ci.yml

name: CI


on:
  push:
    branches: ["main"]
  pull_request:

permissions:
  contents: read

# A newer push to the same pull request supersedes the older run. Pushes to
# main never share a group, so each main commit keeps a complete run.
concurrency:
  group: ci-${{ github.event.pull_request.number || github.sha }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

jobs:
  workflow-lint:
    name: Workflow lint
    needs: paths
    if: needs.paths.outputs.workflows == 'true'
    uses: wrightkit/.github/.github/workflows/actionlint.yml@main

  paths:
    name: Detect paths
    runs-on: ubuntu-latest
    timeout-minutes: 5
    outputs:
      rust_core: ${{ steps.filter.outputs.rust_core }}
      dist: ${{ steps.filter.outputs.dist }}
      agent_guide: ${{ steps.filter.outputs.agent_guide }}
      workflows: ${{ steps.filter.outputs.workflows }}
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0

      - name: Check CI job coupling
        run: |
          python3 -m pip install PyYAML==6.0.3
          python3 scripts/ci-jobs.py check
          python3 scripts/test-ci-jobs.py

      - name: Filter paths
        id: filter
        uses: dorny/paths-filter@ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d # v4.0.3
        with:
          filters: |
            workflows:
              - '.github/workflows/**'
            rust_core:
              - 'Cargo.toml'
              - 'Cargo.lock'
              - 'rust-toolchain'
              - 'rust-toolchain.toml'
              - '.cargo/**'
              - 'src/**'
              - 'crates/**'
              - 'tests/fixtures/**'
              - 'scripts/**'
              - 'benchmarks/**'
              - 'agent-guide/**'
              - 'schemas/**'
              - '.github/workflows/**'
            agent_guide:
              - 'agent-guide/**'
              - 'crates/wright-cli/src/agent.rs'
              - 'scripts/sync-agent-guide.py'
              - '.github/workflows/**'
            dist:
              - 'dist/**'
              - 'install.sh'
              - 'install.ps1'
              - 'Cargo.toml'
              - 'Cargo.lock'
              - 'rust-toolchain'
              - 'rust-toolchain.toml'
              - '.cargo/**'
              - 'src/**'
              - 'crates/**'
              - 'tests/fixtures/**'
              - 'scripts/**'
              - '.github/workflows/**'
  agent-guide:
    name: Agent guide sync
    needs: paths
    if: needs.paths.outputs.agent_guide == 'true'
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Checkout skills
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          repository: wrightkit/skills
          fetch-depth: 0
          path: skills-src

      - name: Verify the vendored guide matches its pin
        run: python3 scripts/sync-agent-guide.py --skills-dir skills-src --check

  rust-quality:
    name: Rust (stable)
    needs: paths
    if: needs.paths.outputs.rust_core == 'true'
    uses: wrightkit/.github/.github/workflows/rust-quality.yml@main
    with:
      toolchain: 1.97.1
      cache-shared-key: linux-quality-stable-dev-test
      all-features: true

  wright-cli-build:
    name: Build CLI
    needs: [paths]
    if: needs.paths.outputs.rust_core == 'true'
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Set up Rust
        uses: wrightkit/.github/.github/actions/setup-rust@main
        with:
          toolchain: 1.97.1
          cache-shared-key: linux-quality-stable-dev-test

      - name: Build CLI
        run: cargo build --locked -p wright-cli -p wright-bench

      - name: Upload CLI artifact
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: wright-cli-linux-stable-debug
          path: |
            target/debug/wright
            target/debug/wright-bench
          if-no-files-found: error

      - name: Record CLI provenance
        shell: bash
        run: |
          cli_digest="$(sha256sum target/debug/wright | cut -d ' ' -f1)"
          bench_digest="$(sha256sum target/debug/wright-bench | cut -d ' ' -f1)"
          {
            printf '%s\n\n' '## Wright CLI artifact'
            printf -- "- Revision: \`%s\`\n" "$GITHUB_SHA"
            printf '%s\n' '- Build identity: stable / debug / ubuntu-latest'
            printf -- "- wright SHA-256: \`%s\`\n" "$cli_digest"
            printf -- "- wright-bench SHA-256: \`%s\`\n" "$bench_digest"
          } >> "$GITHUB_STEP_SUMMARY"

  workshop-integration:
    name: Workshop dogfood
    needs: [paths, wright-cli-build]
    if: needs.paths.outputs.rust_core == 'true'
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - name: Checkout Wright
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Checkout workshop-rs
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          repository: wrightkit/workshop-rs
          ref: f1f3c58f790e9aede9300ca6421698f2503f5f62 # v0.3.11
          path: workshop-rs-pinned
          sparse-checkout: crates/workshop-rs/tests/fixtures/real-projects

      - name: Download CLI artifact
        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          name: wright-cli-linux-stable-debug
          path: target/debug

      - name: Prepare CLI executable
        run: chmod +x target/debug/wright

      - name: Run public CLI dogfood
        run: |
          set -euo pipefail

          run_workflow() {
            local command="$1"
            local output
            local status

            set +e
            output="$(target/debug/wright "$command" --kind workshop "$PROJECT" --format json)"
            status=$?
            set -e

            if [[ "$status" -ne "$EXPECTED_EXIT" ]]; then
              echo "wright $command returned $status; expected $EXPECTED_EXIT for $PROJECT" >&2
              return 1
            fi

            jq -e \
              --arg command "$command" \
              --argjson process_exit "$status" \
              '(
                .wright.contract == "wright-result/v1" and
                .command == $command and
                .exit == $process_exit and
                .ok == ($process_exit == 0) and
                (.diagnostics | type == "array") and
                (all(.diagnostics[]; type == "object")) and
                ([.diagnostics[] | select(.stage == "internal")] | length == 0)
              )' <<<"$output" >/dev/null || return 1
            printf '%s' "$output"
          }

          dogfood() {
            local project="$1"
            EXPECTED_EXIT="$2"
            PROJECT="workshop-rs-pinned/crates/workshop-rs/tests/fixtures/real-projects/${project}.ow"
            echo "::group::${project}"

            local check_output lint_output inspect_output
            check_output="$(run_workflow check)" || return 1
            lint_output="$(run_workflow lint)" || return 1
            inspect_output="$(run_workflow inspect)" || return 1
            jq -e -n \
              --argjson check "$check_output" \
              --argjson lint "$lint_output" \
              --argjson inspect "$inspect_output" \
              --argjson expected_exit "$EXPECTED_EXIT" \
              '(
                $check.ok == $lint.ok and
                $check.exit == $lint.exit and
                (if $expected_exit == 0
                 then ($inspect.result.program.rules | numbers | . > 0)
                 else ($lint.diagnostics | length > 0)
                 end)
              )' >/dev/null || return 1
            echo "::endgroup::"
          }

          failed=0
          for entry in ai-pve:0 bastion:0 defend:1 illari:0 rework:0; do
            dogfood "${entry%%:*}" "${entry##*:}" || { echo "::error::dogfood failed for ${entry%%:*}"; failed=1; }
          done
          exit "$failed"

  opy-integration:
    name: Product integration
    needs: [paths, wright-cli-build]
    if: needs.paths.outputs.rust_core == 'true'
    runs-on: ubuntu-latest
    timeout-minutes: 20
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Set up Rust
        uses: wrightkit/.github/.github/actions/setup-rust@main
        with:
          toolchain: 1.97.1
          cache-shared-key: linux-quality-stable-dev-test
      - name: Download CLI artifact
        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          name: wright-cli-linux-stable-debug
          path: target/debug
      - name: Prepare CLI executable
        run: chmod +x target/debug/wright
      - name: Install OPY provider
        run: target/debug/wright update provider opy

      - name: Compile OPY via provider
        run: >-
          target/debug/wright compile tests/fixtures/opy/basic-rule.opy
          -o "$RUNNER_TEMP/basic-rule.ow"

      - name: Run provider-backed CLI tests
        run: cargo test --locked -p wright-cli --test opy_locale_hook

  lpp-integration:
    name: LPP integration
    needs: [paths]
    if: needs.paths.outputs.rust_core == 'true'
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - name: Checkout Wright
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Set up Rust
        uses: wrightkit/.github/.github/actions/setup-rust@main
        with:
          toolchain: 1.97.1
          cache-shared-key: linux-quality-stable-dev-test

      # The mock provider is built from the pinned language-provider-protocol
      # commit the integration tests were validated against (merged LPP v1,
      # PR wrightkit/language-provider-protocol#2 plus docs-only follow-ups).
      - name: Checkout LPP
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          repository: wrightkit/language-provider-protocol
          ref: 416b293e26e6fb2d29061608a493a7aecd2ce14f
          path: language-provider-protocol

      - name: Build mock provider
        run: cargo build --locked -p lpp-mock-provider
        working-directory: language-provider-protocol

      - name: Run LPP tests
        env:
          LPP_MOCK_PROVIDER: ${{ github.workspace }}/language-provider-protocol/target/debug/lpp-mock-provider
        run: |
          set -euo pipefail
          mkdir -p target
          cargo test --locked -p wright-lpp -p wright-driver \
            --test mock_provider --test lpp --test provider_edit -- --ignored | tee target/lpp-tests.log
          awk '/^test result: ok\./ { passed += $4 } END { print "Mock-provider tests passed:", passed; exit !(passed > 0) }' target/lpp-tests.log

  cli-behavior:
    name: CLI behavior
    needs: [paths, wright-cli-build]
    if: needs.paths.outputs.rust_core == 'true'
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Download CLI artifact
        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          name: wright-cli-linux-stable-debug
          path: target/debug

      - name: Prepare CLI executable
        run: chmod +x target/debug/wright

      - name: Test GitHub Actions renderer
        run: scripts/test-cli-github-actions.sh target/debug/wright

  benchmark:
    name: Benchmarks
    continue-on-error: true
    needs: [paths, wright-cli-build]
    if: needs.paths.outputs.rust_core == 'true'
    runs-on: ubuntu-latest
    timeout-minutes: 20
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Download CLI artifact
        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          name: wright-cli-linux-stable-debug
          path: target/debug

      - name: Prepare benchmark executable
        run: chmod +x target/debug/wright-bench

      - name: Run benchmarks
        id: bench
        run: target/debug/wright-bench

      - name: Upload benchmark report
        if: always()
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: benchmark-report
          path: target/wright-bench-report.json

  metrics-shard:
    name: Metrics shard (${{ matrix.shard }})
    needs: [paths, wright-cli-build]
    if: needs.paths.outputs.rust_core == 'true'
    runs-on: ubuntu-latest
    timeout-minutes: 30
    strategy:
      fail-fast: false
      matrix:
        include:
          - shard: workshop
            projects: small-workshop seed-modify-target-score seed-repair-runaway-loop seed-understand-score-flow
          - shard: opy
            projects: seed-modify-opy-project seed-repair-opy-runaway-loop seed-understand-opy-project
          - shard: real
            projects: bastion overwatch-ai-pve
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Download CLI artifact
        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          name: wright-cli-linux-stable-debug
          path: target/debug

      - name: Prepare CLI executable
        run: chmod +x target/debug/wright

      - name: Measure projects
        env:
          PROJECTS: ${{ matrix.projects }}
        run: |
          set -euo pipefail
          target/debug/wright update provider opy
          mkdir -p "$RUNNER_TEMP/metrics-shards"
          for project in $PROJECTS; do
            python3 benchmarks/metrics/metrics.py run --project "$project" \
              --repeats 1 --cli-repeats 1 --jobs 4 --wright target/debug/wright \
              --out "$RUNNER_TEMP/metrics-shards/$project.json"
          done

      - name: Upload shard runs
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: metrics-shard-${{ matrix.shard }}
          path: ${{ runner.temp }}/metrics-shards/*.json
          if-no-files-found: error

  metrics-drift:
    name: Metrics drift
    needs: [paths, metrics-shard]
    if: needs.paths.outputs.rust_core == 'true'
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Download shard runs
        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          pattern: metrics-shard-*
          merge-multiple: true
          path: metrics-shards

      - name: Check agent-facing metrics drift
        run: |
          python3 -m unittest discover -s benchmarks/metrics
          shards=()
          for run in metrics-shards/*.json; do shards+=(--from "$run"); done
          python3 benchmarks/metrics/metrics.py check --skip-latency "${shards[@]}"

  metrics-latency:
    name: Metrics latency (trend)
    needs: [paths, wright-cli-build]
    if: github.event_name == 'push' && needs.paths.outputs.rust_core == 'true'
    runs-on: ubuntu-latest
    timeout-minutes: 30
    continue-on-error: true
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Download CLI artifact
        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          name: wright-cli-linux-stable-debug
          path: target/debug

      - name: Prepare CLI executable
        run: chmod +x target/debug/wright

      - name: Measure latency against the baseline
        run: |
          target/debug/wright update provider opy
          python3 benchmarks/metrics/metrics.py check --wright target/debug/wright --out target/metrics-latency.json

      - name: Upload latency record
        if: always()
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: metrics-latency
          path: target/metrics-latency.json
          if-no-files-found: ignore

  dist-cli-build:
    name: Build dist (${{ matrix.os }})
    needs: [paths]
    if: needs.paths.outputs.dist == 'true'
    runs-on: ${{ matrix.os }}
    timeout-minutes: 30
    strategy:
      fail-fast: false
      matrix:
        os:
          - ubuntu-latest
          - macos-15
          - windows-latest
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Set up Rust
        uses: wrightkit/.github/.github/actions/setup-rust@main
        with:
          toolchain: 1.97.1
          cache-shared-key: dist-build-${{ runner.os }}-stable-dev
          cache-save: ${{ github.ref == 'refs/heads/main' }}

      - name: Build CLI and LSP
        shell: bash
        run: cargo build --locked -p wright-cli -p wright-lsp

      - name: Upload distribution binaries
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: wright-dist-cli-${{ matrix.os }}
          path: |
            target/debug/wright
            target/debug/wright.exe
            target/debug/wright-lsp
            target/debug/wright-lsp.exe
          if-no-files-found: error

  dist-validation:
    name: Dist validation (${{ matrix.channel }}, ${{ matrix.os }})
    needs: [paths, dist-cli-build]
    if: needs.paths.outputs.dist == 'true'
    runs-on: ${{ matrix.os }}
    timeout-minutes: 20
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: ubuntu-latest
            channel: install.sh
          - os: macos-15
            channel: install.sh
          - os: macos-15
            channel: Homebrew
          - os: windows-latest
            channel: install.ps1
          - os: windows-latest
            channel: Scoop
          - os: windows-latest
            channel: WinGet
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Set up Python
        uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
        with:
          python-version: "3.12"

      - name: Install Scoop
        if: matrix.channel == 'Scoop'
        shell: pwsh
        run: ./scripts/setup-scoop.ps1

      - name: Enable WinGet local manifests
        if: matrix.channel == 'WinGet'
        shell: pwsh
        run: winget settings --enable LocalManifestFiles

      - name: Download distribution binaries
        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          name: wright-dist-cli-${{ matrix.os }}
          path: target/debug

      - name: Prepare distribution executables
        if: runner.os != 'Windows'
        run: chmod +x target/debug/wright target/debug/wright-lsp

      - name: Validate package metadata and installers
        if: matrix.channel == 'install.sh' || matrix.channel == 'install.ps1'
        run: python scripts/verify-dist.py

      - name: Test install.sh (functional)
        if: matrix.channel == 'install.sh'
        run: scripts/test-install.sh
      - name: Test install.sh (native smoke)
        if: matrix.channel == 'install.sh'
        run: python scripts/test-distribution-install-sh.py
      - name: Test install.ps1 (channel)
        if: matrix.channel == 'install.ps1'
        shell: pwsh
        run: ./scripts/test-install.ps1
      - name: Test install.ps1 (R2 smoke)
        if: matrix.channel == 'install.ps1'
        shell: pwsh
        run: ./scripts/test-install-r2.ps1
      - name: Test Homebrew channel
        if: matrix.channel == 'Homebrew'
        run: python scripts/test-distribution-homebrew.py
      - name: Test Scoop channel
        if: matrix.channel == 'Scoop'
        run: python scripts/test-distribution-scoop.py
      - name: Test WinGet channel
        if: matrix.channel == 'WinGet'
        run: python scripts/test-distribution-winget.py

  wasm-core:
    name: Wasm core
    needs: paths
    if: needs.paths.outputs.rust_core == 'true'
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Set up Rust
        uses: wrightkit/.github/.github/actions/setup-rust@main
        with:
          toolchain: 1.97.1
          targets: wasm32-unknown-unknown
          cache-shared-key: wasm-release
          cache-save: ${{ github.ref == 'refs/heads/main' }}

      - name: Set up Node
        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
        with:
          node-version: 24
          cache: npm
          cache-dependency-path: scripts/package-lock.json

      - name: Check generated core types are fresh
        run: |
          npm ci --prefix scripts
          npm --prefix scripts run typecheck
          node scripts/generate-core-types.ts --check

      - name: Build the wasm core and the native parity driver
        run: |
          cargo build --locked --release --target wasm32-unknown-unknown -p wright-wasm --lib
          cargo build --locked --release -p wright-wasm --bin wright-core-parity

      # Native/wasm response-body parity over the ten agent operations,
      # the ADR-0037 apply round-trip + stale refusal, the capability
      # refusals, and the 2048 KiB gzipped size budget.
      - name: Run wasm core parity and budget checks
        run: node crates/wright-wasm/js/wright-core.test.mjs

  ci-result:
    name: CI result
    if: always()
    needs:
      - paths
      - workflow-lint
      - rust-quality
      - wright-cli-build
      - workshop-integration
      - opy-integration
      - lpp-integration
      - cli-behavior
      - metrics-shard
      - metrics-drift
      - dist-cli-build
      - dist-validation
      - agent-guide
      - wasm-core
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Fail on failed, cancelled, or wrongly skipped jobs
        env:
          NEEDS: ${{ toJSON(needs) }}
          PATHS: ${{ toJSON(needs.paths.outputs) }}
        run: |
          python3 -m pip install PyYAML==6.0.3
          python3 scripts/ci-jobs.py result