ci.yml

name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

env:
  NODE_VERSION: 22

jobs:
  # ─────────────────────────────────────────────
  # Setup & Install
  # ─────────────────────────────────────────────
  install:
    name: Install Dependencies
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup pnpm
        uses: pnpm/action-setup@v4

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: 'pnpm'

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Save pnpm store
        uses: actions/cache@v4
        with:
          path: |
            ~/.local/share/pnpm/store
            node_modules
          key: ${{ runner.os }}-pnpm-${{ hashFiles('pnpm-lock.yaml') }}

  # ─────────────────────────────────────────────
  # Security Audit
  # ─────────────────────────────────────────────
  audit:
    name: Security Audit
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup pnpm
        uses: pnpm/action-setup@v4

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: 'pnpm'

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Audit dependencies
        run: pnpm audit --audit-level moderate

  # ─────────────────────────────────────────────
  # Code Format Check
  # ─────────────────────────────────────────────
  format:
    name: Code Format
    runs-on: ubuntu-latest
    needs: install
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup pnpm
        uses: pnpm/action-setup@v4

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: 'pnpm'

      - name: Restore dependencies
        uses: actions/cache@v4
        with:
          path: |
            ~/.local/share/pnpm/store
            node_modules
          key: ${{ runner.os }}-pnpm-${{ hashFiles('pnpm-lock.yaml') }}

      - name: Check formatting
        run: pnpm biome format --write . && git diff --exit-code

  # ─────────────────────────────────────────────
  # Lint
  # ─────────────────────────────────────────────
  lint:
    name: Lint
    runs-on: ubuntu-latest
    needs: install
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup pnpm
        uses: pnpm/action-setup@v4

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: 'pnpm'

      - name: Restore dependencies
        uses: actions/cache@v4
        with:
          path: |
            ~/.local/share/pnpm/store
            node_modules
          key: ${{ runner.os }}-pnpm-${{ hashFiles('pnpm-lock.yaml') }}

      - name: Lint
        run: pnpm lint

  # ─────────────────────────────────────────────
  # Type Check
  # ─────────────────────────────────────────────
  typecheck:
    name: Type Check
    runs-on: ubuntu-latest
    needs: install
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup pnpm
        uses: pnpm/action-setup@v4

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: 'pnpm'

      - name: Restore dependencies
        uses: actions/cache@v4
        with:
          path: |
            ~/.local/share/pnpm/store
            node_modules
          key: ${{ runner.os }}-pnpm-${{ hashFiles('pnpm-lock.yaml') }}

      - name: Link workspace packages
        run: pnpm install --frozen-lockfile --prefer-offline

      - name: Type check
        run: pnpm typecheck

  # ─────────────────────────────────────────────
  # Build
  # ─────────────────────────────────────────────
  build:
    name: Build
    runs-on: ubuntu-latest
    needs: [lint, typecheck]
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup pnpm
        uses: pnpm/action-setup@v4

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: 'pnpm'

      - name: Restore dependencies
        uses: actions/cache@v4
        with:
          path: |
            ~/.local/share/pnpm/store
            node_modules
          key: ${{ runner.os }}-pnpm-${{ hashFiles('pnpm-lock.yaml') }}

      - name: Install dependencies
        run: pnpm install --frozen-lockfile --prefer-offline

      - name: Build
        run: pnpm build

      - name: Verify build output
        run: |
          for pkg in packages/*/dist; do
            [ -d "$pkg" ] || continue
            echo "Verified: $pkg"
          done

      - name: Upload build artifacts
        uses: actions/upload-artifact@v4
        with:
          name: build-dist
          path: packages/*/dist
          retention-days: 1

  # ─────────────────────────────────────────────
  # Test
  # ─────────────────────────────────────────────
  test:
    name: Test
    runs-on: ubuntu-latest
    needs: build
    strategy:
      fail-fast: false
      matrix:
        node-version: [20, 22]
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup pnpm
        uses: pnpm/action-setup@v4

      - name: Setup Node.js ${{ matrix.node-version }}
        uses: actions/setup-node@v4
        with:
          node-version: ${{ matrix.node-version }}
          cache: 'pnpm'

      - name: Install dependencies
        run: pnpm install --frozen-lockfile --prefer-offline

      - name: Download build artifacts
        uses: actions/download-artifact@v4
        with:
          name: build-dist
          path: packages

      - name: Run tests
        run: pnpm test

  # ─────────────────────────────────────────────
  # Coverage
  # ─────────────────────────────────────────────
  coverage:
    name: Coverage
    runs-on: ubuntu-latest
    needs: build
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup pnpm
        uses: pnpm/action-setup@v4

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: 'pnpm'

      - name: Install dependencies
        run: pnpm install --frozen-lockfile --prefer-offline

      - name: Download build artifacts
        uses: actions/download-artifact@v4
        with:
          name: build-dist
          path: packages

      - name: Run tests with coverage
        run: pnpm test:coverage

      - name: Upload coverage to Codecov
        uses: codecov/codecov-action@v4
        with:
          files: ./coverage/lcov.info
          fail_ci_if_error: false

      - name: Upload coverage reports
        uses: actions/upload-artifact@v4
        with:
          name: coverage-reports
          path: coverage
          retention-days: 7

      - name: Post coverage summary
        if: always()
        run: |
          if [ -f coverage/coverage-summary.json ]; then
            lines=$(jq -r '.total.lines.pct // "N/A"' coverage/coverage-summary.json)
            funcs=$(jq -r '.total.functions.pct // "N/A"' coverage/coverage-summary.json)
            branches=$(jq -r '.total.branches.pct // "N/A"' coverage/coverage-summary.json)
            echo '## Test Coverage Summary' >> $GITHUB_STEP_SUMMARY
            echo "| Metric | Coverage |" >> $GITHUB_STEP_SUMMARY
            echo "|--------|----------|" >> $GITHUB_STEP_SUMMARY
            echo "| Lines | $lines% |" >> $GITHUB_STEP_SUMMARY
            echo "| Functions | $funcs% |" >> $GITHUB_STEP_SUMMARY
            echo "| Branches | $branches% |" >> $GITHUB_STEP_SUMMARY
          fi

  # ─────────────────────────────────────────────
  # Docker Build
  # ─────────────────────────────────────────────
  docker-build:
    name: Docker Build
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Build Docker image
        uses: docker/build-push-action@v6
        with:
          context: .
          file: docker/Dockerfile
          push: false
          tags: agent-eval-harness:${{ github.sha }}
          cache-from: type=gha
          cache-to: type=gha,mode=max

  # ─────────────────────────────────────────────
  # Docker Compose Validate
  # ─────────────────────────────────────────────
  docker-compose:
    name: Docker Compose
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Validate Docker Compose
        run: docker compose -f docker/docker-compose.yml config

  # ─────────────────────────────────────────────
  # Agent Eval Suite
  # ─────────────────────────────────────────────
  eval:
    name: Agent Eval
    needs: build
    uses: ./.github/workflows/eval.yml
    permissions:
      contents: read
      pull-requests: write
      issues: write
    secrets: inherit

  # ─────────────────────────────────────────────
  # All Checks Passed
  # ─────────────────────────────────────────────
  all-checks:
    name: All Checks Passed
    runs-on: ubuntu-latest
    needs:
      [audit, format, lint, typecheck, build, test, coverage, docker-build, docker-compose, eval]
    if: always()
    steps:
      - name: Check all jobs passed
        run: |
          check() {
            if [ "$1" != "success" ]; then
              echo "$2 did not succeed: $1"
              exit 1
            fi
          }
          check '${{ needs.audit.result }}' 'Security Audit'
          check '${{ needs.format.result }}' 'Code Format'
          check '${{ needs.lint.result }}' 'Lint'
          check '${{ needs.typecheck.result }}' 'Type Check'
          check '${{ needs.build.result }}' 'Build'
          check '${{ needs.test.result }}' 'Test'
          check '${{ needs.coverage.result }}' 'Coverage'
          check '${{ needs.docker-build.result }}' 'Docker Build'
          check '${{ needs.docker-compose.result }}' 'Docker Compose'
          check '${{ needs.eval.result }}' 'Agent Eval'
          echo "All checks passed!"