ci.yml

# Version PRs from `changesets/action` use head branch `changeset-release/<base>` (e.g. `changeset-release/main`;
# see changesets/action `run.ts`: `versionBranch = \`changeset-release/${branch}\``).
#
# GitHub docs: required status checks may be successful, skipped, or neutral — skipped often still allows merge
# (see https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-status-checks-before-merging ).
# This workflow still gates on `changeset-release/*` and finishes with one **`CI complete`** job so there is a
# single unambiguous pass/fail (branch protection also warns that duplicate job *names* across workflows can block merges).
name: CI

on:
  push:
    branches:
      - main
  pull_request:
    branches:
      - main

permissions:
  contents: read

jobs:
  skip-ci:
    name: Gate (skip full CI for version PRs?)
    runs-on: ubuntu-latest
    outputs:
      skip: ${{ steps.gate.outputs.skip }}
    steps:
      - id: gate
        run: |
          if [ "${{ github.event_name }}" = "pull_request" ] && \
             echo "${{ github.head_ref }}" | grep -q '^changeset-release/'; then
            echo "skip=true" >> "$GITHUB_OUTPUT"
            echo "Head is changeset-release/* — full CI skipped; ci-complete will pass."
          else
            echo "skip=false" >> "$GITHUB_OUTPUT"
          fi

  format:
    name: 💅 Format
    needs: skip-ci
    if: needs['skip-ci'].outputs.skip != 'true'
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
        with:
          persist-credentials: false

      - name: Setup
        uses: ./.github/actions/setup

      - name: Run format
        run: bun run format:check

  lint:
    name: 🕵 Lint
    needs: skip-ci
    if: needs['skip-ci'].outputs.skip != 'true'
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
        with:
          persist-credentials: false

      - name: Setup
        uses: ./.github/actions/setup

      - name: Run lint
        run: bun run lint:ci

  typecheck:
    name: ✅ Typecheck
    needs: skip-ci
    if: needs['skip-ci'].outputs.skip != 'true'
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
        with:
          persist-credentials: false

      - name: Setup
        uses: ./.github/actions/setup

      - name: Run typecheck
        run: bun run typecheck

  test:
    name: 🔬 Test
    needs: skip-ci
    if: needs['skip-ci'].outputs.skip != 'true'
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
        with:
          persist-credentials: false

      - name: Setup
        uses: ./.github/actions/setup

      - name: Run unit tests with coverage
        run: bun run test:coverage

      - name: Run scripts tests (Action helpers + TS↔mjs sync)
        run: bun run test:scripts

      - name: Golden query regression (fixtures/minimal)
        run: bun run test:golden

      - name: Agent eval harness (probe + live smoke, fixtures/minimal)
        run: bun run test:agent-eval

  build:
    name: 🧰 Build
    needs: skip-ci
    if: needs['skip-ci'].outputs.skip != 'true'
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
        with:
          persist-credentials: false

      - name: Setup
        uses: ./.github/actions/setup

      - name: Run build
        run: bun run build

      # Deliberately `node`, not `bun`: many installs use npm + Node; this checks dist/ + better-sqlite3.
      # Bun is already used for build/tests above.
      - name: Node smoke (dist + better-sqlite3)
        run: node dist/index.mjs query "SELECT 1 as ok"

      # 0.6.0 regression guard — `resolveBundledRecipesDir()` walked
      # past the package root, so `--recipes-json` returned `[]` even
      # though the tarball shipped the bundled recipes correctly.
      - name: Node smoke (bundled recipes resolve from dist)
        run: |
          set -euo pipefail
          count=$(node dist/index.mjs query --recipes-json | jq 'length')
          echo "bundled recipes resolved: $count"
          [ "$count" -gt 0 ] || { echo "bundled recipes catalog is empty — resolver path broke"; exit 1; }

      # Full rebuild exercises multi-statement DDL (`runSql`), `dropAll`, workers path — Node only.
      - name: Node full index (fixtures/minimal)
        run: |
          set -euo pipefail
          export CODEMAP_ROOT="$GITHUB_WORKSPACE/fixtures/minimal"
          rm -f "$CODEMAP_ROOT/.codemap.db"
          timeout 45 node dist/index.mjs --full
          node dist/index.mjs query "SELECT COUNT(*) AS files FROM files"

  check-pack:
    name: 📦 Pack validation
    needs: skip-ci
    if: needs['skip-ci'].outputs.skip != 'true'
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
        with:
          persist-credentials: false

      - name: Setup
        uses: ./.github/actions/setup

      - name: Build
        run: bun run build

      - name: Run pack validation
        run: bun run check:pack

  benchmark:
    name: 📊 Benchmark (fixture)
    needs: skip-ci
    if: needs['skip-ci'].outputs.skip != 'true'
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
        with:
          persist-credentials: false

      - name: Setup
        uses: ./.github/actions/setup

      - name: Index fixture and run benchmark
        run: |
          export CODEMAP_ROOT="$GITHUB_WORKSPACE/fixtures/minimal"
          bun run dev --full
          bun run benchmark

  docs:
    name: 📖 Docs site
    needs: skip-ci
    if: needs['skip-ci'].outputs.skip != 'true'
    runs-on: ubuntu-latest
    # Token for github-releases changelog — avoids offline changelog failures under --strict.
    env:
      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
    steps:
      - name: Checkout
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
        with:
          persist-credentials: false
          # Sitemap lastmod uses `git log` per file.
          fetch-depth: 0

      - name: Setup
        uses: ./.github/actions/setup

      # Lib dist — cheap; keep for parity / future islands that resolve package entrypoints.
      - name: Build
        run: bun run build

      - name: Generate API reference (Markdown)
        run: bun run docs:api

      # Site content graph. No --external (offline). Wrapper filters immutable
      # changelog→maintainer-docs broken links (see apps/docs/scripts/validate.ts).
      - name: Validate docs links
        run: bun run docs:validate -- --strict

      - name: Typecheck docs site
        run: bun run docs:check -- --isolated

      - name: Build docs site
        run: bun run docs:build

      # Post-build; skips live in apps/docs `audit` script (+ lessons).
      - name: Audit docs site
        run: bun run docs:audit

  audit:
    # `bun audit` exits 0 regardless of severity — the scan below blocks on high/critical.
    # Transitive-dep CVE visibility; advisory-API outage doesn't block.
    name: 🛡 Audit
    needs: skip-ci
    if: needs['skip-ci'].outputs.skip != 'true'
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
        with:
          persist-credentials: false

      - name: Setup
        uses: ./.github/actions/setup

      - name: bun audit (block on high/critical)
        run: |
          set +e
          # bun emits ANSI color even when piped — strip it or the severity grep misses it.
          NO_COLOR=1 bun audit 2>&1 | sed -E 's/\x1b\[[0-9;]*m//g' > /tmp/bun-audit.log
          cat /tmp/bun-audit.log
          if grep -E '(^|[[:space:]])(high|critical):[[:space:]]' /tmp/bun-audit.log; then
            echo "::error::high or critical vulnerabilities found — blocking"
            exit 1
          fi

  action-smoke:
    # Dogfood Slice 4 of plan PR #73: invoke `uses: ./` from this very repo
    # so the action.yml + scripts/detect-pm.mjs are exercised on every PR.
    # Smoke uses `command: --version` to avoid the real-audit dependency
    # chain (audit baselines etc.) — this validates the composite-step
    # flow + npm-pulled codemap binary, not the audit logic itself
    # (which is covered by the unit-test suite).
    name: 🤖 Action smoke (dogfood)
    needs: skip-ci
    if: needs['skip-ci'].outputs.skip != 'true'
    runs-on: ubuntu-latest
    # Non-blocking until we've published codemap@<v1> matching the Action.
    # Today the Action pulls codemap@latest from npm (currently 0.8.x), which works
    # for `--version` but doesn't validate v1.x flags. Promote to a hard
    # gate when v1.0.0 ships.
    continue-on-error: true
    steps:
      - name: Checkout
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
        with:
          persist-credentials: false

      - name: Run the local-path action
        uses: ./
        with:
          command: "--version"
          format: "json"
          upload-sarif: "false"
          pr-comment: "false"
          fail-on: "never"

  ci-complete:
    name: CI complete
    needs:
      [
        skip-ci,
        format,
        lint,
        typecheck,
        test,
        build,
        check-pack,
        docs,
        audit,
        benchmark,
      ]
    if: always()
    runs-on: ubuntu-latest
    steps:
      - name: Fail if any required job failed
        if: |
          needs['skip-ci'].outputs.skip != 'true' && (
            needs.format.result != 'success' ||
            needs.lint.result != 'success' ||
            needs.typecheck.result != 'success' ||
            needs.test.result != 'success' ||
            needs.build.result != 'success' ||
            needs['check-pack'].result != 'success' ||
            needs.docs.result != 'success' ||
            needs.audit.result != 'success' ||
            needs.benchmark.result != 'success'
          )
        run: exit 1

      - name: OK
        run: echo "CI requirements satisfied"