCE_RELEASE_URL: https://github.com/${{ github.repository }}/releases/download/registry-evidence

jobs:
  resolve-policies:
    name: Resolve pinned upstream policy artifacts
    runs-on: ubuntu-24.04
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        with:
          persist-credentials: false
      - uses: actions/setup-python@v6
        with:
          python-version: '3.12'
      - run: pip install -r scripts/policy/requirements.txt
      - run: python -m unittest discover -s tests -p 'test_*.py'
      - run: python scripts/policy/resolve.py prepare
      - run: mkdir -p .generated/policies
      - uses: actions/upload-artifact@v4
        with:
          name: resolved-policies
          path: .generated/policies/
          include-hidden-files: true
          if-no-files-found: warn

  evidence:
    name: Render current registry evidence
    needs: resolve-policies
    runs-on: ubuntu-24.04
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        with:
          persist-credentials: false
      - run: mkdir -p .generated/policies
      - uses: actions/download-artifact@v4
        with:
          name: resolved-policies
          path: .generated/policies
      - uses: actions/setup-python@v6
        with:
          python-version: '3.12'
      - run: sudo apt-get update -qq && sudo apt-get install -y -qq libegl1 libgl1 ffmpeg
      - run: pip install -r simulation/requirements.txt
      - uses: actions/cache@v4
        with:
          path: .simcache
          key: sim-assets-${{ hashFiles('simulation/assets.lock.json') }}
      - name: Fetch durable evidence index for cache planning
        run: |
          python3 scripts/evidence_store.py fetch-index \
            --release-url "$EVIDENCE_RELEASE_URL" \
            --out evidence-index.json \
            --allow-missing
      - name: Plan diagnostic runs
        run: PYTHONPATH=simulation python3 scripts/evidence_store.py plan --index evidence-index.json --out evidence-plan.json
      - name: Test runner
        run: PYTHONPATH=simulation python -m unittest discover -s simulation/tests
      - name: Render uncached diagnostics (failed checks remain visible)
        env:
          MUJOCO_GL: egl
        run: |
          PYTHONPATH=simulation python - <<'PYRUN'
          import json
          import subprocess
          import sys
          from pathlib import Path

          plan = json.loads(Path('evidence-plan.json').read_text())
          Path('sim-results').mkdir(parents=True, exist_ok=True)
          for item in plan['items']:
              if item['status'] == 'cached':
                  print(f"[{item['entry']}] CACHED {item['evidence_key']}")
                  continue
              result = subprocess.run([
                  sys.executable,
                  'simulation/run_check.py',
                  '--entry', item['entry'],
                  '--out', 'sim-results',
                  '--keep-media',
              ])
              if result.returncode not in (0, 1):
                  raise SystemExit(result.returncode)
          PYRUN
      - uses: actions/upload-artifact@v4
        if: always()
        with:
          name: registry-evidence
          path: |
            sim-results/
            evidence-plan.json
            evidence-index.json
          retention-days: 14
          if-no-files-found: warn

  publish-evidence:
    name: Publish trusted evidence release
    needs: evidence
    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
    runs-on: ubuntu-24.04
    timeout-minutes: 10
    permissions:
      contents: write
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        with:
          persist-credentials: false
      - uses: actions/download-artifact@v4
        with:
          name: registry-evidence
          path: ci-evidence
      - name: Package content-addressed evidence
        run: python3 scripts/evidence_store.py package --results ci-evidence/sim-results --out evidence-assets --fragment evidence-fragment.json
      - name: Merge current results with evidence history
        run: python3 scripts/evidence_store.py merge --existing ci-evidence/evidence-index.json --fragment evidence-fragment.json --out index.json
      - name: Create the durable evidence release
        env:
          GH_TOKEN: ${{ github.token }}
          GH_REPO: ${{ github.repository }}
          COMMIT_SHA: ${{ github.sha }}
        run: |
          if gh release view "$EVIDENCE_TAG" --repo "$GH_REPO" >/dev/null 2>&1; then
            echo 'Evidence release already exists.'
          else
            gh release create "$EVIDENCE_TAG" --repo "$GH_REPO" --target "$COMMIT_SHA" --title 'uDuck registry evidence' --notes 'Content-addressed registry diagnostics generated by trusted main code. Each report describes its measured checks and input identity.' --latest=false
          fi
      - name: Upload immutable evidence assets
        env:
          GH_TOKEN: ${{ github.token }}
          GH_REPO: ${{ github.repository }}
        run: |
          existing_assets=$(gh release view "$EVIDENCE_TAG" --repo "$GH_REPO" --json assets --jq '.assets[].name')
          for asset in evidence-assets/*.tar.gz; do
            if [ -f "$asset" ]; then
              name=$(basename "$asset")
              if printf '%s\n' "$existing_assets" | grep -Fqx "$name"; then
                echo "Keeping immutable existing asset $name"
              else
                gh release upload "$EVIDENCE_TAG" "$asset" --repo "$GH_REPO"
              fi
            fi
          done
      - name: Upload the current evidence index
        env:
          GH_TOKEN: ${{ github.token }}
          GH_REPO: ${{ github.repository }}
        run: gh release upload "$EVIDENCE_TAG" index.json --repo "$GH_REPO" --clobber

  validate:
    name: Validate Registry & Build
    needs: [evidence, resolve-policies, publish-evidence]
    if: always() && needs.evidence.result == 'success' && needs['resolve-policies'].result == 'success' && (needs['publish-evidence'].result == 'success' || needs['publish-evidence'].result == 'skipped')
    runs-on: ubuntu-24.04
    steps:
      - name: Checkout Code
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Setup pnpm
        uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10

      - name: Setup Node.js
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: 22
          cache: 'pnpm'

      - name: Install Dependencies
        run: pnpm install --frozen-lockfile --ignore-scripts

      - uses: actions/download-artifact@v4
        with:
          name: registry-evidence
          path: ci-evidence
      - uses: actions/download-artifact@v4
        with:
          pattern: resolved-policies
          path: .generated/policies
          merge-multiple: true

      - name: Validate Registry
        run: pnpm validate

      - name: Run Vitest Suite
        run: pnpm test

      - name: Add this run's temporary diagnostics to the build view
        run: |
          python3 scripts/evidence_store.py package --results ci-evidence/sim-results --out ci-evidence/local-assets --fragment ci-evidence/local-fragment.json
          python3 scripts/evidence_store.py merge --existing ci-evidence/evidence-index.json --fragment ci-evidence/local-fragment.json --out build-evidence-index.json
      - name: Hydrate matching evidence into this build
        run: python3 scripts/evidence_store.py hydrate --index build-evidence-index.json --release-url "$EVIDENCE_RELEASE_URL" --local ci-evidence/sim-results --out public/media/registry-sim
      - name: Compile Public Registry Index
        run: pnpm compile

      - name: Build Web Application
        run: pnpm build

      - name: Deploy to Cloudflare Pages
        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
        uses: cloudflare/wrangler-action@v4
        with:
          apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
          accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
          packageManager: npm
          wranglerVersion: "4.127.1"
          workingDirectory: ${{ runner.temp }}
          command: pages deploy ${{ github.workspace }}/out --project-name=uduck-registry