check.yml

name: core-check

on:
  workflow_call:
    inputs:
      ref:
        description: Source commit to check
        required: false
        type: string
      native-artifacts:
        description: Retain native installers for a release build
        type: boolean
        default: false
  workflow_dispatch:
  pull_request:

permissions:
  contents: read

concurrency:
  group: core-check-${{ github.workflow }}-${{ inputs.ref && github.run_id || github.ref }}
  cancel-in-progress: true

jobs:
  plan:
    runs-on: ${{ vars.OAC_USE_GITHUB_RUNNERS == 'true' && 'ubuntu-22.04' || 'blacksmith-2vcpu-ubuntu-2204' }}
    timeout-minutes: 5
    outputs:
      plan: ${{ steps.select.outputs.plan }}
      jobs: ${{ steps.select.outputs.jobs }}
      image: ${{ steps.select.outputs.image }}
    steps:
      - uses: actions/checkout@v7
        with:
          ref: ${{ inputs.ref || github.sha }}
          fetch-depth: 2
      - name: Select checks from the integrated change
        id: select
        env:
          REQUESTED_REF: ${{ inputs.ref }}
        run: python3 scripts/ci_plan.py plan

  hygiene:
    needs: plan
    if: needs.plan.result == 'success' && contains(fromJSON(needs.plan.outputs.jobs || '[]'), 'hygiene')
    runs-on: ${{ vars.OAC_USE_GITHUB_RUNNERS == 'true' && 'ubuntu-22.04' || 'blacksmith-2vcpu-ubuntu-2204' }}
    timeout-minutes: 5
    steps:
      - uses: actions/checkout@v7
        with:
          ref: ${{ inputs.ref || github.sha }}
      - name: Verify names, documentation and CI selection invariants
        run: make check-names check-docs check-ci

  # Parts run in parallel; the serial store integration package is split into deterministic shards.
  backend:
    needs: plan
    if: needs.plan.result == 'success' && contains(fromJSON(needs.plan.outputs.jobs || '[]'), 'backend')
    strategy:
      fail-fast: false
      matrix:
        include:
          - part: runtime
          - part: core
          - part: store
            shard: 1/3
          - part: store
            shard: 2/3
          - part: store
            shard: 3/3
    name: backend (${{ matrix.part }}${{ matrix.shard && format(' {0}', matrix.shard) || '' }})
    runs-on: ${{ vars.OAC_USE_GITHUB_RUNNERS == 'true' && 'ubuntu-22.04' || 'blacksmith-2vcpu-ubuntu-2204' }}
    timeout-minutes: 30
    services:
      postgres:
        image: postgres:16-alpine
        env:
          POSTGRES_DB: oac_core_ci_tests
          POSTGRES_USER: agents_api
          POSTGRES_PASSWORD: core_test_only
        ports:
          - 5432/tcp
        options: >-
          --health-cmd "pg_isready -U agents_api -d oac_core_ci_tests"
          --health-interval 5s
          --health-timeout 5s
          --health-retries 10
    steps:
      - uses: actions/checkout@v7
        with:
          ref: ${{ inputs.ref || github.sha }}
      - name: Select Go caches
        id: source
        run: |
          echo "revision=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT"
          echo "GOCACHE=$HOME/.oac/cache/go-build" >> "$GITHUB_ENV"
          echo "GOMODCACHE=$HOME/.oac/cache/go-mod" >> "$GITHUB_ENV"
      - uses: actions/setup-go@v7
        with:
          go-version-file: go.mod
          cache: false
      - uses: actions/cache@v6
        with:
          path: |
            ~/.oac/cache/go-build
            ~/.oac/cache/go-mod
          key: core-go-v2-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('**/go.mod', '**/go.sum') }}-backend-${{ matrix.part }}-${{ steps.source.outputs.revision }}
          restore-keys: |
            core-go-v2-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('**/go.mod', '**/go.sum') }}-backend-${{ matrix.part }}-
            core-go-v2-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('**/go.mod', '**/go.sum') }}-backend-
            core-go-v1-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('**/go.mod', '**/go.sum') }}-
      - uses: actions/setup-node@v6
        with:
          node-version: '22'
      - name: Install native Go prerequisites
        if: matrix.part == 'runtime'
        run: |
          sudo apt-get update
          sudo apt-get install -y build-essential pkg-config libssl-dev
      - name: Verify dedicated test database
        env:
          OAC_TEST_DATABASE_URL: postgres://agents_api:core_test_only@127.0.0.1:${{ job.services.postgres.ports['5432'] }}/oac_core_ci_tests?sslmode=disable
        run: |
          echo "OAC_TEST_DATABASE_URL=$OAC_TEST_DATABASE_URL" >> "$GITHUB_ENV"
          make check-database
      - name: Verify generated SQL queries
        if: matrix.part == 'runtime'
        run: make check-sqlc
      - name: Test Runtime and shared Go contracts
        if: matrix.part == 'runtime'
        run: make check-go
      - name: Test microsandbox provider and Linux helper
        if: matrix.part == 'runtime'
        run: make check-microsandbox-provider
      - name: Build execution daemon
        if: matrix.part == 'runtime'
        run: make build-daemon
      - name: Build standalone Core and test services and clients
        if: matrix.part == 'core'
        run: make build-core check-core-packages
      - name: Test Core persistence shard ${{ matrix.shard }}
        if: matrix.part == 'store'
        run: make check-core-store OAC_CORE_STORE_SHARD=${{ matrix.shard }}

  distribution:
    needs: plan
    if: needs.plan.result == 'success' && contains(fromJSON(needs.plan.outputs.jobs || '[]'), 'distribution')
    runs-on: ${{ vars.OAC_USE_GITHUB_RUNNERS == 'true' && 'ubuntu-22.04' || 'blacksmith-2vcpu-ubuntu-2204' }}
    timeout-minutes: 20
    steps:
      - uses: actions/checkout@v7
        with:
          ref: ${{ inputs.ref || github.sha }}
      - name: Select Go caches
        id: source
        run: |
          echo "revision=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT"
          echo "GOCACHE=$HOME/.oac/cache/go-build" >> "$GITHUB_ENV"
          echo "GOMODCACHE=$HOME/.oac/cache/go-mod" >> "$GITHUB_ENV"
      - uses: actions/setup-go@v7
        with:
          go-version-file: go.mod
          cache: false
      - uses: actions/cache@v6
        with:
          path: |
            ~/.oac/cache/go-build
            ~/.oac/cache/go-mod
          key: core-go-v2-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('**/go.mod', '**/go.sum') }}-distribution-${{ steps.source.outputs.revision }}
          restore-keys: |
            core-go-v2-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('**/go.mod', '**/go.sum') }}-distribution-
            core-go-v2-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('**/go.mod', '**/go.sum') }}-tooling-
            core-go-v1-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('**/go.mod', '**/go.sum') }}-
      - uses: actions/setup-node@v6
        with:
          node-version: '22'
      - name: Verify Harness catalog and installer schema
        run: make check-harness-catalog
      - name: Install distribution compressor
        run: sudo apt-get update && sudo apt-get install -y pigz
      - name: Test distribution, installer and console packaging
        run: make check-distribution

  compose:
    needs: plan
    if: needs.plan.result == 'success' && contains(fromJSON(needs.plan.outputs.jobs || '[]'), 'compose')
    runs-on: ${{ vars.OAC_USE_GITHUB_RUNNERS == 'true' && 'ubuntu-22.04' || 'blacksmith-2vcpu-ubuntu-2204' }}
    timeout-minutes: 20
    steps:
      - uses: actions/checkout@v7
        with:
          ref: ${{ inputs.ref || github.sha }}
      - uses: actions/setup-go@v7
        with:
          go-version-file: go.mod
      - name: Allocate an isolated Compose project
        run: python3 -c 'import uuid; print("COMPOSE_SMOKE_PROJECT=oac-smoke-" + uuid.uuid4().hex)' >> "$GITHUB_ENV"
      - name: Build the images, start the installation and verify it
        timeout-minutes: 17
        run: python3 scripts/compose-smoke.py
      - name: Remove test containers and volumes
        if: always() && env.COMPOSE_SMOKE_PROJECT != ''
        timeout-minutes: 2
        run: docker compose --env-file /dev/null -p "$COMPOSE_SMOKE_PROJECT" -f deploy/compose/compose.yaml down --volumes --remove-orphans

  harness:
    needs: plan
    if: needs.plan.result == 'success' && contains(fromJSON(needs.plan.outputs.jobs || '[]'), 'harness')
    runs-on: ${{ vars.OAC_USE_GITHUB_RUNNERS == 'true' && 'ubuntu-22.04' || 'blacksmith-2vcpu-ubuntu-2204' }}
    timeout-minutes: 20
    steps:
      - uses: actions/checkout@v7
        with:
          ref: ${{ inputs.ref || github.sha }}
      - uses: ./.github/actions/node
        with:
          lockfiles: |
            packages/claude-sdk-adapter/pnpm-lock.yaml
            packages/mcode-harness/package-lock.json
      - name: Test and package Harness adapters
        run: make check-claude-sdk check-mcode-harness

  example:
    needs: plan
    if: needs.plan.result == 'success' && contains(fromJSON(needs.plan.outputs.jobs || '[]'), 'example')
    runs-on: ${{ vars.OAC_USE_GITHUB_RUNNERS == 'true' && 'ubuntu-22.04' || 'blacksmith-2vcpu-ubuntu-2204' }}
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@v7
        with:
          ref: ${{ inputs.ref || github.sha }}
      - uses: ./.github/actions/node
        with:
          lockfiles: |
            example/parsar/pnpm-lock.yaml
            packages/agents-client/pnpm-lock.yaml
      - name: Install dependencies and example acceptance browser
        run: |
          make example-deps
          pnpm --filter @oac/parsar-example exec playwright install --with-deps chrome
      - name: Test and build optional example with browser acceptance
        run: make check-example
      - name: Upload browser failure evidence
        if: failure()
        uses: actions/upload-artifact@v6
        with:
          name: example-acceptance-${{ github.run_attempt }}
          path: |
            example/*/playwright-report/
            example/*/test-results/
          retention-days: 7
          compression-level: 0
          if-no-files-found: ignore

  web:
    needs: plan
    if: needs.plan.result == 'success' && contains(fromJSON(needs.plan.outputs.jobs || '[]'), 'web')
    runs-on: ${{ vars.OAC_USE_GITHUB_RUNNERS == 'true' && 'ubuntu-22.04' || 'blacksmith-2vcpu-ubuntu-2204' }}
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@v7
        with:
          ref: ${{ inputs.ref || github.sha }}
      - uses: ./.github/actions/node
        with:
          lockfiles: |
            apps/web/pnpm-lock.yaml
            packages/agents-client/pnpm-lock.yaml
      - name: Typecheck, test and build Web and clients
        run: make check-web-unit

  website:
    needs: plan
    if: needs.plan.result == 'success' && contains(fromJSON(needs.plan.outputs.jobs || '[]'), 'website')
    runs-on: ${{ vars.OAC_USE_GITHUB_RUNNERS == 'true' && 'ubuntu-22.04' || 'blacksmith-2vcpu-ubuntu-2204' }}
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@v7
        with:
          ref: ${{ inputs.ref || github.sha }}
      - uses: ./.github/actions/node
        with:
          lockfiles: |
            website/pnpm-lock.yaml
      - name: Build and test the website
        env:
          WEBSITE_URL: https://minimax-ai.github.io/OpenAgentCore/
        run: make check-website

  web-acceptance:
    needs: [plan, web]
    if: needs.web.result == 'success' && needs.plan.result == 'success' && contains(fromJSON(needs.plan.outputs.jobs || '[]'), 'web-acceptance')
    strategy:
      fail-fast: false
      matrix:
        shard: [1, 2, 3, 4]
    runs-on: ${{ vars.OAC_USE_GITHUB_RUNNERS == 'true' && 'ubuntu-22.04' || 'blacksmith-2vcpu-ubuntu-2204' }}
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@v7
        with:
          ref: ${{ inputs.ref || github.sha }}
      - uses: ./.github/actions/node
        with:
          lockfiles: |
            apps/web/pnpm-lock.yaml
            packages/agents-client/pnpm-lock.yaml
      - name: Install dependencies and Web acceptance browser
        run: |
          make web-deps
          pnpm --filter @oac/web exec playwright install --with-deps chrome
      - name: Verify Web workflows against isolated fixtures
        run: make check-web-acceptance OAC_WEB_TEST_SHARD=${{ matrix.shard }}/${{ strategy.job-total }}
      - name: Upload browser failure evidence
        if: failure()
        uses: actions/upload-artifact@v6
        with:
          name: web-acceptance-${{ matrix.shard }}-${{ github.run_attempt }}
          path: |
            apps/web/playwright-report/
            apps/web/test-results/
          retention-days: 7
          compression-level: 0
          if-no-files-found: ignore

  api:
    needs: plan
    if: needs.plan.result == 'success' && contains(fromJSON(needs.plan.outputs.jobs || '[]'), 'api')
    uses: ./.github/workflows/api-acceptance.yml
    with:
      ref: ${{ inputs.ref || github.sha }}
      container: ${{ needs.plan.outputs.image == 'true' }}

  native:
    needs: plan
    if: needs.plan.result == 'success' && contains(fromJSON(needs.plan.outputs.jobs || '[]'), 'native')
    uses: ./.github/workflows/native.yml
    with:
      ref: ${{ inputs.ref || github.sha }}
      upload-artifacts: ${{ inputs.native-artifacts || false }}

  lint:
    needs: plan
    if: needs.plan.result == 'success' && contains(fromJSON(needs.plan.outputs.jobs || '[]'), 'lint')
    uses: ./.github/workflows/actionlint.yml
    with:
      ref: ${{ inputs.ref || github.sha }}

  # Always report the required check, even when planning or a dependency fails.
  check:
    if: always()
    needs: [plan, hygiene, distribution, compose, backend, harness, example, web, web-acceptance, website, api, native, lint]
    runs-on: ${{ vars.OAC_USE_GITHUB_RUNNERS == 'true' && 'ubuntu-22.04' || 'blacksmith-2vcpu-ubuntu-2204' }}
    timeout-minutes: 5
    steps:
      - uses: actions/checkout@v7
        with:
          ref: ${{ inputs.ref || github.sha }}
      - name: Require every selected check to succeed
        env:
          PLAN: ${{ needs.plan.outputs.plan }}
          RESULTS: ${{ toJSON(needs) }}
        run: python3 scripts/ci_plan.py gate