ci.yml

name: CI

on:
  push:
    branches: [main]
  pull_request:

permissions:
  contents: read

# A push that supersedes an in-flight run makes that run's verdict
# irrelevant, so cancel it rather than paying for both. Keyed by ref, so
# concurrent PRs never cancel each other.
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

# No SQL lane here on purpose: any target that builds or tests SQL must
# delegate to cmd/rgit-install, so -tags rgit_sql and parser generation stay
# in exactly one place (AGENTS.md § Delegation boundary). Plain `go build`/
# `go test` never touch it.
#
# cgo is mandatory -- rgit links tree-sitter through cgo, so CGO_ENABLED=0
# is not an option. ubuntu-latest ships gcc (verified against
# actions/runner-images' own software manifest), so no toolchain step is
# needed here.
jobs:
  test:
    name: test (unit lane)
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: Rethunk-Tech/gh-actions/setup-go@e04e0afa3e00c59e33030fdbc7df29c15000357b # v1.7
      # cmd/rgit-install's own tests (TestRunPrereqChecks, TestFindSQLAdapter)
      # assert this in a real dev/CI environment -- not a build-time SQL
      # lane (this file's own top comment), just PATH presence for the
      # prereq check itself. Same step release.yml's darwin/linux/windows
      # jobs already carry, kept in sync on purpose.
      - run: npm install -g tree-sitter-cli
      # -short: the unit lane CONTRIBUTING.md calls where the guarantee
      # lives. It also skips every live-language-server test cleanly (each
      # checks testing.Short() and/or exec.LookPath before dialling), which
      # matters here since this runner has no language servers installed.
      - run: go test -short ./...

  lint:
    name: lint
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: Rethunk-Tech/gh-actions/setup-go@e04e0afa3e00c59e33030fdbc7df29c15000357b # v1.7
        with:
          run-lint: "true"
          run-govulncheck: "true"

  e2e:
    name: test (full suite)
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: Rethunk-Tech/gh-actions/setup-go@e04e0afa3e00c59e33030fdbc7df29c15000357b # v1.7
      # Same reason the unit lane above installs this: cmd/rgit-install's
      # own tests run here too, unshortened by -short.
      - run: npm install -g tree-sitter-cli
      # The unit lane above is where a regression must fail; this lane
      # proves the assembled program behaves -- it builds the binary and
      # execs it, which -short skips entirely. Without it, CONTRIBUTING's
      # claim that these gates run on every push was true of two lanes out
      # of three. The completion cases guard on exec.LookPath and skip
      # cleanly when a shell (zsh here) is absent from the runner.
      - run: go test ./...

  race:
    name: race (internal/lsp)
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: Rethunk-Tech/gh-actions/setup-go@e04e0afa3e00c59e33030fdbc7df29c15000357b # v1.7
      # Scoped to internal/lsp, not ./...: CONTRIBUTING.md names jsonrpc2
      # and the spawn lock -- both there -- as the concurrency that
      # matters. Every live-server case in this package skips cleanly via
      # its own exec.LookPath guard when nothing is installed.
      - run: go test -race ./internal/lsp/...

  install-script:
    name: install script
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      # shellcheck ships preinstalled on ubuntu-latest (actions/runner-images'
      # own software manifest) -- no extra Action or install step needed, the
      # same reasoning this file's own top comment gives for skipping a gcc
      # setup step.
      - run: shellcheck scripts/install.sh
      # --dry-run never touches the network (docs/INSTALL.md § Install
      # script): this is a lint of the script's own control flow -- flag
      # parsing, OS/arch detection, the printed plan -- not a real download,
      # so it needs nothing from the release it would otherwise fetch.
      - run: VERSION=v1.2.0 sh scripts/install.sh --dry-run
      - name: Show cosign plan in dry-run
        run: |
          mock_bin="$(mktemp -d)"
          trap 'rm -rf "$mock_bin"' EXIT
          printf '%s\n' \
            '#!/bin/sh' \
            'exit 0' >"$mock_bin/cosign"
          chmod +x "$mock_bin/cosign"
          output="$(
            PATH="$mock_bin:/usr/bin:/bin" VERSION=v1.2.0 \
              sh scripts/install.sh --dry-run
          )"
          printf '%s\n' "$output"
          printf '%s\n' "$output" | grep -Fq 'cosign/Sigstore bundle' || {
            printf '%s\n' 'missing cosign/Sigstore dry-run plan' >&2
            exit 1
          }
      # Exercise Darwin's asset and checksum selection without needing a Mac
      # runner or touching the network.
      - run: |
          mock_bin="$(mktemp -d)"
          trap 'rm -rf "$mock_bin"' EXIT
          printf '%s\n' \
            '#!/bin/sh' \
            "case \"\$1\" in" \
            '  -s) printf "%s\n" Darwin ;;' \
            '  -m) printf "%s\n" arm64 ;;' \
            'esac' >"$mock_bin/uname"
          chmod +x "$mock_bin/uname"
          output="$(
            PATH="$mock_bin:$PATH" VERSION=v1.2.0 sh scripts/install.sh --dry-run
          )"
          printf '%s\n' "$output"
          for expected in \
            rgit-v1.2.0-darwin-arm64 \
            SHA256SUMS
          do
            printf '%s\n' "$output" | grep -Fq "$expected" || {
              printf 'missing expected output: %s\n' "$expected" >&2
              exit 1
            }
          done
      - run: |
          mock_bin="$(mktemp -d)"
          trap 'rm -rf "$mock_bin"' EXIT
          printf '%s\n' \
            '#!/bin/sh' \
            "case \"\$1\" in" \
            '  -s) printf "%s\n" Darwin ;;' \
            '  -m) printf "%s\n" x86_64 ;;' \
            'esac' >"$mock_bin/uname"
          chmod +x "$mock_bin/uname"
          output="$(
            PATH="$mock_bin:$PATH" VERSION=v1.2.0 sh scripts/install.sh --dry-run
          )"
          printf '%s\n' "$output"
          for expected in \
            rgit-v1.2.0-darwin-amd64 \
            SHA256SUMS
          do
            printf '%s\n' "$output" | grep -Fq "$expected" || {
              printf 'missing expected output: %s\n' "$expected" >&2
              exit 1
            }
          done
      - name: Verify optional cosign branch without network
        run: |
          fixture="$(mktemp -d)"
          mock_bin="$(mktemp -d)"
          no_cosign_prefix="$(mktemp -d)"
          cosign_prefix="$(mktemp -d)"
          cosign_marker="$(mktemp)"
          trap 'rm -rf "$fixture" "$mock_bin" "$no_cosign_prefix" "$cosign_prefix" "$cosign_marker"' EXIT
          asset="rgit-v1.2.0-linux-amd64"
          printf '%s\n' \
            '#!/bin/sh' \
            'printf "%s\n" "rgit v1.2.0"' >"$fixture/$asset"
          chmod +x "$fixture/$asset"
          asset_digest="$(sha256sum "$fixture/$asset" | cut -d' ' -f1)"
          printf '%s  %s\n' "$asset_digest" "$asset" >"$fixture/SHA256SUMS"
          printf '%s\n' '{"mock":true}' >"$fixture/SHA256SUMS.sigstore.json"
          export COSIGN_FIXTURE="$fixture"
          export COSIGN_MARKER="$cosign_marker"
          printf '%s\n' \
            '#!/bin/sh' \
            'set -eu' \
            'out=' \
            'url=' \
            "while [ \"\$#\" -gt 0 ]; do" \
            "  case \"\$1\" in" \
            "    -o) out=\$2; shift 2 ;;" \
            '    -*) shift ;;' \
            "    *) url=\$1; shift ;;" \
            '  esac' \
            'done' \
            "case \"\$url\" in" \
            "  */SHA256SUMS.sigstore.json) cp \"\$COSIGN_FIXTURE/SHA256SUMS.sigstore.json\" \"\$out\" ;;" \
            "  */SHA256SUMS) cp \"\$COSIGN_FIXTURE/SHA256SUMS\" \"\$out\" ;;" \
            "  */rgit-v1.2.0-linux-amd64) cp \"\$COSIGN_FIXTURE/rgit-v1.2.0-linux-amd64\" \"\$out\" ;;" \
            '  *) exit 1 ;;' \
            'esac' >"$mock_bin/curl"
          chmod +x "$mock_bin/curl"
          PATH="$mock_bin:/usr/bin:/bin" \
            PREFIX="$no_cosign_prefix" VERSION=v1.2.0 \
            sh scripts/install.sh
          test ! -s "$cosign_marker"
          printf '%s\n' \
            '#!/bin/sh' \
            'set -eu' \
            "[ \"\${1:-}\" = verify-blob ]" \
            'shift' \
            'bundle=' \
            'identity=' \
            'issuer=' \
            'checksum=' \
            "while [ \"\$#\" -gt 0 ]; do" \
            "  case \"\$1\" in" \
            "    --bundle) bundle=\$2; shift 2 ;;" \
            "    --certificate-identity-regexp) identity=\$2; shift 2 ;;" \
            "    --certificate-oidc-issuer) issuer=\$2; shift 2 ;;" \
            "    *) checksum=\$1; shift ;;" \
            '  esac' \
            'done' \
            "[ \"\$bundle\" = SHA256SUMS.sigstore.json ]" \
            "[ \"\$checksum\" = SHA256SUMS ]" \
            "[ \"\$identity\" = \"https://github.com/Rethunk-Tech/rethunk-git-cli/.github/workflows/release.yml@.*\" ]" \
            "[ \"\$issuer\" = \"https://token.actions.githubusercontent.com\" ]" \
            "test -s \"\$bundle\"" \
            "test -s \"\$checksum\"" \
            "printf \"%s\n\" verified >\"\$COSIGN_MARKER\"" >"$mock_bin/cosign"
          chmod +x "$mock_bin/cosign"
          PATH="$mock_bin:/usr/bin:/bin" \
            PREFIX="$cosign_prefix" VERSION=v1.2.0 \
            sh scripts/install.sh
          grep -Fqx verified "$cosign_marker"
  install-script-windows:
    name: install script (windows)
    runs-on: windows-latest
    timeout-minutes: 5
    env:
      VERSION: v1.2.0
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Verify Windows dry-run output
        shell: pwsh
        run: |
          $mockBin = Join-Path $env:RUNNER_TEMP "rgit-cosign-dry-run-$([guid]::NewGuid().ToString('N'))"
          New-Item -ItemType Directory -Path $mockBin | Out-Null
          try {
            Set-Content -LiteralPath (Join-Path $mockBin 'cosign.cmd') `
              -Value @('@echo off', 'exit /b 0') -Encoding ascii
            $oldPath = $env:PATH
            $env:PATH = "$mockBin;$oldPath"
            $outputLines = @(& .\scripts\install.ps1 -DryRun)
          } finally {
            $env:PATH = $oldPath
            Remove-Item -LiteralPath $mockBin -Recurse -Force -ErrorAction SilentlyContinue
          }
          if ($LASTEXITCODE -and $LASTEXITCODE -ne 0) {
            exit $LASTEXITCODE
          }
          $output = $outputLines -join [Environment]::NewLine
          $output
          foreach ($expected in @(
              'rgit-v1.2.0-windows-amd64.exe',
              'SHA256SUMS',
              'cosign/Sigstore bundle'
          )) {
            if (-not $output.Contains($expected)) {
              throw "missing expected output: $expected"
            }
          }
      - name: Verify optional cosign branch without network
        shell: pwsh
        run: |
          $fixture = Join-Path $env:RUNNER_TEMP "rgit-install-fixture-$([guid]::NewGuid().ToString('N'))"
          $mockBin = Join-Path $env:RUNNER_TEMP "rgit-cosign-$([guid]::NewGuid().ToString('N'))"
          $noCosignBin = Join-Path $env:RUNNER_TEMP "rgit-no-cosign-$([guid]::NewGuid().ToString('N'))"
          $noCosignPrefix = Join-Path $env:RUNNER_TEMP "rgit-no-cosign-prefix-$([guid]::NewGuid().ToString('N'))"
          $cosignPrefix = Join-Path $env:RUNNER_TEMP "rgit-cosign-prefix-$([guid]::NewGuid().ToString('N'))"
          $marker = Join-Path $env:RUNNER_TEMP "rgit-cosign-marker-$([guid]::NewGuid().ToString('N'))"
          $asset = 'rgit-v1.2.0-windows-amd64.exe'

          foreach ($directory in @(
              $fixture,
              $mockBin,
              $noCosignBin,
              $noCosignPrefix,
              $cosignPrefix
          )) {
            New-Item -ItemType Directory -Path $directory | Out-Null
          }
          [IO.File]::WriteAllText($marker, '')
          Copy-Item -LiteralPath (Join-Path $env:SystemRoot 'System32\where.exe') `
            -Destination (Join-Path $fixture $asset)
          $digest = (Get-FileHash -LiteralPath (Join-Path $fixture $asset) -Algorithm SHA256).Hash
          Set-Content -LiteralPath (Join-Path $fixture 'SHA256SUMS') `
            -Value "$digest  $asset" -Encoding ascii
          Set-Content -LiteralPath (Join-Path $fixture 'SHA256SUMS.sigstore.json') `
            -Value '{"mock":true}' -Encoding ascii

          function Invoke-WebRequest {
            param(
              [string]$Uri,
              [string]$OutFile
            )
            $name = [IO.Path]::GetFileName(([Uri]$Uri).AbsolutePath)
            Copy-Item -LiteralPath (Join-Path $env:COSIGN_FIXTURE $name) `
              -Destination $OutFile -Force
          }

          $cosignScript = @(
            '@echo off'
            'if /i not "%~1"=="verify-blob" exit /b 1'
            'if /i not "%~2"=="--bundle" exit /b 1'
            'if /i not "%~nx3"=="SHA256SUMS.sigstore.json" exit /b 1'
            'if not exist "%~3" exit /b 1'
            'if /i not "%~4"=="--certificate-identity-regexp" exit /b 1'
            'if not "%~5"=="https://github.com/Rethunk-Tech/rethunk-git-cli/.github/workflows/release.yml@.*" exit /b 1'
            'if /i not "%~6"=="--certificate-oidc-issuer" exit /b 1'
            'if not "%~7"=="https://token.actions.githubusercontent.com" exit /b 1'
            'if /i not "%~nx8"=="SHA256SUMS" exit /b 1'
            'if not exist "%~8" exit /b 1'
            '> "%COSIGN_MARKER%" echo verified'
            'exit /b 0'
          )
          Set-Content -LiteralPath (Join-Path $mockBin 'cosign.cmd') `
            -Value $cosignScript -Encoding ascii

          $oldPath = $env:PATH
          try {
            $env:COSIGN_FIXTURE = $fixture
            $env:COSIGN_MARKER = $marker

            $env:PATH = $noCosignBin
            $env:PREFIX = $noCosignPrefix
            & .\scripts\install.ps1
            if (-not (Test-Path -LiteralPath (Join-Path $noCosignPrefix 'rgit.exe'))) {
              throw 'Windows install without cosign did not produce rgit.exe'
            }
            if ((Get-Item -LiteralPath $marker).Length -ne 0) {
              throw 'cosign marker was written on the no-cosign path'
            }

            $env:PATH = "$mockBin;$env:SystemRoot\System32"
            $env:PREFIX = $cosignPrefix
            & .\scripts\install.ps1
            if (-not (Test-Path -LiteralPath (Join-Path $cosignPrefix 'rgit.exe'))) {
              throw 'Windows install with cosign did not produce rgit.exe'
            }
            if ((Get-Content -LiteralPath $marker -Raw).Trim() -ne 'verified') {
              throw 'cosign marker was not written by the cosign path'
            }
          } finally {
            $env:PATH = $oldPath
            $env:PREFIX = $null
            Remove-Item -LiteralPath @(
              $fixture,
              $mockBin,
              $noCosignBin,
              $noCosignPrefix,
              $cosignPrefix,
              $marker
            ) -Recurse -Force -ErrorAction SilentlyContinue
          }