ci.yml

name: CI

on:
  push:
  pull_request:

permissions:
  contents: read

jobs:
  javascript:
    name: JavaScript
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
        with:
          node-version-file: package.json
          cache: npm
      - run: npm ci
      - run: npm run typecheck
      - run: npm run lint:gate
      - run: npm test
        # The CORE_MANIFEST <-> API_PREFIXES drift gate and the other
        # managed-toolchain suites need no secrets, only this opt-in. Without
        # it six suites skip and the drift they guard ships unnoticed.
        env:
          BLITZDEV_MANAGED: "1"

  lody-daemon:
    name: Lody daemon pair gate
    runs-on: ubuntu-latest
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
        with:
          fetch-depth: 0
      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
        with:
          node-version: 22.20.0
          cache: npm
      - name: Enable Corepack
        run: |
          mkdir -p "$RUNNER_TEMP/corepack-bin"
          corepack enable --install-directory "$RUNNER_TEMP/corepack-bin"
          echo "$RUNNER_TEMP/corepack-bin" >> "$GITHUB_PATH"
      - name: Locate the pnpm store
        id: pnpm-store
        working-directory: vendor/lody
        run: echo "path=$(corepack pnpm store path --silent)" >> "$GITHUB_OUTPUT"
      - name: Cache the Lody pnpm store
        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
        with:
          path: ${{ steps.pnpm-store.outputs.path }}
          key: lody-pnpm-${{ runner.os }}-${{ hashFiles('vendor/lody/pnpm-lock.yaml') }}
          restore-keys: lody-pnpm-${{ runner.os }}-
      - run: npm ci
      - name: Authenticate adapter snapshots against upstream
        run: node scripts/lody-sync-adapters.mjs --check --fetch
      - name: Build and stamp the tree daemon
        run: node scripts/lody-build-package.mjs --out "$RUNNER_TEMP/lody-artifact" --scratch "$RUNNER_TEMP/lody-scratch"
      - name: Run the ported daemon seam tests against the built tree
        working-directory: ${{ runner.temp }}/lody-scratch/lody/apps/cli
        run: |
          corepack pnpm exec vitest run \
            src/lib/message-processor.test.ts \
            src/agent/agent-client-session-preparation.test.ts \
            tests/session-execution-helpers.test.ts \
            tests/session-sandbox.test.ts
      - name: Install the daemon artifact and Claude CLI
        run: |
          mapfile -t tarballs < <(find "$RUNNER_TEMP/lody-artifact" -maxdepth 1 -type f -name 'lody-*.tgz' -print)
          test "${#tarballs[@]}" -eq 1
          tarball=${tarballs[0]}
          npm install --global --prefix "$RUNNER_TEMP/lody-install" --omit=dev @anthropic-ai/claude-code@latest
          mkdir -p "$RUNNER_TEMP/lody-install/lib/node_modules" "$RUNNER_TEMP/lody-unpack"
          tar -xzf "$tarball" -C "$RUNNER_TEMP/lody-unpack"
          mv "$RUNNER_TEMP/lody-unpack/package" "$RUNNER_TEMP/lody-install/lib/node_modules/lody"
          npm ci --prefix "$RUNNER_TEMP/lody-install/lib/node_modules/lody" --omit=dev
          echo "LODY_BUNDLE=$RUNNER_TEMP/lody-install/lib/node_modules/lody" >> "$GITHUB_ENV"
          echo "LODY_CLAUDE_BINARY=$RUNNER_TEMP/lody-install/bin/claude" >> "$GITHUB_ENV"
      - name: Run every non-probe daemon harness consumer
        env:
          LODY_REQUIRE_BUNDLE: "1"
        run: |
          test -f "$LODY_BUNDLE/dist/index.js"
          mapfile -t pair_tests < <(grep -rl --include='*.test.ts' --include='*.test.tsx' \
            'lody-daemon-harness' test | grep -v '\.probe\.' | sort)
          test "${#pair_tests[@]}" -gt 0
          npx vitest run --maxWorkers=1 "${pair_tests[@]}" 2>&1 | tee "$RUNNER_TEMP/lody-pair.log"
        working-directory: packages/webapp
      - name: Reject bundle-absence skips
        if: always()
        run: |
          if test -f "$RUNNER_TEMP/lody-pair.log" && \
             grep -F 'LODY PAIR GATE: skipped for lack of a bundle' "$RUNNER_TEMP/lody-pair.log"; then
            echo "A non-paid daemon suite skipped because the built package was unavailable." >&2
            exit 1
          fi
      - name: Upload the daemon package and provenance
        if: always()
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          name: lody-daemon-package
          path: |
            ${{ runner.temp }}/lody-artifact/BUILD.json
            ${{ runner.temp }}/lody-artifact/lody-*.tgz
          if-no-files-found: error

  credential-helper:
    name: Go box credential helper
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
      - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0
        with:
          go-version-file: packages/box/credential-helper/go.mod
          cache-dependency-path: packages/box/credential-helper/go.mod
      - run: test -z "$(gofmt -l .)" || { gofmt -d .; exit 1; }
        working-directory: packages/box/credential-helper
      - run: go test ./...
        working-directory: packages/box/credential-helper

  # The gateway has a separate test job because an image build only compiles it.
  # This job also checks the webApp ticket and Lody share contracts.
  gateway:
    name: Go box gateway
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
      - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0
        with:
          go-version-file: packages/box/gateway/go.mod
          cache-dependency-path: packages/box/gateway/go.mod
      - run: test -z "$(gofmt -l .)" || { gofmt -d .; exit 1; }
        working-directory: packages/box/gateway
      - run: go test ./...
        working-directory: packages/box/gateway

  box-image:
    name: Box image build check (amd64)
    runs-on: ubuntu-latest
    # 40 minutes for the two image builds, the smoke's hard 3-minute boot
    # deadline, and 2 minutes for diagnostics and cleanup.
    timeout-minutes: 45
    steps:
      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
      - name: Build and boot the Lody-enabled image
        run: packages/box/test/smoke.sh
      - name: Upload box smoke diagnostics
        if: failure()
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          name: box-smoke-diagnostics
          path: packages/box/test/.smoke-tmp/**
          if-no-files-found: warn
          include-hidden-files: true