ci.yml

name: ci

env:
  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true

on:
  push:
    branches:
      - main
  pull_request:
  workflow_dispatch:

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: read

jobs:
  js-checks:
    runs-on: ubuntu-latest
    env:
      RUNX_SKILL_VERSION_BASE: ${{ github.event.pull_request.base.sha || github.event.before }}
    steps:
      - name: Checkout
        uses: actions/checkout@v7
        with:
          fetch-depth: 0

      - name: Setup pnpm
        uses: pnpm/action-setup@v6
        with:
          version: 10.18.2

      - name: Setup Node
        uses: actions/setup-node@v7
        with:
          node-version: 24
          cache: pnpm
          cache-dependency-path: pnpm-lock.yaml

      - name: Restore check caches
        uses: actions/cache@v6
        with:
          path: |
            node_modules/.cache/tsc
            .build
          key: ${{ runner.os }}-oss-checks-${{ hashFiles('pnpm-lock.yaml', 'package.json', 'tsconfig*.json', 'packages/**/tsconfig.json', 'packages/**/package.json') }}
          restore-keys: |
            ${{ runner.os }}-oss-checks-

      - name: Setup Rust
        run: rustup show

      - name: Cargo cache
        # verify:fast builds the debug runx + fixture-oracle binaries; without this
        # cache the whole dependency tree recompiles cold on every run.
        uses: Swatinem/rust-cache@v2
        with:
          workspaces: crates

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Verify
        run: pnpm verify:fast

      - name: Verify fast plan coverage
        run: pnpm verify:fast:plan-check

  demo-checks:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v7

      - name: Setup pnpm
        uses: pnpm/action-setup@v6
        with:
          version: 10.18.2

      - name: Setup Node
        uses: actions/setup-node@v7
        with:
          node-version: 24
          cache: pnpm
          cache-dependency-path: pnpm-lock.yaml

      - name: Restore check caches
        uses: actions/cache@v6
        with:
          path: |
            node_modules/.cache/tsc
            .build
          key: ${{ runner.os }}-oss-checks-${{ hashFiles('pnpm-lock.yaml', 'package.json', 'tsconfig*.json', 'packages/**/tsconfig.json', 'packages/**/package.json') }}
          restore-keys: |
            ${{ runner.os }}-oss-checks-

      - name: Setup Rust
        run: rustup show

      - name: Cargo cache
        # test:heavy:graph builds the debug runx binary via test-workspace.mjs;
        # without this cache the whole dependency tree recompiles cold on every run.
        uses: Swatinem/rust-cache@v2
        with:
          workspaces: crates

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Demo and local payment dogfood
        run: |
          pnpm demos:check
          pnpm x402:dogfood:local

      - name: Heavy graph Vitest
        run: pnpm test:heavy:graph

  rust-checks:
    runs-on: ubuntu-latest
    env:
      CARGO_INCREMENTAL: "0"
    steps:
      - name: Checkout
        uses: actions/checkout@v7

      - name: Setup Node
        uses: actions/setup-node@v7
        with:
          node-version: 24

      - name: Setup Rust
        run: rustup show

      - name: Setup Rust nightly
        uses: dtolnay/rust-toolchain@nightly
        with:
          components: rustfmt, clippy

      - name: Install Rust test and advisory tools
        uses: taiki-e/install-action@v2.85.5
        with:
          # Prebuilt binaries instead of compiling from source on every cache miss.
          # cargo-public-api is snapshot-sensitive; keep this in sync with
          # scripts/check-rust-kernel-parity.mjs.
          tool: cargo-nextest,cargo-deny,cargo-public-api@0.51.0

      - name: Cargo cache
        # Same Rust-aware cache the cloud workflow uses for oss/crates: keys on the
        # lockfile and rustc version and prunes stale artifacts, so the target tree
        # does not bloat the cache (it grew to ~183GB locally under the old scheme).
        uses: Swatinem/rust-cache@v2
        with:
          workspaces: crates

      - name: Rust checks
        working-directory: crates
        run: |
          cargo fmt --all --check
          cargo clippy --workspace --all-targets --all-features -- -D warnings
          cargo nextest run --workspace --all-features --no-fail-fast
          # nextest does not run doctests; runx-contracts (fingerprint), runx-parser
          # (yaml), and runx-sdk (command) carry doctests, so keep this gated.
          cargo test --workspace --all-features --doc
          cargo package -p runx-cli --list

      - name: License boundary guard
        run: |
          node scripts/check-license-edges.mjs --check manifest-complete
          node scripts/check-license-edges.mjs --check identifiers
          cargo metadata --manifest-path crates/Cargo.toml --format-version 1 | node scripts/check-license-edges.mjs --check edges

      - name: Cargo policy
        run: cargo deny --manifest-path crates/Cargo.toml check advisories bans licenses sources

      - name: Rust public API snapshot
        run: node scripts/check-rust-kernel-parity.mjs --api-only

  skill-harness:
    # One catalog-wide behavioral sweep. Skill Lab is the sole authoring path,
    # so there is no parallel template-generator smoke lane.
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v7
      - name: Setup pnpm
        uses: pnpm/action-setup@v6
        with:
          version: 10.18.2
      - name: Setup Node
        uses: actions/setup-node@v7
        with:
          node-version: 24
          cache: pnpm
          cache-dependency-path: pnpm-lock.yaml
      - name: Setup Rust
        run: rustup show
      - name: Install workspace dependencies
        run: pnpm install --frozen-lockfile
      - name: Build workspace packages
        run: node scripts/build-workspace.mjs
      - name: Cargo cache
        uses: Swatinem/rust-cache@v2
        with:
          workspaces: crates
      - name: Build runtime binaries
        working-directory: crates
        run: |
          cargo build -p runx-cli
          cargo build -p runx-js-worker
      - name: Audit official skill operator value
        run: node scripts/audit-core-skills.mjs --check --json
      - name: Catalog harness sweep
        # The official lock is the catalog source of truth. The sweep fails on
        # every unallowed harness failure, so a duplicate hard-coded skill count
        # would only drift from that owner.
        env:
          RUNX_RECEIPT_SIGN_KID: ci-skill-harness
          RUNX_RECEIPT_SIGN_ED25519_SEED_BASE64: QkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkI=
          RUNX_RECEIPT_SIGN_ISSUER_TYPE: hosted
        run: |
          set -euo pipefail
          node scripts/harness-sweep.mjs \
            --runx-bin crates/target/debug/runx --no-build

  windows-process-lifecycle:
    # The Windows Job Object boundary cannot be proved by Linux emulation.
    # Keep this lane deliberately narrow: two runtime ownership tests and the
    # platform watchdog self-test, not another workspace-wide matrix build.
    runs-on: windows-latest
    timeout-minutes: 8
    steps:
      - name: Checkout
        uses: actions/checkout@v7
      - name: Setup Node
        uses: actions/setup-node@v7
        with:
          node-version: 24
      - name: Setup Rust
        run: rustup show
      - name: Cargo cache
        uses: Swatinem/rust-cache@v2
        with:
          workspaces: crates
      - name: Prove Windows process-tree ownership
        working-directory: crates
        run: cargo test -p runx-runtime --features cli-tool,mcp windows_ -- --test-threads=1 --nocapture
      - name: Prove watchdog timeout semantics
        run: node scripts/harness-sweep.mjs --self-test

  checks:
    runs-on: ubuntu-latest
    needs:
      - js-checks
      - demo-checks
      - rust-checks
      - skill-harness
      - windows-process-lifecycle
    steps:
      - name: Done
        run: echo "All CI lanes passed."