ci.yml

name: CI

on:
  push:
    branches: [ main, develop ]
  pull_request:
    branches: [ main ]
  schedule:
    - cron: '0 4 * * 1'  # Weekly on Monday at 04:00 UTC
  workflow_dispatch:

# Minimal permissions by default
permissions:
  contents: read
  checks: write
  pull-requests: write

jobs:
  # Main CI job using lefthook
  ci:
    name: CI Validation
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v4
      with:
        fetch-depth: 0  # Need full history for some checks
    
    - name: Set up Go
      uses: actions/setup-go@v5
      with:
        go-version-file: 'cli/go.mod'
        cache-dependency-path: cli/go.sum

    - name: golangci-lint
      uses: golangci/golangci-lint-action@v8
      with:
        version: v2.11.4
        working-directory: cli
        skip-cache: false

    - name: Install lefthook
      run: |
        # Install using Go for better reliability in CI
        go install github.com/evilmartians/lefthook@latest
        echo "$(go env GOPATH)/bin" >> $GITHUB_PATH

    - name: Set up Bun
      uses: oven-sh/setup-bun@v2
      with:
        bun-version: latest

    - name: Install root dependencies
      run: bun install --frozen-lockfile

    - name: Lint DESIGN.md
      run: bunx @google/design.md lint .stitch/DESIGN.md

    - name: Build CLI binary
      run: |
        cd cli
        make build

    - name: Validate bead schema
      run: make bead-schema

    - name: Validate readiness-checks schema
      run: make readiness-schema

    - name: Validate skill metadata
      run: make skill-schema

    - name: Validate ddx skill (agentskills.io conformance)
      run: scripts/eval-skill.sh --validate

    - name: Run CI validation
      run: lefthook run ci
      env:
        LEFTHOOK_QUIET: meta,execution

    - name: Guard server state against test pollution
      run: |
        set -euo pipefail

        export XDG_DATA_HOME="$(mktemp -d)"

        cd cli
        go test ./... -count=1

        ./build/ddx server --addr 127.0.0.1 --port 17743 --tsnet=false > ../ddx-state-guard-server.log 2>&1 &
        server_pid=$!
        cleanup() {
          kill "$server_pid" 2>/dev/null || true
          wait "$server_pid" 2>/dev/null || true
        }
        trap cleanup EXIT

        state_file="$XDG_DATA_HOME/ddx/server-state.json"
        for _ in $(seq 1 20); do
          if [ -f "$state_file" ]; then
            break
          fi
          sleep 0.25
        done

        if [ ! -f "$state_file" ]; then
          cat ../ddx-state-guard-server.log
          echo "server-state.json was not created"
          exit 1
        fi

        project_count="$(jq '.projects | length' "$state_file")"
        if [ "$project_count" -gt 20 ]; then
          jq '.projects[] | {name, path}' "$state_file"
          echo "server-state.json contains $project_count projects; expected <= 20"
          exit 1
        fi

        if jq -e '.projects[]? | select(.path | test("(^/tmp/|^/private/tmp/|^/var/folders/|/Test[A-Z][A-Za-z0-9_]*[0-9]+/)"))' "$state_file" >/dev/null; then
          jq '.projects[] | select(.path | test("(^/tmp/|^/private/tmp/|^/var/folders/|/Test[A-Z][A-Za-z0-9_]*[0-9]+/)")) | {name, path}' "$state_file"
          echo "server-state.json contains Go test temp-dir project entries"
          exit 1
        fi

  # Separate build job for matrix builds
  build:
    name: Build
    needs: ci
    runs-on: ubuntu-latest
    strategy:
      matrix:
        # Fizeau v0.14.32 does not currently cross-compile for Windows
        # (github.com/easel/fizeau/internal/discoverycache uses syscall.Kill).
        os: [linux, darwin]
        arch: [amd64, arm64]
    defaults:
      run:
        working-directory: cli
    steps:
    - uses: actions/checkout@v4
    
    - name: Set up Go
      uses: actions/setup-go@v5
      with:
        go-version-file: 'cli/go.mod'
        cache-dependency-path: cli/go.sum
    
    - name: Build binary
      run: |
        GOOS=${{ matrix.os }} GOARCH=${{ matrix.arch }} \
          go build -v -o ../bin/ddx-${{ matrix.os }}-${{ matrix.arch }} .
    
    - name: Upload artifacts
      uses: actions/upload-artifact@v4
      with:
        name: ddx-${{ matrix.os }}-${{ matrix.arch }}
        path: bin/ddx-${{ matrix.os }}-${{ matrix.arch }}
        retention-days: 7

  # Integration tests
  integration:
    name: Integration Tests
    needs: ci
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: cli
    steps:
    - uses: actions/checkout@v4

    - name: Set up Go
      uses: actions/setup-go@v5
      with:
        go-version-file: 'cli/go.mod'
        cache-dependency-path: cli/go.sum

    - name: Build binary
      run: go build -o ../bin/ddx .

    - name: Run E2E smoke tests
      run: go test -v ./cmd -run TestE2ESmokeJourney -count=1 2>&1 | tee ../e2e-test-output.txt

    - name: Upload E2E test output
      if: always()
      uses: actions/upload-artifact@v4
      with:
        name: e2e-test-output
        path: e2e-test-output.txt
        retention-days: 7

    - name: Render execute-bead prompt-size report
      env:
        DDX_PROMPT_SIZE_REPORT: ${{ github.workspace }}/prompt-size-report.txt
      run: go test -v ./internal/agent -run '^TestPromptSizeReport$' -count=1 2>&1 | tee ../prompt-size-report.log

    - name: Upload prompt-size report
      if: always()
      uses: actions/upload-artifact@v4
      with:
        name: prompt-size-report
        path: |
          prompt-size-report.txt
          prompt-size-report.json
          prompt-size-report.log
        retention-days: 14

  frontend-e2e:
    name: Frontend Playwright E2E
    needs: ci
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v4

    - name: Set up Go
      uses: actions/setup-go@v5
      with:
        go-version-file: 'cli/go.mod'
        cache-dependency-path: cli/go.sum

    - name: Set up Bun
      uses: oven-sh/setup-bun@v2
      with:
        bun-version: latest

    - name: Install frontend dependencies
      working-directory: cli/internal/server/frontend
      run: bun install

    - name: Build frontend bundle
      working-directory: cli/internal/server/frontend
      run: bun run build

    - name: Build CLI binary
      working-directory: cli
      run: make build

    - name: Install Playwright browsers
      working-directory: cli/internal/server/frontend
      run: bunx playwright install --with-deps chromium

    - name: Run frontend unit tests
      working-directory: cli/internal/server/frontend
      run: bun run test:unit -- --run

    - name: Run frontend Playwright E2E tests
      working-directory: cli/internal/server/frontend
      run: bun run test:e2e:functional

  # Test timing — runs the full suite with -json output and uploads durable timing artifacts.
  # Non-gating: timing data is captured regardless of ci job outcome.
  test-timing:
    name: Test Timing
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: cli
    steps:
    - uses: actions/checkout@v4

    - name: Set up Go
      uses: actions/setup-go@v5
      with:
        go-version-file: 'cli/go.mod'
        cache-dependency-path: cli/go.sum

    - name: Run tests with JSON output
      run: go test -json -race -cover ./... 2>&1 | tee ../test-output.json || true

    - name: Generate timing summary
      if: always()
      run: go run ./tools/test-timing < ../test-output.json > ../test-timing-summary.md

    - name: Upload test timing artifacts
      if: always()
      uses: actions/upload-artifact@v4
      with:
        name: test-timing-${{ github.run_id }}
        path: |
          test-output.json
          test-timing-summary.md
        retention-days: 30

  # Perf tests — non-gating; run weekly on schedule or on manual dispatch only
  perf:
    name: Perf Tests
    runs-on: ubuntu-latest
    if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'
    defaults:
      run:
        working-directory: cli
    steps:
    - uses: actions/checkout@v4

    - name: Set up Go
      uses: actions/setup-go@v5
      with:
        go-version-file: 'cli/go.mod'
        cache-dependency-path: cli/go.sum

    - name: Run perf tests
      run: make test-perf