ci.yml

name: CI

on:
  workflow_call:
  push:
    branches: [main]
  # Every pull request, whatever it targets. Restricting this to `main` meant a
  # PR stacked on another branch got no CI at all — which is exactly when a
  # second opinion is most useful, since the base is itself unreviewed.
  pull_request:

permissions:
  contents: read

concurrency:
  group: ci-${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

jobs:
  check:
    name: Check
    runs-on: ubuntu-24.04
    timeout-minutes: 20
    steps:
      # `npm ci` runs install scripts from the whole Astro dependency tree.
      # Nothing here pushes, so the job token does not need to survive checkout.
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
          persist-credentials: false

      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version-file: go.mod
          cache-dependency-path: go.sum

      # The documentation site is part of the gate: `just check` builds it, and
      # the build is what enforces the agent-facing invariants — llms.txt fails
      # on a documentation section it would omit, and check-tables.mjs fails on a
      # table that would ship outside its scroll container.
      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: 26.7.0
          cache: npm
          cache-dependency-path: site/package-lock.json

      # just is installed from its pinned release asset rather than through
      # extractions/setup-just. That action resolves the version through the
      # GitHub releases API on every run, and when that lookup returns nothing —
      # rate limiting is the usual cause on shared runners — it fails with
      # `no release for just matching version specifier`, before a line of this
      # repository is compiled. Pinning the version did not help: the lookup is
      # what breaks, not the version. A direct URL has no lookup to fail.
      #
      # The checksum is the point of doing it this way rather than piping a
      # script from the internet into a shell: what CI executes is exactly the
      # artifact this line names, or the job stops.
      - name: Install just
        run: |
          set -euo pipefail
          version=1.58.0
          archive=just-${version}-x86_64-unknown-linux-musl.tar.gz
          sha=4a5cc2f53e6f0f8c59092a6cc38291eb729d46a7dd95d3ae582008881b84931d
          curl -fsSL --retry 3 -o "$archive" \
            "https://github.com/casey/just/releases/download/${version}/${archive}"
          echo "${sha}  ${archive}" | sha256sum --check --strict -
          tar -xzf "$archive" just
          install -m 0755 just /usr/local/bin/just
          rm -f "$archive" just
          just --version

      - name: Install govulncheck
        run: go install golang.org/x/vuln/cmd/govulncheck@v1.7.0

      - name: Install actionlint
        run: go install github.com/rhysd/actionlint/cmd/actionlint@v1.7.12

      - name: Install golangci-lint
        uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a # v9.3.0
        with:
          version: v2.13.1
          install-mode: binary
          args: --help

      - name: Install site dependencies
        run: npm ci --prefix site

      - name: Verify repository
        run: just ci

      - name: Validate GoReleaser configuration
        uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7.2.3
        with:
          distribution: goreleaser
          version: v2.18.0
          args: check

      - name: Build release snapshot
        uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7.2.3
        with:
          distribution: goreleaser
          version: v2.18.0
          args: release --snapshot --clean

      - name: Inspect release snapshot
        run: scripts/verify-release-dist.sh dist

      # A green run should leave the tree exactly as it was found. The generated
      # reference pages are committed, so a regeneration nobody committed means
      # the tree disagrees with the binary that just built it.
      #
      # `git status --porcelain`, not `git diff`: a new registry block generates a
      # new page, and an untracked file is invisible to `git diff`. The check
      # would have missed the case most likely to occur.
      - name: Fail on an uncommitted change
        run: |
          if [ -n "$(git status --porcelain)" ]; then
            echo "The working tree changed during verification:" >&2
            git status --porcelain >&2
            git --no-pager diff >&2
            exit 1
          fi

  native-smoke:
    name: Native CLI smoke (${{ matrix.os }})
    runs-on: ${{ matrix.os }}
    timeout-minutes: 15
    strategy:
      fail-fast: false
      matrix:
        os:
          - ubuntu-24.04
          - macos-15
          - windows-2025
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version-file: go.mod
          cache-dependency-path: go.sum

      - name: Build native CLI
        run: go build -o ob-smoke${{ runner.os == 'Windows' && '.exe' || '' }} ./cmd/ob

      - name: Exercise safe CLI surfaces
        run: |
          ./ob-smoke${{ runner.os == 'Windows' && '.exe' || '' }} version
          ./ob-smoke${{ runner.os == 'Windows' && '.exe' || '' }} --help
          ./ob-smoke${{ runner.os == 'Windows' && '.exe' || '' }} schema --out "${{ runner.temp }}/onebox.run-v1.schema.json"

  e2e:
    name: End-to-end (Docker)
    runs-on: ubuntu-24.04
    timeout-minutes: 30
    # Kept out of the Check job so that starting containers, pulling images and
    # waiting on health checks never delays the answer to "does this compile,
    # lint and pass unit tests". The suite also fails for reasons Check cannot —
    # a daemon that is wedged rather than code that is wrong.
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version-file: go.mod
          cache-dependency-path: go.sum

      # just is installed from its pinned release asset rather than through
      # extractions/setup-just. That action resolves the version through the
      # GitHub releases API on every run, and when that lookup returns nothing —
      # rate limiting is the usual cause on shared runners — it fails with
      # `no release for just matching version specifier`, before a line of this
      # repository is compiled. Pinning the version did not help: the lookup is
      # what breaks, not the version. A direct URL has no lookup to fail.
      #
      # The checksum is the point of doing it this way rather than piping a
      # script from the internet into a shell: what CI executes is exactly the
      # artifact this line names, or the job stops.
      - name: Install just
        run: |
          set -euo pipefail
          version=1.58.0
          archive=just-${version}-x86_64-unknown-linux-musl.tar.gz
          sha=4a5cc2f53e6f0f8c59092a6cc38291eb729d46a7dd95d3ae582008881b84931d
          curl -fsSL --retry 3 -o "$archive" \
            "https://github.com/casey/just/releases/download/${version}/${archive}"
          echo "${sha}  ${archive}" | sha256sum --check --strict -
          tar -xzf "$archive" just
          install -m 0755 just /usr/local/bin/just
          rm -f "$archive" just
          just --version

      - name: Confirm the Docker daemon is usable
        run: docker version

      - name: Run the end-to-end suite
        run: just e2e