smoke.yml

name: smoke

# Native smoke harness — runs the real netclaw / netclawd binaries natively
# (no Docker for the binary) against a native Ollama process.
#
# Runs on every PR to dev (Linux + macOS legs in parallel), on dev pushes,
# and nightly. The `Native Smoke (Linux)` + `Screenshot Regression (Linux)`
# checks gate merges. The macOS leg runs alongside them — it is the
# regression guard for Apple-Silicon-specific bugs (e.g. #1036) — and is
# non-required during its burn-in (see issue #1068). Scheduled-run failures
# surface via GitHub's built-in Actions notifications.

on:
  # Merge queues test a synthetic merge group rather than the pull request ref.
  # Required checks must subscribe to this event or queued PRs will never merge.
  merge_group:
    types:
      - checks_requested
  workflow_dispatch:
  schedule:
    # 07:00 UTC daily — catches external-dependency drift during quiet
    # stretches (Ollama model digests, the Homebrew vhs version).
    # NOTE: scheduled runs only fire from the repository's default branch.
    - cron: '0 7 * * *'
  push:
    branches:
      - dev
      - feature/*
  pull_request:
    branches:
      - dev
      - feature/*
    types:
      - opened
      - synchronize
      - reopened

concurrency:
  group: smoke-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true

permissions:
  contents: read

jobs:
  publish:
    name: Publish native binaries (${{ matrix.rid }})
    runs-on: ${{ matrix.os }}
    timeout-minutes: 20

    strategy:
      fail-fast: false
      matrix:
        include:
          - os: ubuntu-latest
            rid: linux-x64
          - os: macos-26
            rid: osx-arm64

    steps:
      - name: Checkout
        uses: actions/checkout@v7

      - name: Install .NET SDK
        uses: actions/setup-dotnet@v6
        with:
          global-json-file: ./global.json

      - name: Publish binaries
        shell: bash
        run: |
          chmod +x scripts/build/publish-binaries.sh
          scripts/build/publish-binaries.sh \
            --rid ${{ matrix.rid }} --component all --output-dir ./publish

      # The mcp-setup scenario registers this as a stdio MCP server. Published
      # self-contained single-file so the SDK-less smoke job can run it.
      - name: Publish smoke MCP server
        shell: bash
        run: >
          dotnet publish tests/Netclaw.SmokeMcpServer
          -c Release -r ${{ matrix.rid }} --self-contained /p:PublishSingleFile=true
          -o ./publish/mcp-server

      - name: Upload binary artifact
        uses: actions/upload-artifact@v7
        with:
          name: netclaw-native-binaries-${{ matrix.rid }}-${{ github.run_id }}-${{ github.run_attempt }}
          path: |
            publish/cli/netclaw
            publish/daemon/netclawd
            publish/mcp-server/Netclaw.SmokeMcpServer
          retention-days: 1
          if-no-files-found: error

  smoke-linux:
    name: Native Smoke (Linux)
    needs: publish
    runs-on: ubuntu-latest
    timeout-minutes: 45

    env:
      SMOKE_OLLAMA_MODEL: qwen2:0.5b
      SMOKE_OLLAMA_ALT_MODEL: all-minilm:latest

    steps:
      - name: Checkout
        uses: actions/checkout@v7

      - name: Download binary artifact
        uses: actions/download-artifact@v8
        with:
          name: netclaw-native-binaries-linux-x64-${{ github.run_id }}-${{ github.run_attempt }}
          path: ./publish

      - name: Mark binaries executable
        run: |
          chmod +x publish/cli/netclaw publish/daemon/netclawd publish/mcp-server/Netclaw.SmokeMcpServer
          echo "NETCLAW_SMOKE_CLI=$(pwd)/publish/cli/netclaw" >> "$GITHUB_ENV"
          echo "NETCLAW_SMOKE_DAEMON=$(pwd)/publish/daemon/netclawd" >> "$GITHUB_ENV"
          echo "NETCLAW_SMOKE_MCP_SERVER=$(pwd)/publish/mcp-server/Netclaw.SmokeMcpServer" >> "$GITHUB_ENV"

      - name: Run native smoke (light)
        shell: bash
        run: |
          mkdir -p smoke-logs
          set -o pipefail
          scripts/smoke/run-smoke.sh light 2>&1 | tee smoke-logs/run-smoke.log

      - name: Upload smoke artifacts
        if: always()
        uses: actions/upload-artifact@v7
        with:
          name: smoke-native-logs-linux-${{ github.run_id }}-${{ github.run_attempt }}
          path: smoke-logs
          if-no-files-found: warn

  smoke-macos:
    name: Native Smoke (macOS)
    needs: publish
    runs-on: macos-26
    timeout-minutes: 45

    env:
      SMOKE_OLLAMA_MODEL: qwen2:0.5b
      SMOKE_OLLAMA_ALT_MODEL: all-minilm:latest

    steps:
      - name: Checkout
        uses: actions/checkout@v7

      - name: Download binary artifact
        uses: actions/download-artifact@v8
        with:
          name: netclaw-native-binaries-osx-arm64-${{ github.run_id }}-${{ github.run_attempt }}
          path: ./publish

      - name: Mark binaries executable
        run: |
          chmod +x publish/cli/netclaw publish/daemon/netclawd publish/mcp-server/Netclaw.SmokeMcpServer
          echo "NETCLAW_SMOKE_CLI=$(pwd)/publish/cli/netclaw" >> "$GITHUB_ENV"
          echo "NETCLAW_SMOKE_DAEMON=$(pwd)/publish/daemon/netclawd" >> "$GITHUB_ENV"
          echo "NETCLAW_SMOKE_MCP_SERVER=$(pwd)/publish/mcp-server/Netclaw.SmokeMcpServer" >> "$GITHUB_ENV"

      # Screenshots stay Linux-only (VHS renders identically across OSes); the
      # macOS leg runs the flow tapes + scenarios, which assert on exit codes.
      - name: Run native smoke (light)
        shell: bash
        run: |
          mkdir -p smoke-logs
          set -o pipefail
          scripts/smoke/run-smoke.sh light 2>&1 | tee smoke-logs/run-smoke.log

      - name: Upload smoke artifacts
        if: always()
        uses: actions/upload-artifact@v7
        with:
          name: smoke-native-logs-macos-${{ github.run_id }}-${{ github.run_attempt }}
          path: smoke-logs
          if-no-files-found: warn

  screenshots:
    name: Screenshot Regression (Linux)
    needs: publish
    runs-on: ubuntu-latest
    timeout-minutes: 45

    env:
      SMOKE_OLLAMA_MODEL: qwen2:0.5b
      SMOKE_OLLAMA_ALT_MODEL: all-minilm:latest

    steps:
      - name: Checkout
        uses: actions/checkout@v7

      - name: Download binary artifact
        uses: actions/download-artifact@v8
        with:
          name: netclaw-native-binaries-linux-x64-${{ github.run_id }}-${{ github.run_attempt }}
          path: ./publish

      - name: Install ImageMagick
        run: sudo apt-get install -y --no-install-recommends imagemagick

      - name: Mark binaries executable
        run: |
          chmod +x publish/cli/netclaw publish/daemon/netclawd publish/mcp-server/Netclaw.SmokeMcpServer
          echo "NETCLAW_SMOKE_CLI=$(pwd)/publish/cli/netclaw" >> "$GITHUB_ENV"
          echo "NETCLAW_SMOKE_DAEMON=$(pwd)/publish/daemon/netclawd" >> "$GITHUB_ENV"
          echo "NETCLAW_SMOKE_MCP_SERVER=$(pwd)/publish/mcp-server/Netclaw.SmokeMcpServer" >> "$GITHUB_ENV"

      - name: Run screenshot regression
        shell: bash
        run: |
          mkdir -p smoke-logs
          set -o pipefail
          scripts/smoke/run-smoke.sh screenshots 2>&1 | tee smoke-logs/run-screenshots.log

      - name: Upload screenshot artifacts
        # Always upload so a missing/changed baseline run leaves the
        # actual/diff/candidate PNGs for a human to review and commit.
        if: always()
        uses: actions/upload-artifact@v7
        with:
          name: smoke-screenshots-${{ github.run_id }}-${{ github.run_attempt }}
          path: smoke-logs
          if-no-files-found: warn