ci.yml

name: CI

on:
  push:
    branches: [main]
  pull_request:

concurrency:
  group: ci-${{ github.ref }}
  cancel-in-progress: true

jobs:
  check:
    # macOS only: the microphone grant, the menu-bar shell and the push path are
    # all macOS-shaped (see docs/adr/0005).
    runs-on: macos-latest
    # A hung test reads as `pending`, never as `failure`, so without a ceiling
    # it holds a macOS runner — 10x billing — until GitHub's own 6h limit. One
    # did, for 26h49m, before #65 was raised. Every healthy job here has
    # finished in 64-125s, so 15 minutes is roughly seven times the slowest and
    # still turns a hang into a fast red.
    timeout-minutes: 15
    strategy:
      fail-fast: false
      matrix:
        python-version: ["3.12", "3.13"]

    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-python@v5
        with:
          python-version: ${{ matrix.python-version }}

      - name: Install
        run: python -m pip install --upgrade pip && python -m pip install -e '.[dev]'

      - name: Lint
        run: ruff check .

      - name: Format
        run: ruff format --check .

      - name: Test
        run: pytest

  shell:
    # The menu-bar shell, checked in its own job so a Swift failure reads as a
    # Swift failure. "The shell builds" is #11's own acceptance, and this is
    # where that sentence is proved — leaving it to the packaging ticket would
    # mean main could break the shell and the packaging ticket would be the one
    # to find out.
    runs-on: macos-latest
    timeout-minutes: 15  # why 15: see the `check` job.

    steps:
      - uses: actions/checkout@v4

      - name: Build
        run: swift build --package-path shell

      # swift-testing is an explicit test-only dependency, because a checkout
      # with only the Command Line Tools has neither it nor XCTest in the
      # toolchain. `--disable-xctest` is what makes that the harness that runs.
      - name: Test
        run: swift test --package-path shell --disable-xctest

      - name: Format
        run: |
          cd shell
          swift format lint --recursive --strict Sources Tests Package.swift

  bundle:
    # The app bundle, built and signed for real. A runner has no microphone, so
    # the one thing this cannot prove is the grant — that is a person with a
    # mouse (scripts/microphone_grant_proof.py). Everything else is here:
    # fetching the pinned interpreter, installing the hash-pinned wheels,
    # pre-compiling, signing ~85 Mach-O files inside out, verifying, and running
    # the bundled bridgectl from a path the bundle was not built at.
    #
    # Signing is ad-hoc, which is exactly what v0 ships — a self-signed
    # certificate in a temporary keychain would test a path the product does not
    # use. "Throwaway identity" is read as "no Developer ID", and ad-hoc is that.
    #
    # The plan tests in the `check` job run against a fixture tree and are fast;
    # this runs against the real wheel set. They are complements: a plan that is
    # right about a fixture and wrong about `av`'s eighteen dylibs is precisely
    # the gap the plan/do split exists to close.
    runs-on: macos-latest
    timeout-minutes: 15  # why 15: see the `check` job.

    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-python@v5
        with:
          python-version: "3.12"

      # Keyed on both inputs the bundle's contents are pinned by, so a cache hit
      # can only ever be the interpreter the checksum names.
      - name: Cache the pinned interpreter
        uses: actions/cache@v4
        with:
          path: shell/.build/cache
          key: pbs-${{ hashFiles('app_bundle/inputs.py', 'app_bundle/locks/*.lock') }}

      - name: Build and sign
        run: scripts/build-app.sh

      - name: Say what was signed
        run: codesign --display --verbose=2 shell/.build/GPT-VoiceCoding.app