ci.yml

# Jobs are split by what they wait on, so the slowest one decides the wall time
# and nothing queues behind unrelated work. Static checks, three unit shards, the
# PostgreSQL contract, twelve browser shards, two design suites, the container and
# the CLI all start together. Two small gates keep the required check names,
# `format, lint, types, tests` and `e2e`, over the jobs they summarise.
name: ci

on:
  push:
    branches: [main]
  pull_request:
  merge_group:
    types: [checks_requested]
  workflow_dispatch:

# A second push supersedes the first. Nothing here is worth finishing for a
# commit that is no longer the head of the branch.
concurrency:
  group: ci-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: read

env:
  # Matches the version this is developed against. Bun's lockfile format and
  # its workspace catalogs are both young enough that "latest" is a variable.
  BUN_VERSION: 1.4.4
  # Shard counts; keep each matrix below in step with its count.
  UNIT_SHARDS: 3
  E2E_SHARDS: 12

jobs:
  static:
    name: format, lint, and types
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7

      - uses: oven-sh/setup-bun@v2
        with:
          bun-version: ${{ env.BUN_VERSION }}

      # The pinned Impeccable CLI requires Node 22.18 or newer.
      - uses: actions/setup-node@v7
        with:
          node-version: '24'

      # Refuses rather than resolving: a lockfile that does not describe
      # package.json is a difference between what was reviewed and what ran.
      - run: bun install --frozen-lockfile

      # dprint fetches its plugins as wasm from GitHub releases on first use.
      # Cached on the config that names them, since that is exactly what
      # decides which ones are wanted.
      - uses: actions/cache@v6
        with:
          path: ~/.cache/dprint
          key: dprint-${{ runner.os }}-${{ hashFiles('dprint.json') }}

      # Independent of each other, so they share one runner side by side.
      - parallel:
          - name: Format, lint, and enforce design tokens
            run: bun run ci

          - name: Types
            run: bun run types

  # Every unit test file runs in exactly one shard. `--timings` places files by
  # recorded duration (a stale or missing entry changes only the balance), and
  # `--parallel --no-isolate` runs a worker per core that, like plain `bun test`,
  # keeps one module registry across the files it runs. Refresh the timings with
  # `bun test --parallel --no-isolate --timings=.github/bun-test-timings.json --update-timings`.
  unit:
    name: unit tests (${{ matrix.shard }}/3)
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        shard: [1, 2, 3]
    steps:
      - uses: actions/checkout@v7

      - uses: oven-sh/setup-bun@v2
        with:
          bun-version: ${{ env.BUN_VERSION }}

      - uses: actions/setup-node@v7
        with:
          node-version: '24'

      - run: bun install --frozen-lockfile

      # No browser, no agent. `AGENT=off` is set by the tests that spawn a
      # server; nothing here needs a token.
      - run: >-
          bun test --shard=${{ matrix.shard }}/${{ env.UNIT_SHARDS }}
          --timings=.github/bun-test-timings.json --parallel --no-isolate

  # Every durable provider passes the same behavioral contract. The ordinary
  # unit command leaves this one skipped so it stays usable without Docker.
  postgres:
    name: PostgreSQL contract
    runs-on: ubuntu-latest
    services:
      postgres:
        image: mirror.gcr.io/library/postgres:17-alpine
        env:
          POSTGRES_DB: chopin
          POSTGRES_USER: chopin
          POSTGRES_PASSWORD: chopin
        ports:
          - 5432:5432
        options: >-
          --health-cmd "pg_isready -U chopin -d chopin"
          --health-interval 2s
          --health-timeout 3s
          --health-retries 15
    steps:
      - uses: actions/checkout@v7

      - uses: oven-sh/setup-bun@v2
        with:
          bun-version: ${{ env.BUN_VERSION }}

      - uses: actions/setup-node@v7
        with:
          node-version: '24'

      - run: bun install --frozen-lockfile

      - run: bun run test:postgres

  # The required check. It does no work of its own, so it reports as soon as the
  # last job above does, and a failed, skipped or cancelled one fails it.
  checks:
    name: format, lint, types, tests
    needs: [static, unit, postgres]
    if: ${{ always() }}
    runs-on: ubuntu-latest
    steps:
      - name: Require static checks, every unit shard and PostgreSQL to pass
        env:
          STATIC_RESULT: ${{ needs.static.result }}
          UNIT_RESULT: ${{ needs.unit.result }}
          POSTGRES_RESULT: ${{ needs.postgres.result }}
        run: |
          echo "static: $STATIC_RESULT, unit: $UNIT_RESULT, postgres: $POSTGRES_RESULT"
          test "$STATIC_RESULT" = success
          test "$UNIT_RESULT" = success
          test "$POSTGRES_RESULT" = success

  browser-integration:
    name: e2e (shard ${{ matrix.shard }}/12)
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        shard: [1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12]
    env:
      PLAYWRIGHT_BLOB_OUTPUT_DIR: e2e/blob-report
      PLAYWRIGHT_BLOB_OUTPUT_NAME: shard-${{ matrix.shard }}.zip
    steps:
      - uses: actions/checkout@v7

      # Docker needs nothing from Bun, so the databases come up while the rest
      # installs: healthy and empty, and `bun run e2e` migrates them as usual.
      - name: Start the four PostgreSQL databases
        id: databases
        background: true
        run: |
          docker pull --quiet mirror.gcr.io/library/postgres:17-alpine
          docker tag mirror.gcr.io/library/postgres:17-alpine postgres:17-alpine
          docker compose -f compose.yaml -f compose.local.yaml up -d --wait \
            db-e2e db-e2e-fixtures db-e2e-harness db-e2e-local

      # The client is a function of these sources, the lockfile, Bun and the
      # motion toggle, so a client built from the same ones is reused instead of
      # rebuilt on every shard of every run. Restored before the install, so the
      # hash never walks node_modules.
      - name: Restore a client built from these sources
        id: client
        uses: actions/cache@v6
        with:
          path: |
            apps/web/dist
            apps/connector/dist
          key: >-
            client-${{ runner.os }}-bun-${{ env.BUN_VERSION }}-motion-on-analysis-on-${{ hashFiles(
              'apps/web/**', 'apps/connector/**', 'packages/**', '!**/node_modules/**', '!**/dist/**',
              'package.json', 'bun.lock', 'tsconfig.json', 'patches/**'
            ) }}

      - uses: oven-sh/setup-bun@v2
        with:
          bun-version: ${{ env.BUN_VERSION }}

      - run: bun install --frozen-lockfile

      # Build on this runner unless restored above, and either way reject
      # development previews before the long browser suite. It carries the same
      # child-motion toggle as scripts/e2e.ts and runs while Chromium is restored.
      - name: Build the client
        id: build
        background: true
        run: |
          if [ "$CLIENT_RESTORED" = true ]; then
            echo "Client restored for these sources; not rebuilding."
          else
            bun run build
          fi
          bun scripts/check-design-production.ts
        env:
          CLIENT_RESTORED: ${{ steps.client.outputs.cache-hit }}
          VITE_CHILD_MOTION_TOGGLE: "on"
          VITE_MESSAGE_ANALYSIS: "on"

      # Keyed on the Playwright version and nothing else. Keying on the
      # lockfile would discard a 180MB browser every time an unrelated
      # dependency moved.
      - name: Resolve the Playwright version
        id: playwright
        run: |
          version=$(bun --print 'require("./package.json").devDependencies["@playwright/test"]')
          echo "version=$version" >> "$GITHUB_OUTPUT"

      - uses: actions/cache@v6
        with:
          path: ~/.cache/ms-playwright
          key: ms-playwright-${{ runner.os }}-${{ steps.playwright.outputs.version }}

      # Run unconditionally, cache hit or not: it makes the Playwright binary
      # available when the cache is cold. GitHub's Ubuntu image already ships
      # Chromium's shared libraries, so do not make E2E depend on its apt mirror.
      - run: bun node_modules/@playwright/test/cli.js install chromium

      - name: Wait for the client build and the databases
        wait: [build, databases]

      # Each runner owns its servers and databases. Keep two workers per runner so
      # motion assertions do not compete with more browser processes on the same
      # machine. `e2e/shard-balance.ts` replaces Playwright's equal-count split
      # with whole files placed by recorded duration; every file still runs once.
      - name: Browser integration
        run: >-
          bun run e2e --shard=${{ matrix.shard }}/${{ env.E2E_SHARDS }} --workers=2
          --reporter=github,blob,./e2e/shard-balance.ts
        env:
          E2E_SKIP_BUILD: "1"
          E2E_DATABASE_URL_0: postgresql://chopin:chopin@127.0.0.1:5433/chopin?sslmode=disable
          E2E_DATABASE_URL_1: postgresql://chopin:chopin@127.0.0.1:5434/chopin?sslmode=disable
          E2E_DATABASE_URL_2: postgresql://chopin:chopin@127.0.0.1:5435/chopin?sslmode=disable
          E2E_DATABASE_URL_3: postgresql://chopin:chopin@127.0.0.1:5436/chopin?sslmode=disable

      - name: Save integration report and attachments
        if: ${{ !cancelled() }}
        uses: actions/upload-artifact@v7
        with:
          name: browser-blob-report-${{ matrix.shard }}
          path: e2e/blob-report/*.zip
          if-no-files-found: error
          retention-days: 7

  # Two runners rather than three suites in a row. The suites cannot share one
  # runner side by side: each starts its own Vite dev server over the same
  # dependency cache.
  browser-design:
    name: browser ${{ matrix.suite }}
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        suite: [design, diagrams]
    steps:
      - uses: actions/checkout@v7

      - uses: oven-sh/setup-bun@v2
        with:
          bun-version: ${{ env.BUN_VERSION }}

      - run: bun install --frozen-lockfile

      - name: Resolve the Playwright version
        id: playwright
        run: |
          version=$(bun --print 'require("./package.json").devDependencies["@playwright/test"]')
          echo "version=$version" >> "$GITHUB_OUTPUT"

      - uses: actions/cache@v6
        with:
          path: ~/.cache/ms-playwright
          key: ms-playwright-${{ runner.os }}-${{ steps.playwright.outputs.version }}

      - run: bun node_modules/@playwright/test/cli.js install chromium

      - name: Design behaviour (keyboard, focus, motion, and scrolling)
        if: ${{ matrix.suite == 'design' }}
        run: bun run design:behavior

      - name: Development startup (optional feedback and navigation imports)
        if: ${{ matrix.suite == 'design' }}
        run: bun node_modules/@playwright/test/cli.js test --config e2e/startup/playwright.config.ts

      - name: Diagram gallery (rendering and keyboard behaviour)
        if: ${{ matrix.suite == 'diagrams' }}
        run: bun run diagrams:test

      - name: Save design and gallery results
        if: ${{ !cancelled() }}
        uses: actions/upload-artifact@v7
        with:
          name: browser-design-results-${{ matrix.suite }}
          path: e2e/.scratch/ci-reports/*.json
          include-hidden-files: true
          if-no-files-found: error
          retention-days: 7

      - if: ${{ !cancelled() && failure() }}
        uses: actions/upload-artifact@v7
        with:
          name: playwright-design-report-${{ matrix.suite }}
          path: |
            e2e/playwright-report
            e2e/test-results
          retention-days: 7

  # Keep the existing `e2e` check as the gate for every browser job and report. Producer success
  # alone is insufficient if a report is no longer available when the collector reruns.
  browser:
    name: e2e
    needs: [browser-integration, browser-design]
    # GitHub accepts skipped required checks, so cancellation must still reach the result gate.
    if: ${{ always() }}
    runs-on: ubuntu-latest
    env:
      CHOPIN_CI_HEAD_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
    steps:
      - uses: actions/checkout@v7

      - uses: oven-sh/setup-bun@v2
        with:
          bun-version: ${{ env.BUN_VERSION }}

      # The gate needs Playwright alone, at exactly the version that wrote the
      # blobs, rather than the whole workspace.
      - name: Resolve the Playwright version
        id: playwright
        run: |
          version=$(bun --print 'require("./package.json").devDependencies["@playwright/test"]')
          echo "version=$version" >> "$GITHUB_OUTPUT"

      - name: Collect integration reports
        id: blobs
        uses: actions/download-artifact@v8
        with:
          pattern: browser-blob-report-*
          path: e2e/blob-report
          merge-multiple: true

      - name: Merge integration results, retries, and traces
        if: ${{ !cancelled() && steps.blobs.outcome == 'success' }}
        run: |
          for shard in $(seq 1 "$E2E_SHARDS"); do
            if [ ! -f "e2e/blob-report/shard-$shard.zip" ]; then
              echo "::error::Missing integration report for shard $shard"
              exit 1
            fi
          done
          bunx -p "@playwright/test@$PLAYWRIGHT_VERSION" playwright merge-reports \
            --reporter=html,json e2e/blob-report
        env:
          PLAYWRIGHT_VERSION: ${{ steps.playwright.outputs.version }}
          PLAYWRIGHT_HTML_OPEN: never
          PLAYWRIGHT_HTML_OUTPUT_DIR: e2e/playwright-report/integration
          PLAYWRIGHT_JSON_OUTPUT_NAME: e2e/.scratch/ci-reports/integration.json

      - name: Collect design and gallery results
        if: ${{ !cancelled() }}
        uses: actions/download-artifact@v8
        with:
          pattern: browser-design-results-*
          path: e2e/.scratch/ci-reports
          merge-multiple: true

      - name: Require every browser job to pass
        if: ${{ always() }}
        env:
          INTEGRATION_RESULT: ${{ needs.browser-integration.result }}
          DESIGN_RESULT: ${{ needs.browser-design.result }}
        run: |
          test "$INTEGRATION_RESULT" = success
          test "$DESIGN_RESULT" = success
          test -f e2e/.scratch/ci-reports/design.json
          test -f e2e/.scratch/ci-reports/gallery.json
          test -f e2e/.scratch/ci-reports/integration.json

      - name: Summarise browser results and retries
        id: browser_summary
        if: ${{ !cancelled() }}
        run: bun scripts/browser-ci-summary.ts

      - name: Save browser result counts
        if: ${{ !cancelled() }}
        uses: actions/upload-artifact@v7
        with:
          name: browser-test-summary
          path: e2e/.scratch/ci-reports/*.json
          include-hidden-files: true
          if-no-files-found: error
          retention-days: 7

      # Retry passes need their traces too; the merged HTML report contains their attachments.
      - if: ${{ !cancelled() && (failure() || steps.browser_summary.outputs.has_flaky == 'true') }}
        uses: actions/upload-artifact@v7
        with:
          name: playwright-report
          path: |
            e2e/playwright-report
            e2e/test-results
          retention-days: 7

  # The `chopin` CLI is the connector compiled into one binary that runs without Bun. The smoke
  # test runs a fake investigation through it, so the agent starts the binary's own stdio bridge.
  cli:
    name: chopin CLI
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7

      - uses: oven-sh/setup-bun@v2
        with:
          bun-version: ${{ env.BUN_VERSION }}

      - run: bun install --frozen-lockfile

      - run: bun run --cwd apps/connector build:binaries bun-linux-x64 bun-windows-x64

      - run: ./dist/chopin-linux-x64 --version
        working-directory: apps/connector

      - name: Bridge smoke test from the compiled binary
        run: bun test apps/connector/src/binary.test.ts
        env:
          CHOPIN_BINARY: apps/connector/dist/chopin-linux-x64

      - uses: actions/upload-artifact@v7
        with:
          name: chopin-windows-x64
          path: apps/connector/dist/chopin-windows-x64.exe
          if-no-files-found: error
          retention-days: 1

  # Cross-compiled above; this checks that the .exe starts on Windows, and runs install.ps1
  # against a local fake release (the Linux job only sees it refuse to run outside Windows).
  cli-windows:
    name: chopin CLI (Windows)
    needs: cli
    runs-on: windows-latest
    steps:
      - uses: actions/checkout@v7

      - uses: oven-sh/setup-bun@v2
        with:
          bun-version: ${{ env.BUN_VERSION }}

      - uses: actions/download-artifact@v8
        with:
          name: chopin-windows-x64
          path: dist

      - run: ./dist/chopin-windows-x64.exe --version

      - name: install.ps1 against a fake release
        run: bun test apps/connector/install/install.test.ts

  container:
    name: container
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7

      - uses: docker/setup-buildx-action@v3
        with:
          buildkitd-config-inline: |
            [registry."docker.io"]
              mirrors = ["mirror.gcr.io"]

      - uses: docker/build-push-action@v6
        with:
          context: .
          push: false
          tags: chopin:test
          cache-from: type=gha
          cache-to: type=gha,mode=max