ci.yml

name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

permissions:
  contents: read

jobs:
  validate:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6

      - name: Skill scripts stay executable (canonical + generated mounts)
        # Proves the committed install payload is runnable. Canonical scripts
        # are checked as committed (not chmod'd first), so a script committed
        # non-executable fails CI instead of being silently repaired. A mount
        # script that landed non-executable would silently break
        # `./scripts/publish.sh` for installed users.
        run: |
          status=0
          for dir in display-dev skills/display-dev hermes/productivity/display.dev pi/agent/skills/display-dev codex/display-dev/skills/display-dev; do
            for script in "$dir"/scripts/*.sh; do
              if [ ! -x "$script" ]; then
                echo "not executable: $script" >&2
                status=1
              fi
            done
          done
          for script in claude/hooks/*.sh; do
            if [ ! -x "$script" ]; then
              echo "not executable: $script" >&2
              status=1
            fi
          done
          exit $status

      - name: Make wrapper executable
        run: chmod +x bin/sync-mounts.sh

      - name: Generated mounts match canonical (placeholders resolved)
        # Covers all four generated skill mounts (skills / hermes / pi /
        # codex), plus the no-unresolved-{{...}} and frontmatter-field-set
        # assertions the transformer runs in --check mode.
        run: bin/sync-mounts.sh --check

      - name: Bundled Visualize matches its pinned release
        # claude/skills/visualize/ is a copy of one display-dev/visualize
        # release (claude/visualize.lock). Edits belong in that repo.
        run: bin/sync-visualize.sh --check

      - name: JSON manifests and config parse
        run: |
          jq empty claude/hooks/hooks.json
          jq empty .cursor-plugin/plugin.json
          jq empty .claude-plugin/plugin.json
          jq empty .claude-plugin/marketplace.json
          jq empty codex/display-dev/.codex-plugin/plugin.json
          jq empty codex/display-dev/.mcp.json
          jq empty .agents/plugins/marketplace.json

      - name: Version equality across release metadata
        # Single source of truth is SKILL_VERSION in
        # display-dev/scripts/_common.sh. Every manifest version field and
        # the Codex .mcp.json X-Client-Source suffix must match it, so a
        # release bump can't half-land across the hand-authored files.
        run: |
          want="$(grep SKILL_VERSION_OVERRIDE display-dev/scripts/_common.sh | grep -oE '[0-9]+\.[0-9]+\.[0-9]+')"
          echo "SKILL_VERSION = $want"
          status=0
          check() {
            if [ "$1" != "$want" ]; then
              echo "version mismatch: $2 = '$1' (want $want)" >&2
              status=1
            fi
          }
          check "$(jq -r .version .cursor-plugin/plugin.json)" .cursor-plugin/plugin.json
          check "$(jq -r .version .claude-plugin/plugin.json)" .claude-plugin/plugin.json
          check "$(jq -r '.plugins[0].version' .claude-plugin/marketplace.json)" .claude-plugin/marketplace.json
          check "$(jq -r '.mcpServers["display-dev"].headers["X-Client-Source"]' .claude-plugin/plugin.json | sed 's/.*@//')" '.claude-plugin/plugin.json (X-Client-Source)'
          check "$(grep -oE 'display-dev-claude-plugin@[0-9]+\.[0-9]+\.[0-9]+' claude/commands/feedback.md | sort -u | sed 's/.*@//')" claude/commands/feedback.md
          check "$(jq -r .version codex/display-dev/.codex-plugin/plugin.json)" codex/display-dev/.codex-plugin/plugin.json
          check "$(jq -r '.mcpServers["display-dev"].http_headers["X-Client-Source"]' codex/display-dev/.mcp.json | sed 's/.*@//')" codex/display-dev/.mcp.json
          check "$(grep -oE 'display-dev-skill@[0-9]+\.[0-9]+\.[0-9]+' display-dev/SKILL.md | sort -u | sed 's/.*@//')" display-dev/SKILL.md
          exit $status

      - name: Bash syntax check
        run: |
          for script in display-dev/scripts/*.sh; do
            bash -n "$script"
          done
          for script in claude/hooks/*.sh; do
            bash -n "$script"
          done
          bash -n tests/run.sh
          bash -n tests/claude-hooks.sh

      - name: Helper trust-boundary tests
        run: bash tests/run.sh

      - name: Claude Code plugin hook tests
        run: bash tests/claude-hooks.sh

      - name: Candidate archive contract
        run: node --test tests/archive-candidate.test.mjs

      - name: ShellCheck
        # Pinned to v2.0.0 by full commit SHA — public-repo supply-chain
        # hygiene; floating branch refs let upstream rewrite history.
        uses: ludeeus/action-shellcheck@00cae500b08a931fb5698e11e79bfbd38e612a38 # v2.0.0
        with:
          scandir: ./display-dev/scripts
          severity: warning

      - name: ShellCheck Claude Code plugin hooks
        uses: ludeeus/action-shellcheck@00cae500b08a931fb5698e11e79bfbd38e612a38 # v2.0.0
        with:
          scandir: ./claude/hooks
          severity: warning

      - name: ShellCheck tests
        uses: ludeeus/action-shellcheck@00cae500b08a931fb5698e11e79bfbd38e612a38 # v2.0.0
        with:
          scandir: ./tests
          severity: warning

      # Deliberately no wire-level smoke against a spawned API. The
      # bash helpers here are thin shell glue with no business logic of
      # their own — syntax + shellcheck above is the appropriate gate.
      # The HTTP contracts they hit (POST /v1/public/artifacts and the
      # OTP / auth-check endpoints) are stable display.dev surfaces;
      # any drift would surface in `@displaydev/cli`'s own tests before
      # reaching the skill.