name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

concurrency:
  group: ci-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: read

jobs:
  trust:
    name: Contributor trust
    runs-on: ubuntu-latest
    outputs:
      allowed: ${{ github.event_name == 'push' || steps.vouch.outputs.vouched == 'true' }}
    steps:
      - name: Check pull request author
        id: vouch
        if: github.event_name == 'pull_request'
        uses: mitchellh/vouch/action/check-user@d66fa29a64600490892131ad87597c30c91fcac4 # v1
        with:
          user: ${{ github.event.pull_request.user.login }}
          allow-fail: true
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  build-check:
    name: Build and check
    needs: trust
    if: needs.trust.outputs.allowed == 'true'
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - name: Checkout
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false

      - name: Setup Node.js
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: 22
          cache: npm

      - name: Install system dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y libcairo2-dev libpango1.0-dev libjpeg-dev libgif-dev librsvg2-dev fd-find ripgrep
          sudo ln -s $(which fdfind) /usr/local/bin/fd

      - name: Install dependencies
        run: npm ci

      - name: Build
        run: npm run build

      - name: Check
        run: npm run check

  test:
    name: Test (${{ matrix.name }})
    needs: trust
    if: needs.trust.outputs.allowed == 'true'
    runs-on: ubuntu-latest
    timeout-minutes: 15
    strategy:
      fail-fast: false
      matrix:
        include:
          - name: agent-core
            package: packages/agent
            command: npm test
            install_uv: false
          - name: ai
            package: packages/ai
            command: npm test
            install_uv: false
          - name: tui
            package: packages/tui
            command: npm test
            install_uv: false
          - name: coding-agent 1/3
            package: packages/coding-agent
            command: npm run test:ci -- --shard=1/3
            install_uv: true
          - name: coding-agent 2/3
            package: packages/coding-agent
            command: npm run test:ci -- --shard=2/3
            install_uv: true
          - name: coding-agent 3/3
            package: packages/coding-agent
            command: npm run test:ci -- --shard=3/3
            install_uv: true
          - name: coding-agent process smoke
            package: packages/coding-agent
            command: npm run test:process
            install_uv: true
          - name: coding-agent kernel
            package: packages/coding-agent
            command: npm run test:kernel
            install_uv: true
          - name: runtime python
            package: prime-agent-runtime
            command: uv run python -m unittest discover -s test
            install_uv: true
    steps:
      - name: Checkout
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false

      - name: Setup Node.js
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: 22
          cache: npm

      - name: Install system dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y libcairo2-dev libpango1.0-dev libjpeg-dev libgif-dev librsvg2-dev fd-find ripgrep
          sudo ln -s $(which fdfind) /usr/local/bin/fd

      - name: Install dependencies
        run: npm ci

      - name: Build
        run: npm run build

      - name: Install uv
        if: matrix.install_uv
        run: |
          python3 -m pip install --user uv
          echo "$HOME/.local/bin" >> "$GITHUB_PATH"

      - name: Test
        working-directory: ${{ matrix.package }}
        run: ${{ matrix.command }}

  build-check-test:
    name: build-check-test
    if: always() && needs.trust.outputs.allowed == 'true'
    needs: [trust, build-check, test]
    runs-on: ubuntu-latest
    steps:
      - name: Verify CI results
        env:
          BUILD_CHECK_RESULT: ${{ needs.build-check.result }}
          TEST_RESULT: ${{ needs.test.result }}
        run: |
          test "$BUILD_CHECK_RESULT" = success
          test "$TEST_RESULT" = success