ci.yml

name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

permissions:
  contents: read

jobs:
  test:
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@v7

      - uses: actions/setup-python@v6
        with:
          python-version: "3.11"
          cache: pip
          cache-dependency-path: requirements-dev.lock

      - name: Install Python test dependencies
        run: pip install -r requirements-dev.lock

      - name: Run tests with coverage
        run: python -m pytest tests/ -q --cov=py_modules --cov=main --cov-report=xml --cov-branch

      - name: Upload coverage artifact
        uses: actions/upload-artifact@v7
        with:
          name: coverage-report
          path: coverage.xml

  build:
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@v7

      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6

      - uses: actions/setup-node@v7
        with:
          node-version: "24"
          cache: pnpm
          cache-dependency-path: pnpm-lock.yaml

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: ESLint
        run: pnpm lint

      - name: Prettier format check
        run: pnpm format:check

      - name: Build
        run: pnpm build

      - name: Type check
        run: pnpm typecheck

      - name: Check bundle size budget
        run: pnpm size

  frontend-test:
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@v7

      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6

      - uses: actions/setup-node@v7
        with:
          node-version: "24"
          cache: pnpm
          cache-dependency-path: pnpm-lock.yaml

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Run frontend tests with coverage
        run: pnpm test:coverage

      - name: Upload frontend coverage artifact
        uses: actions/upload-artifact@v7
        with:
          name: frontend-coverage
          path: coverage/lcov.info

  lint:
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@v7

      - uses: actions/setup-python@v6
        with:
          python-version: "3.11"

      # uv is the project's canonical Python package manager (mise pins 0.10.2;
      # `mise run setup` installs via uv). Use it in CI too for parity + speed,
      # and so the lock-sync check below can run `uv pip compile`.
      - uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
        with:
          version: "0.10.2"

      - name: Install lint dependencies
        run: uv pip install --system -r requirements-dev.lock

      - name: Ruff check
        run: ruff check .

      - name: Ruff format check
        run: ruff format --check .

      - name: Basedpyright check
        run: basedpyright

      - name: Check import boundaries
        run: PYTHONPATH=py_modules lint-imports

      - name: Check service-independence contract is complete
        run: python scripts/check_service_independence_contract.py

      - name: Check callable-manifest parity (frontend ↔ backend)
        run: python scripts/check_callable_manifest.py

      - name: Check Cosmic Python call bans
        run: bash scripts/check_cosmic_call_bans.sh

      - name: Check aggregate field-assignment ban
        run: python scripts/check_aggregate_field_assignment.py

      - name: Check UoW-seam nesting ban
        run: python scripts/check_uow_seam_nesting.py

      - name: Check failure-shape dialect gate
        run: python scripts/check_failure_shape.py --check

      - name: Check 404-vs-unreachable classification gate
        run: python scripts/check_404_not_unreachable.py --check

      - name: Check no bare ignores
        run: bash scripts/check_no_bare_ignores.sh

      - name: Check emit↔listener event parity (backend ↔ frontend)
        run: python scripts/check_event_parity.py

      - name: Check settings-owner confinement
        run: python scripts/check_settings_owner.py

      - name: Check sync-lifecycle owner confinement
        run: python scripts/check_sync_lifecycle_owner.py

      - name: Check dependency locks satisfy their source constraints
        run: python scripts/check_lock_sync.py

      - name: Check local markdown links resolve (file + anchor)
        run: python scripts/check_markdown_links.py

      - name: Check stated RomM minimum matches the enforced one
        run: python scripts/check_romm_min_version.py
      # The compiled gavel core ships in the plugin zip and has no source in
      # this repo — a silently swapped binary must fail CI. Verify the vendored
      # .so against its checksum (bumped only by a deliberate native/README.md
      # update when pulling a newer romm-gavel release).
      - name: Check vendored gavel native core checksum
        run: cd py_modules/native && sha256sum -c libgavel-x86_64-linux.so.sha256
      # The BIOS registry ships in the plugin zip and is vendored verbatim from an
      # emu-atlas release — there is no in-tree generator. A hand-edited snapshot
      # must fail CI. Verify the vendored data against its checksum (bumped only by
      # a deliberate defaults/README.md update when pulling a newer emu-atlas release).
      - name: Check vendored BIOS registry checksum
        run: cd defaults && sha256sum -c bios_registry.json.sha256

  # Skipped when SONAR_TOKEN is structurally unavailable: Dependabot PRs and
  # PRs from forks (GitHub withholds secrets from `pull_request` runs whose head
  # is not this repo). SonarSource does not support forked-PR analysis at all, so
  # the scan would only fail auth and block the merge. Sonar still runs on
  # push-to-main, so forked contributions are analysed once they land.
  sonarcloud:
    runs-on: ubuntu-latest
    timeout-minutes: 15
    needs: [test, frontend-test]
    if: >-
      github.actor != 'dependabot[bot]' &&
      (github.event_name != 'pull_request' ||
      github.event.pull_request.head.repo.full_name == github.repository)
    steps:
      - uses: actions/checkout@v7
        with:
          fetch-depth: 0

      - name: Download Python coverage artifact
        uses: actions/download-artifact@v8
        with:
          name: coverage-report

      - name: Download frontend coverage artifact
        uses: actions/download-artifact@v8
        with:
          name: frontend-coverage
          path: coverage

      - name: SonarCloud Scan
        uses: SonarSource/sonarqube-scan-action@22918119ff8e1ca75a623e15c8296b6ea4fbe28f # v8
        env:
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}

  # Branch-protection shim: the `sonarcloud` job is skipped when SONAR_TOKEN is
  # unavailable (Dependabot PRs and forked PRs), and a skipped required check
  # never reports success, which would deadlock those PRs. This gate always
  # reports, passing when SonarCloud succeeded or was skipped and failing only
  # when it failed. Make THIS job the required status check instead of `sonarcloud`.
  sonar-gate:
    runs-on: ubuntu-latest
    timeout-minutes: 5
    needs: [sonarcloud]
    if: always()
    steps:
      - name: Require SonarCloud to pass (skipped on Dependabot / forked PRs)
        env:
          SONAR_RESULT: ${{ needs.sonarcloud.result }}
        run: |
          echo "SonarCloud job result: $SONAR_RESULT"
          if [ "$SONAR_RESULT" = "failure" ] || [ "$SONAR_RESULT" = "cancelled" ]; then
            echo "::error::SonarCloud did not pass"
            exit 1
          fi

  markdownlint:
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
      - uses: actions/checkout@v7

      - uses: DavidAnson/markdownlint-cli2-action@6bf21b07787794f89a243495939cd651942aeabe # v24
        with:
          globs: |
            **/*.md
            !node_modules
            !.worktrees
            !CHANGELOG.md

  markdown-format:
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
      - uses: actions/checkout@v7

      - uses: denoland/setup-deno@22d081ff2d3a40755e97629de92e3bcbfa7cf2ed # v2.0.5
        with:
          deno-version: v2.x

      - name: Check Markdown formatting
        run: deno fmt --check