code-qa.yml

name: Code QA Roo Code

on:
    workflow_dispatch:
    push:
        branches: [main]
    pull_request:
        types: [opened, reopened, ready_for_review, synchronize]
    merge_group:
        types: [checks_requested]

# Least privilege: every job below escalates only where it needs to.
permissions:
    contents: read

jobs:
    dependency-review:
        runs-on: ubuntu-latest
        # Only meaningful for PRs — validates the dependency diff of the pull
        # request against GitHub's advisory database before merge.
        if: github.event_name == 'pull_request'
        steps:
            - name: Checkout code
              uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
              with:
                  # This job never pushes — don't persist the GITHUB_TOKEN.
                  persist-credentials: false
            - name: Dependency review
              uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0

    invisible-chars:
        runs-on: ubuntu-latest
        # Reject invisible / homoglyph Unicode that GitHub's diff UI renders
        # invisibly and most editors hide. These compile fine, which is the
        # risk: identifier-splitting, string-literal injection, and the
        # "Trojan Source" bidi-override attack (U+202A-U+202E). Scanning raw
        # bytes catches them in strings, identifiers, and comments alike.
        steps:
            - name: Checkout code
              uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
              with:
                  # This job never pushes — don't persist the GITHUB_TOKEN.
                  persist-credentials: false
            - name: Reject invisible / homoglyph Unicode
              run: |
                  # zero-width (U+200B-200F), word joiner (U+2060), BOM (U+FEFF),
                  # bidi overrides (U+202A-202E), soft hyphen (U+00AD).
                  # Covers source, release-adjacent executable scripts
                  # (*.sh / *.cjs / *.cts / *.mts), and the executable shell
                  # blocks inside GitHub workflow/action YAML.
                  if grep -rnP '[\x{200B}-\x{200F}\x{202A}-\x{202E}\x{2060}\x{FEFF}\x{00AD}]' \
                      --include='*.ts' --include='*.tsx' --include='*.js' --include='*.mjs' \
                      --include='*.cjs' --include='*.cts' --include='*.mts' --include='*.sh' \
                      --include='*.yml' --include='*.yaml' \
                      --exclude-dir=node_modules --exclude-dir=dist --exclude-dir=out \
                      --exclude-dir=coverage --exclude-dir=.turbo --exclude-dir=.vinxi \
                      src webview-ui packages apps .github; then
                      echo "::error::Found invisible or homoglyph Unicode characters (zero-width / bidi-override / BOM / soft hyphen)"
                      exit 1
                  fi

    check-translations:
        runs-on: ubuntu-latest
        steps:
            - name: Checkout code
              uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
            - name: Setup Node.js and pnpm
              uses: ./.github/actions/setup-node-pnpm
            - name: Verify all translations are complete
              run: node scripts/find-missing-translations.js

    knip:
        runs-on: ubuntu-latest
        steps:
            - name: Checkout code
              uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
            - name: Setup Node.js and pnpm
              uses: ./.github/actions/setup-node-pnpm
            - name: Verify Knip guardrails
              run: pnpm test:knip-policy
            - name: Run knip checks
              run: pnpm knip
            - name: Run production Knip checks
              run: pnpm knip:production

    compile:
        runs-on: ubuntu-latest
        steps:
            - name: Checkout code
              uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
            - name: Setup Node.js and pnpm
              uses: ./.github/actions/setup-node-pnpm
            - name: Check formatting
              run: pnpm format:check
            - name: Lint
              run: pnpm lint
            - name: Check types
              run: pnpm check-types
            - name: Validate Code QA workflow
              run: pnpm test:code-qa-ci
            - name: Validate Solheim provider smoke workflow
              run: pnpm test:solheim-smoke-ci
            - name: Test Solheim provider smoke units
              run: pnpm test:solheim-smoke:unit
            - name: Check Solheim provider smoke types
              run: pnpm solheim-smoke:check-types
            - name: Test agent evals units
              run: pnpm test:agent-evals:unit
            - name: Check agent evals types
              run: pnpm agent-evals:check-types
            - name: Model-check task lifecycle protocols
              run: pnpm lifecycle:model-check
            - name: Validate MCP OAuth integration
              run: pnpm mcp:integration-check

    build-vsix:
        name: Build test VSIX
        if: github.event_name == 'pull_request'
        runs-on: ubuntu-latest
        steps:
            - name: Checkout code
              uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
              with:
                  persist-credentials: false
            - name: Setup Node.js and pnpm
              uses: ./.github/actions/setup-node-pnpm
              with:
                  install-args: "--frozen-lockfile"
            - name: Build workspace packages
              run: |
                  pnpm --filter @roo-code/build build
                  pnpm --filter @roo-code/vscode-webview build
            - name: Package extension
              run: pnpm --filter ./src vsix
            - name: Upload test VSIX
              uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
              with:
                  name: zoo-code-vsix-pr-${{ github.event.pull_request.number }}
                  path: bin/*.vsix
                  if-no-files-found: error
                  retention-days: 7

    unit-test:
        name: platform-unit-test (${{ matrix.name }})
        runs-on: ${{ matrix.os }}
        concurrency:
            # Duplicate runs for one commit must not race the OS-specific Turbo cache save.
            group: unit-test-${{ github.repository }}-${{ github.sha }}-${{ matrix.name }}
            cancel-in-progress: false
        strategy:
            matrix:
                include:
                    - os: ubuntu-latest
                      name: ubuntu-latest
                      codecov-flag: ubuntu
                      collect-coverage: true
                    - os: windows-latest
                      name: windows-latest
                      codecov-flag: windows
                      collect-coverage: false
        steps:
            - name: Checkout code
              uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
            - name: Setup Node.js and pnpm
              uses: ./.github/actions/setup-node-pnpm
            - name: Restore Turbo cache
              id: turbo-cache
              uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
              with:
                  path: .turbo/cache
                  key: ${{ runner.os }}-turbo-${{ hashFiles('**/pnpm-lock.yaml') }}-${{ github.sha }}
                  restore-keys: |
                      ${{ runner.os }}-turbo-${{ hashFiles('**/pnpm-lock.yaml') }}-
                      ${{ runner.os }}-turbo-
            # Windows never uploads coverage, so Windows runs the same test
            # suites through the uninstrumented Turbo tasks. Ubuntu stays the
            # authoritative coverage lane.
            - name: Run non-extension package coverage
              if: matrix.collect-coverage
              run: pnpm turbo run test:coverage --filter="!@roo-code/core" --filter="!zoo-code" --log-order grouped --output-logs new-only
            - name: Run non-extension package tests
              if: ${{ !matrix.collect-coverage }}
              run: pnpm turbo run test --filter="!@roo-code/core" --filter="!zoo-code" --log-order grouped --output-logs new-only
            - name: Run extension coverage lanes
              if: matrix.collect-coverage
              run: pnpm turbo run test:coverage:api test:coverage:core test:coverage:services test:coverage:misc test:coverage:tree-sitter --filter="zoo-code" --concurrency=2 --log-order grouped --output-logs new-only
            - name: Run extension test lanes
              if: ${{ !matrix.collect-coverage }}
              run: pnpm turbo run test:api test:core test:services test:misc test:tree-sitter --filter="zoo-code" --concurrency=2 --log-order grouped --output-logs new-only
            # Runs outside Turbo so changes to .coderabbit.yaml,
            # .github/workflows/label-pr-review-state.yml, and
            # .github/workflows/stale.yml always bust the result. Those files
            # sit outside the src/ package boundary and cannot be declared as
            # Turbo inputs.
            - name: Run workflow config tests
              run: pnpm --dir src run test:workflow
            - name: Verify extension coverage contract
              if: matrix.collect-coverage
              run: pnpm --dir src run verify:coverage-contract
            - name: Run extension dist smoke test
              run: pnpm turbo run test:dist --filter="zoo-code" --log-order grouped --output-logs new-only
            - name: Run core unit coverage
              if: matrix.collect-coverage
              run: pnpm turbo run test:coverage:unit --filter="@roo-code/core" --log-order grouped --output-logs new-only
            - name: Run core unit tests
              if: ${{ !matrix.collect-coverage }}
              run: pnpm turbo run test:unit --filter="@roo-code/core" --log-order grouped --output-logs new-only
            - name: Run core integration coverage
              if: matrix.collect-coverage
              run: pnpm turbo run test:coverage:integration --filter="@roo-code/core" --log-order grouped --output-logs new-only
            - name: Run core integration tests
              if: ${{ !matrix.collect-coverage }}
              run: pnpm turbo run test:integration --filter="@roo-code/core" --log-order grouped --output-logs new-only
            - name: Verify extension coverage reports
              if: matrix.collect-coverage
              run: |
                  node src/scripts/verify-lcov.mjs src/coverage/api/lcov.info
                  node src/scripts/verify-lcov.mjs src/coverage/core/lcov.info
                  node src/scripts/verify-lcov.mjs src/coverage/services/lcov.info
                  node src/scripts/verify-lcov.mjs src/coverage/misc/lcov.info
                  node src/scripts/verify-lcov.mjs src/coverage/tree-sitter/lcov.info
            - name: Merge extension coverage reports
              if: matrix.collect-coverage
              run: |
                  mkdir -p src/coverage/merged
                  pnpm --dir src run merge:coverage
                  node src/scripts/verify-lcov.mjs src/coverage/merged/lcov.info
            # Validate cache boundaries before publishing any new Turbo entries.
            - name: Verify coverage cache inputs
              if: matrix.collect-coverage
              run: pnpm --dir src run verify:coverage-cache-inputs
            - name: Save Turbo cache
              if: steps.turbo-cache.outputs.cache-hit != 'true'
              uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
              with:
                  path: .turbo/cache
                  key: ${{ steps.turbo-cache.outputs.cache-primary-key }}
            # Only ubuntu uploads coverage. Windows still runs the same test
            # lanes for behavioral confidence, but duplicating coverage uploads
            # there mostly adds Codecov overhead without changing pass/fail
            # behavior.
            # Coverage is uploaded in separate steps so each LCOV gets the
            # correct flag set. Extension lanes instrument the same sources, so
            # union them before upload; a line is covered when any lane executes
            # it. Core and webview reports retain their independent flags.
            # See https://docs.codecov.com/docs/flags
            - name: Upload non-core coverage to Codecov
              if: matrix.collect-coverage
              uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
              with:
                  files: >-
                      src/coverage/merged/lcov.info,
                      packages/cloud/coverage/lcov.info,
                      packages/telemetry/coverage/lcov.info,
                      apps/cli/coverage/lcov.info
                  disable_search: true
                  flags: ${{ matrix.codecov-flag }}
                  token: ${{ secrets.CODECOV_TOKEN }}
            - name: Upload webview JSDOM coverage to Codecov
              if: matrix.collect-coverage
              uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
              with:
                  files: webview-ui/coverage/lcov.info
                  disable_search: true
                  flags: webview-ui
                  token: ${{ secrets.CODECOV_TOKEN }}
            - name: Upload core unit coverage to Codecov
              if: matrix.collect-coverage
              uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
              with:
                  files: packages/core/coverage/unit/lcov.info
                  disable_search: true
                  flags: ${{ matrix.codecov-flag }},core-unit
                  token: ${{ secrets.CODECOV_TOKEN }}
            - name: Upload core integration coverage to Codecov
              if: matrix.collect-coverage
              uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
              with:
                  files: packages/core/coverage/integration/lcov.info
                  disable_search: true
                  flags: ${{ matrix.codecov-flag }},core-integration
                  token: ${{ secrets.CODECOV_TOKEN }}
            - name: Upload coverage reports to GitHub
              if: matrix.collect-coverage
              uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
              with:
                  name: coverage-reports-${{ matrix.name }}
                  path: |
                      src/coverage/api/lcov.info
                      src/coverage/core/lcov.info
                      src/coverage/services/lcov.info
                      src/coverage/misc/lcov.info
                      src/coverage/tree-sitter/lcov.info
                      src/coverage/merged/lcov.info
                      webview-ui/coverage/lcov.info
                      packages/cloud/coverage/lcov.info
                      packages/telemetry/coverage/lcov.info
                      apps/cli/coverage/lcov.info
                      packages/core/coverage/unit/lcov.info
                      packages/core/coverage/integration/lcov.info
                  retention-days: 7