ci.yml

name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

jobs:
  validate:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Standalone skill package
        run: node dev-scripts/check-skill-package.mjs

      - name: Make scripts executable
        run: chmod +x dev-scripts/*.mjs skills/visualize/scripts/*.sh skills/visualize/scripts/*.mjs

      - name: Plugin manifests parse as JSON
        run: |
          jq empty .cursor-plugin/plugin.json
          jq empty .codex-plugin/plugin.json

      - name: Bash syntax check
        run: |
          bash -n skills/visualize/scripts/_common.sh
          bash -n skills/visualize/scripts/publish.sh
          bash -n dev-scripts/build-previews.sh
          bash -n dev-scripts/build-template-previews.sh
          bash -n dev-scripts/build-templates-showcase.sh

      - name: Node syntax check
        run: |
          node --check skills/visualize/scripts/catalog.mjs
          node --check skills/visualize/scripts/teach.mjs
          node --check skills/visualize/scripts/palette.mjs
          node --check skills/visualize/scripts/detect.mjs
          node --check skills/visualize/scripts/browser-contrast.mjs
          node --check skills/visualize/scripts/browser-diagram.mjs
          node --check skills/visualize/scripts/render-mermaid.mjs
          node --check skills/visualize/scripts/image-contract.mjs
          node --check skills/visualize/scripts/generate-image.mjs
          node --check skills/visualize/scripts/record-image.mjs
          node --check skills/visualize/scripts/print-check.mjs
          node --check skills/visualize/scripts/slide-canvas-overflow.mjs
          node --check skills/visualize/scripts/slide-canvas-smoke.mjs
          node --check skills/visualize/shells/slide-canvas/slide-canvas.js
          node --check dev-scripts/catalog-index.mjs
          node --check dev-scripts/check-authoring-contracts.mjs
          node --check dev-scripts/check-fixtures.mjs
          node --check dev-scripts/check-library-policy.mjs
          node --check dev-scripts/check-schema.mjs
          node --check dev-scripts/build-template-previews.mjs
          node --check dev-scripts/build-templates-showcase.mjs
          node --check dev-scripts/inventory-template-composition.mjs
          node --check dev-scripts/palette-curate/generate-candidates.mjs
          node --check dev-scripts/palette-curate/swipe-server.mjs
          node --check dev-scripts/palette-curate/coverage.mjs
          node --check dev-scripts/palette-curate/build-standalone.mjs
          node --check dev-scripts/palette-curate/ingest-paste.mjs
          node --check dev-scripts/palette-eval/diversity-audit.mjs
          node --check dev-scripts/palette-eval/render-strips.mjs
          node --check dev-scripts/palette-eval/aggregate-moodfit.mjs

      - name: Palette picker smoke
        # Determinism contract, stratified-zone sampling, seed gamut +
        # contrast math cross-checked against vendored culori, and the
        # --check validator regression suite (parser edges, context-valid color palettes,
        # ladder self-consistency).
        run: node dev-scripts/palette-smoke.mjs

      - name: Fetch immutable catalog snapshot
        run: git fetch --no-tags --depth=1 origin "$(node -p "require('./catalog/source.json').revision")"

      - name: Catalog selection metadata
        # DESIGN.md frontmatter feeds deterministic catalog-index.json.
        # The check fails on missing / invalid selection metadata or
        # hand-edited index drift.
        run: node dev-scripts/catalog-index.mjs --check

      - name: Selected catalog resolution
        run: node --test dev-scripts/catalog.test.mjs

      - name: slide-canvas unit tests
        # Pure-logic helpers (computeScale, parseSlideHash, static API).
        # Zero deps; runs with the bundled node:test runner.
        run: node --test skills/visualize/shells/slide-canvas/slide-canvas.test.mjs

      - name: Portable image-generation contract
        run: node --test skills/visualize/scripts/image-contract.test.mjs skills/visualize/scripts/image-generation.test.mjs skills/visualize/scripts/image-routes.test.mjs

      - name: Authoring contract
        # Enforces the template.md / patterns / shells / fixtures model.
        run: node dev-scripts/check-authoring-contracts.mjs

      - name: Slide-canvas overflow self-test
        run: node skills/visualize/scripts/slide-canvas-overflow.mjs --self-test

      - name: Library / CDN policy enforcement
        # Fails the build if any template <script src=...> references a
        # URL outside the allowlist (Chart.js on cdn.jsdelivr.net).
        # See dev-scripts/check-library-policy.mjs for the allowlist.
        run: node dev-scripts/check-library-policy.mjs --quiet

      - name: Diagram geometry self-test
        run: node skills/visualize/scripts/browser-diagram.mjs --self-test

      - name: Mermaid authoring-path self-test
        run: node skills/visualize/scripts/render-mermaid.mjs --self-test

      - name: Fixture manifest checks
        # Runs each detect / contrast / smoke check declared in fixtures/manifest.json.
        run: node dev-scripts/check-fixtures.mjs

      - name: Fixture preview smoke matrix
        # Renders curated fixture/design-system pairs to temp/.
        run: |
          node dev-scripts/inventory-template-composition.mjs --strict
          dev-scripts/build-template-previews.sh --matrix dev-scripts/template-preview-matrix.json
          find temp/template-previews -name '*.html' -print0 | xargs -0 node skills/visualize/scripts/detect.mjs --strict

      - name: Preview freshness — design-systems/<ds>/preview*.html match generated
        # Re-runs build-previews.sh in --check mode. Fails if committed
        # preview.html / preview-dark.html differ from regenerated output.
        # Forces contributors to commit regenerated previews when they edit
        # the preview template, fixture styles, or a design system's tokens.css.
        run: dev-scripts/build-previews.sh --check

      - name: ShellCheck
        # Pinned to v2.0.0 by full commit SHA — public-repo supply-chain
        # hygiene; floating branch refs let upstream rewrite history.
        uses: ludeeus/action-shellcheck@00cae500b08a931fb5698e11e79bfbd38e612a38 # v2.0.0
        with:
          scandir: ./skills/visualize/scripts
          severity: warning

      # Deliberately no wire-level smoke against a spawned API. The bash
      # helpers here are thin shell glue with no business logic of their
      # own — syntax + shellcheck above is the appropriate gate. The HTTP
      # contracts the publish path hits (POST /v1/public/artifacts) are
      # stable display.dev surfaces; any drift would surface in
      # `@displaydev/cli`'s own tests before reaching this skill.

  mermaid-windows:
    runs-on: windows-latest
    # Cold npm installs have exceeded ten minutes. Cache the prepared CLI, but
    # leave bounded headroom for the first run or an evicted cache.
    timeout-minutes: 20
    env:
      npm_config_audit: "false"
      npm_config_fund: "false"
      PUPPETEER_SKIP_DOWNLOAD: "true"
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Identify npm cache compatibility
        id: toolchain
        run: |
          "npm_config_cache=$env:RUNNER_TEMP/visualize-mermaid-npm" >> $env:GITHUB_ENV
          "node=$(node --version)" >> $env:GITHUB_OUTPUT
          "npm=$(npm --version)" >> $env:GITHUB_OUTPUT

      - name: Cache prepared Mermaid CLI
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: ${{ env.npm_config_cache }}
          key: mermaid-${{ runner.os }}-${{ runner.arch }}-${{ steps.toolchain.outputs.node }}-${{ steps.toolchain.outputs.npm }}-${{ hashFiles('skills/visualize/scripts/render-mermaid.mjs') }}

      - name: Prepare pinned Mermaid CLI
        # Keep cold package acquisition outside the renderer's 60-second
        # availability deadline. Run on cache hits too; the self-test below
        # exercises this same npm cache through the ordinary renderer path.
        timeout-minutes: 15
        run: npx --yes --prefer-offline --timing --loglevel=http --foreground-scripts @mermaid-js/mermaid-cli@11.12.0 --version

      - name: Mermaid authoring path on Windows
        # Covers direct npx-cli.js execution through Node, valid and invalid
        # source, the end-to-end deadline, and taskkill-based descendant cleanup.
        timeout-minutes: 3
        run: node skills/visualize/scripts/render-mermaid.mjs --self-test