ci.yml

name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
  workflow_dispatch:

permissions:
  contents: write
  id-token: write
  issues: write
  pull-requests: write

jobs:
  lint:
    name: Lint
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - uses: pnpm/action-setup@v6
      - uses: actions/setup-node@v7
        with:
          node-version-file: .tool-versions
      - run: pnpm install --frozen-lockfile
      # No remote cache configured (would need a TURBO_TOKEN/TURBO_TEAM), so actions/cache is the fallback: it persists turbo's own per-task content hashes across runs so an unchanged task can still skip re-execution here, not just on a developer's machine.
      - uses: actions/cache@v6
        with:
          path: .turbo
          key: turbo-${{ runner.os }}-${{ github.job }}-${{ github.sha }}
          restore-keys: |
            turbo-${{ runner.os }}-${{ github.job }}-
      - run: pnpm run lint

  typecheck:
    name: Typecheck
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - uses: pnpm/action-setup@v6
      - uses: actions/setup-node@v7
        with:
          node-version-file: .tool-versions
      - run: pnpm install --frozen-lockfile
      - uses: actions/cache@v6
        with:
          path: .turbo
          key: turbo-${{ runner.os }}-${{ github.job }}-${{ github.sha }}
          restore-keys: |
            turbo-${{ runner.os }}-${{ github.job }}-
      - run: pnpm run typecheck

  test:
    name: Test
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@v7
      - uses: pnpm/action-setup@v6
      - uses: actions/setup-node@v7
        with:
          node-version-file: .tool-versions
      - run: pnpm install --frozen-lockfile
      - uses: actions/cache@v6
        with:
          path: .turbo
          key: turbo-${{ runner.os }}-${{ github.job }}-${{ github.sha }}
          restore-keys: |
            turbo-${{ runner.os }}-${{ github.job }}-
      - run: pnpm run build
      - run: pnpm test
      - run: pnpm test:delivery
      - run: pnpm test:smoke

  e2e:
    name: E2E
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@v7
      - uses: pnpm/action-setup@v6
      - uses: actions/setup-node@v7
        with:
          node-version-file: .tool-versions
      - run: pnpm install --frozen-lockfile
      - name: Resolve Playwright version
        id: playwright
        run: echo "version=$(pnpm exec playwright --version | awk '{print $2}')" >> "$GITHUB_OUTPUT"
      # Browser binaries are versioned by Playwright itself, so the version is the whole cache key.
      - uses: actions/cache@v6
        id: playwright-browsers
        with:
          path: ~/.cache/ms-playwright
          key: playwright-${{ runner.os }}-${{ steps.playwright.outputs.version }}
      - name: Install Playwright browser and system dependencies
        if: steps.playwright-browsers.outputs.cache-hit != 'true'
        run: pnpm exec playwright install --with-deps chromium
      # The cache holds only the browser download; the OS libraries it needs live outside it and are not restored, so they are installed on every run.
      - name: Install Playwright system dependencies
        if: steps.playwright-browsers.outputs.cache-hit == 'true'
        run: pnpm exec playwright install-deps chromium
      - run: pnpm test:e2e

  mutation:
    name: Mutation Testing (${{ matrix.file }})
    if: github.event_name == 'workflow_dispatch'
    runs-on: ubuntu-latest
    # One job per file instead of one job for all of them: each gets its own runner (its own 4 vCPUs, not shared with the others), so every file's mutants run genuinely in parallel across separate machines rather than sequentially through a single job's own worker pool. The prior single-job run took over an hour and was still going when a too-short timeout cancelled it -- this is the actual fix for that, not just a bigger number. The list grew from the original three files once mesh-store.ts's own logic was split across ten collaborator files -- each now gets its own matrix entry and its own mutation score, matching stryker.config.ts's own mutate list.
    strategy:
      fail-fast: false
      matrix:
        file:
          [
            identity,
            mesh-store,
            wire-mesh-transport,
            agent-registry,
            connection-approval,
            delivery-engine,
            federation-bridge,
            mesh-store-shared,
            peer-lifecycle,
            room-lifecycle,
            room-messaging,
            room-protocol,
            room-wire-extensions,
            stale-agent-checker,
          ]
    # 120 minutes wasn't enough for mesh-store.ts specifically -- it was still running (identity.ts finished in 20 minutes, wire-mesh-transport.ts's own dry run failed in under 2) when that ceiling cancelled it on the first real matrix dispatch. Raised back to the same generous budget the prior single-job run used; a shorter-lived file finishing early costs the other matrix entries nothing, since each runs on its own independent runner.
    timeout-minutes: 240
    steps:
      - uses: actions/checkout@v7
      - uses: pnpm/action-setup@v6
      - uses: actions/setup-node@v7
        with:
          node-version-file: .tool-versions
      - run: pnpm install --frozen-lockfile
      - run: pnpm run build
      - run: pnpm exec stryker run stryker.config.ts --mutate "src/core/${{ matrix.file }}.ts"
      - uses: actions/upload-artifact@v7
        if: always()
        with:
          name: mutation-report-${{ matrix.file }}
          path: reports/mutation/mutation.html
          retention-days: 30

  pages:
    name: GitHub Pages
    if: github.ref == 'refs/heads/main' && github.event_name == 'push'
    needs: [lint, typecheck, test]
    runs-on: ubuntu-latest
    permissions:
      pages: write
      id-token: write
    environment:
      name: github-pages
      url: ${{ steps.deployment.outputs.page_url }}
    steps:
      - uses: actions/checkout@v7
      - uses: pnpm/action-setup@v6
      - uses: actions/setup-node@v7
        with:
          node-version-file: .tool-versions
      - run: pnpm install --frozen-lockfile
      - run: pnpm build:frontend
      - name: Assemble static site
        run: |
          mkdir -p github-pages
          cp src/bridges/user/web/frontend/index.html github-pages/
          cp -r src/bridges/user/web/dist/* github-pages/
      - uses: actions/upload-pages-artifact@v5
        with:
          path: github-pages
      - uses: actions/deploy-pages@v5
        id: deployment

  release:
    name: Release
    if: github.ref == 'refs/heads/main' && github.event_name == 'push'
    needs: [lint, typecheck, test, e2e]
    runs-on: ubuntu-latest
    steps:
      # The release commit is a direct push to main, and main's ruleset requires status checks on every change unless the actor is a bypass actor. The default GITHUB_TOKEN is not one, so the push authenticates as the org-wide "exadev" GitHub App instead, which is an Integration bypass actor on this repository's ruleset. GITHUB_TOKEN stays in the semantic-release env below for creating the GitHub release and commenting on issues and pull requests.
      - name: Generate a token for the release push
        id: app-token
        uses: actions/create-github-app-token@v3
        with:
          client-id: Iv23liLMzahHqi38Qo4c
          private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}
      # The token is left persisted in the checkout's git config: semantic-release first tries the repository URL as it stands and only falls back to token-derived URLs when that push is refused, so persisted App credentials are what its push to main authenticates with.
      - uses: actions/checkout@v7
        with:
          fetch-depth: 0
          token: ${{ steps.app-token.outputs.token }}
      - uses: pnpm/action-setup@v6
      - uses: actions/setup-node@v7
        with:
          node-version-file: .tool-versions
          # Do NOT set registry-url — it creates an .npmrc that overrides OIDC
      - run: pnpm install --frozen-lockfile
      - run: pnpm run build
      - run: HUSKY=0 pnpm exec semantic-release
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}