name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

concurrency:
  group: ci-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: read

jobs:
  trust:
    name: Contributor trust
    runs-on: ubuntu-latest
    outputs:
      allowed: ${{ github.event_name == 'push' || steps.vouch.outputs.vouched == 'true' }}
    steps:
      - name: Check pull request author
        id: vouch
        if: github.event_name == 'pull_request'
        uses: mitchellh/vouch/action/check-user@d66fa29a64600490892131ad87597c30c91fcac4 # v1
        with:
          user: ${{ github.event.pull_request.user.login }}
          allow-fail: true
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  build-check:
    name: Build and check
    needs: trust
    if: needs.trust.outputs.allowed == 'true'
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - name: Checkout
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          fetch-depth: 0
          persist-credentials: false

      - name: Setup Node.js
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: 22
          cache: npm

      - name: Install system dependencies
        run: |
          # These dependencies come from Ubuntu, not the runner's third-party repositories.
          test -f /etc/apt/sources.list.d/ubuntu.sources
          apt_sources=(-o Dir::Etc::sourcelist=/etc/apt/sources.list.d/ubuntu.sources -o Dir::Etc::sourceparts=-)
          sudo apt-get "${apt_sources[@]}" update
          sudo apt-get "${apt_sources[@]}" install -y libcairo2-dev libpango1.0-dev libjpeg-dev libgif-dev librsvg2-dev fd-find ripgrep
          sudo ln -s $(which fdfind) /usr/local/bin/fd

      - name: Install Zig
        run: |
          # The native usage core is pinned to one Zig release: the standard library moved
          # args/stdio/fs/clock APIs in 0.16. Verified against the published checksum.
          curl -L --fail -o /tmp/zig.tar.xz https://ziglang.org/download/0.16.0/zig-x86_64-linux-0.16.0.tar.xz
          echo "70e49664a74374b48b51e6f3fdfbf437f6395d42509050588bd49abe52ba3d00  /tmp/zig.tar.xz" | sha256sum -c -
          sudo tar -xJf /tmp/zig.tar.xz -C /opt
          echo "/opt/zig-x86_64-linux-0.16.0" >> "$GITHUB_PATH"

      - name: Install dependencies
        run: npm ci

      - name: Build
        run: npm run build

      - name: Check
        run: npm run check

  test:
    name: Test (${{ matrix.name }})
    needs: trust
    if: needs.trust.outputs.allowed == 'true'
    runs-on: ubuntu-latest
    timeout-minutes: 15
    strategy:
      fail-fast: false
      matrix:
        include:
          - name: agent-core
            package: packages/agent
            command: npm test
            install_uv: false
          - name: ai
            package: packages/ai
            command: npm test
            install_uv: false
          - name: tui
            package: packages/tui
            command: npm test
            install_uv: false
          - name: coding-agent 1/3
            package: packages/coding-agent
            command: npm run test:ci -- --shard=1/3
            install_uv: true
          - name: coding-agent 2/3
            package: packages/coding-agent
            command: npm run test:ci -- --shard=2/3
            install_uv: true
          - name: coding-agent 3/3
            package: packages/coding-agent
            command: npm run test:ci -- --shard=3/3
            install_uv: true
          - name: coding-agent process smoke
            package: packages/coding-agent
            command: npm run test:process
            install_uv: true
          - name: coding-agent kernel
            package: packages/coding-agent
            command: npm run test:kernel
            install_uv: true
          - name: runtime python
            package: prime-agent-runtime
            command: uv run python -m unittest discover -s test
            install_uv: true
    steps:
      - name: Checkout
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false

      - name: Setup Node.js
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: 22
          cache: npm

      - name: Install system dependencies
        run: |
          # These dependencies come from Ubuntu, not the runner's third-party repositories.
          test -f /etc/apt/sources.list.d/ubuntu.sources
          apt_sources=(-o Dir::Etc::sourcelist=/etc/apt/sources.list.d/ubuntu.sources -o Dir::Etc::sourceparts=-)
          sudo apt-get "${apt_sources[@]}" update
          sudo apt-get "${apt_sources[@]}" install -y libcairo2-dev libpango1.0-dev libjpeg-dev libgif-dev librsvg2-dev fd-find ripgrep
          sudo ln -s $(which fdfind) /usr/local/bin/fd

      - name: Install Zig
        run: |
          # The native usage core is pinned to one Zig release: the standard library moved
          # args/stdio/fs/clock APIs in 0.16. Verified against the published checksum.
          curl -L --fail -o /tmp/zig.tar.xz https://ziglang.org/download/0.16.0/zig-x86_64-linux-0.16.0.tar.xz
          echo "70e49664a74374b48b51e6f3fdfbf437f6395d42509050588bd49abe52ba3d00  /tmp/zig.tar.xz" | sha256sum -c -
          sudo tar -xJf /tmp/zig.tar.xz -C /opt
          echo "/opt/zig-x86_64-linux-0.16.0" >> "$GITHUB_PATH"

      - name: Install dependencies
        run: npm ci

      - name: Build
        run: npm run build

      - name: Install uv
        if: matrix.install_uv
        run: |
          python3 -m pip install --user uv
          echo "$HOME/.local/bin" >> "$GITHUB_PATH"

      - name: Test
        working-directory: ${{ matrix.package }}
        run: ${{ matrix.command }}

      - name: Test benchmark harness
        if: matrix.name == 'runtime python'
        working-directory: scripts/benchmarks
        run: |
          uv run --locked ruff check .
          uv run --locked ruff format --check .
          uv run --locked python -m unittest discover -s tests -v

  standalone:
    needs: trust
    if: needs.trust.outputs.allowed == 'true'
    uses: ./.github/workflows/standalone-binaries.yml

  build-check-test:
    name: build-check-test
    if: always() && needs.trust.outputs.allowed == 'true'
    needs: [trust, build-check, test, standalone]
    runs-on: ubuntu-latest
    steps:
      - name: Verify CI results
        env:
          BUILD_CHECK_RESULT: ${{ needs.build-check.result }}
          TEST_RESULT: ${{ needs.test.result }}
          STANDALONE_RESULT: ${{ needs.standalone.result }}
        run: |
          test "$BUILD_CHECK_RESULT" = success
          test "$TEST_RESULT" = success
          test "$STANDALONE_RESULT" = success