ci.yml

name: CI

on:
  push:
    branches: [main]
    paths:
      - "apps/**"
      - "packages/**"
      - "config/**"
      - "scripts/**"
      - "package.json"
      - "pnpm-lock.yaml"
      - "pnpm-workspace.yaml"
      - "tsconfig.base.json"
      - "vitest.config.ts"
      - "vitest.integration.config.ts"
      - ".github/workflows/ci.yml"
      - ".github/workflows/publish-cli.yml"
      - ".dockerignore"
      - "install-cli.sh"
      - "website/install-cli.sh"
  pull_request:
    branches: [main]
    paths:
      - "apps/**"
      - "packages/**"
      - "config/**"
      - "scripts/**"
      - "package.json"
      - "pnpm-lock.yaml"
      - "pnpm-workspace.yaml"
      - "tsconfig.base.json"
      - "vitest.config.ts"
      - "vitest.integration.config.ts"
      - ".github/workflows/ci.yml"
      - ".github/workflows/publish-cli.yml"
      - ".dockerignore"
      - "install-cli.sh"
      - "website/install-cli.sh"
  workflow_dispatch:

permissions:
  contents: read
  pull-requests: write
  issues: write

concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

jobs:
  # ---------------------------------------------------------------------------
  # CI Jobs — test, lint, build (run in parallel)
  # ---------------------------------------------------------------------------
  test:
    name: Unit Tests (${{ matrix.node-version }})
    needs: [detect-changes]
    if: >
      github.event_name == 'workflow_dispatch' ||
      needs.detect-changes.outputs.typescript == 'true'
    runs-on: ubuntu-latest

    strategy:
      matrix:
        node-version: [22]

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      # pnpm/action-setup@v4 is not allowed on EMU
      - name: Install pnpm
        run: |
          corepack enable
          corepack prepare pnpm@10.29.1 --activate
          pnpm --version

      - name: Setup Node.js ${{ matrix.node-version }}
        uses: actions/setup-node@v4
        with:
          node-version: ${{ matrix.node-version }}
          registry-url: "https://registry.npmjs.org"
          cache: "pnpm"

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Build shared packages
        run: pnpm --filter shared --filter github-auth build

      - name: Run tests with coverage
        run: pnpm test:coverage

      - name: Generate GitHub test summary from CTRF
        if: always()
        run: |
          pnpm exec github-actions-ctrf "ctrf/*-ctrf-report.json" --title "Test Results (Node.js ${{ matrix.node-version }})"

      - name: Upload coverage reports
        uses: actions/upload-artifact@v4
        if: always()
        with:
          name: coverage-reports-node-${{ matrix.node-version }}
          path: coverage/

      - name: Post coverage summary to Pull Request
        if: always() && github.event_name == 'pull_request'
        run: |
          node -e "
          const fs = require('fs');
          const summary = JSON.parse(fs.readFileSync('coverage/coverage-summary.json', 'utf8'));
          const t = summary.total;
          const pct = (v) => v.pct !== undefined && v.pct !== null ? v.pct + '%' : 'N/A';
          const lines = [
            '## 📊 Coverage Summary',
            '',
            '| Category | Coverage | Covered | Total |',
            '|----------|----------|---------|-------|',
            '| **Statements** | ' + pct(t.statements) + ' | ' + t.statements.covered + ' | ' + t.statements.total + ' |',
            '| **Branches** | ' + pct(t.branches) + ' | ' + t.branches.covered + ' | ' + t.branches.total + ' |',
            '| **Functions** | ' + pct(t.functions) + ' | ' + t.functions.covered + ' | ' + t.functions.total + ' |',
            '| **Lines** | ' + pct(t.lines) + ' | ' + t.lines.covered + ' | ' + t.lines.total + ' |',
          ];
          fs.appendFileSync(process.env.GITHUB_STEP_SUMMARY, lines.join('\n') + '\n');
          "
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Post test results to Pull Request
        if: always() && github.event_name == 'pull_request'
        run: |
          pnpm exec github-actions-ctrf pull-request "ctrf/*-ctrf-report.json" --title "Test Results (Node.js ${{ matrix.node-version }})" || {
            echo "⚠️ Failed to post PR comment (may be due to permissions)"
            echo "✅ Test results are still available in the Actions summary above"
            exit 0
          }
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Upload CTRF test results
        uses: actions/upload-artifact@v4
        if: always()
        with:
          name: ctrf-test-results-node-${{ matrix.node-version }}
          path: ctrf/

  # ---------------------------------------------------------------------------
  # LLM evals. Runs every *.eval.test.ts against a real LLM; each eval asserts on
  # a majority of N samples (non-deterministic, quota-costing). The criteria-prompt
  # orientation eval (origin: #1225) lives here today; adding more *.eval.test.ts
  # files makes them run in this same job. Path-filtered to eval files + prompt-gen
  # source and required via CI Summary (success-or-skipped). Self-skips when no LLM
  # token is present.
  # ---------------------------------------------------------------------------
  llm-evals:
    name: LLM Evals
    needs: [detect-changes]
    if: >
      (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) &&
      (github.event_name == 'workflow_dispatch' || needs.detect-changes.outputs.evals == 'true')
    runs-on: ubuntu-latest
    permissions:
      contents: read
      models: read

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      # pnpm/action-setup@v4 is not allowed on EMU
      - name: Install pnpm
        run: |
          corepack enable
          corepack prepare pnpm@10.29.1 --activate
          pnpm --version

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: "22"
          registry-url: "https://registry.npmjs.org"
          cache: "pnpm"

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Build shared packages
        run: pnpm --filter shared build

      - name: Run LLM evals
        run: npx vitest run --config vitest.eval.config.ts --silent=false
        env:
          # A real GitHub PAT is required here: the generator calls the legacy
          # GitHub Models endpoint (models.inference.ai.azure.com), which the
          # ephemeral Actions GITHUB_TOKEN is NOT valid against (that only works
          # with the newer models.github.ai/inference endpoint). COPILOT_GITHUB_TOKEN
          # is an existing PAT secret. If it lacks model access, add a dedicated
          # GITHUB_MODELS_API_KEY secret (a PAT with models scope) and read it here.
          GITHUB_TOKEN: ${{ secrets.COPILOT_GITHUB_TOKEN }}
          CRITERIA_EVAL_SAMPLES: "3"

      - name: Generate GitHub test summary from CTRF
        if: always()
        run: |
          pnpm exec github-actions-ctrf "ctrf/*-eval-ctrf-report.json" --title "LLM Eval Results" || true

      - name: Upload CTRF eval results
        uses: actions/upload-artifact@v4
        if: always()
        with:
          name: ctrf-eval-results
          path: ctrf/
          if-no-files-found: ignore

  integration-test:
    name: Integration Tests (${{ matrix.worker.name }})
    needs: [detect-changes]
    if: >-
      github.repository == 'microsoft/scope' &&
      (
        github.event_name == 'workflow_dispatch' ||
        needs.detect-changes.outputs.ci == 'true' ||
        needs.detect-changes.outputs.coder-acp-copilot == 'true' ||
        needs.detect-changes.outputs.coder-acp-claude-code == 'true' ||
        needs.detect-changes.outputs.shared == 'true'
      )
    runs-on: ubuntu-latest
    permissions:
      contents: read
    env:
      TRUSTED_CODE: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
      DOCKERHUB_LOGIN_ENABLED: ${{ secrets.DOCKERHUB_USERNAME != '' && secrets.DOCKERHUB_TOKEN != '' }}

    strategy:
      fail-fast: false
      matrix:
        worker:
          - name: copilot-acp
            dockerfile: apps/workers/coder-acp-copilot/Dockerfile
            versions_env: apps/workers/coder-acp-copilot/versions.env
            test_pattern: apps/workers/coder-acp-copilot
            images: |
              source apps/workers/coder-acp-copilot/versions.env
              docker buildx build \
                -t coder-acp-copilot-integration-test \
                -f apps/workers/coder-acp-copilot/Dockerfile \
                --target dev \
                --build-arg COPILOT_CLI_VERSION=$COPILOT_CLI_VERSION \
                --cache-from type=local,src=/tmp/.buildx-cache \
                --cache-to type=local,dest=/tmp/.buildx-cache-new,mode=min \
                --load \
                .
          - name: claude-code-acp
            dockerfile: apps/workers/coder-acp-claude-code/Dockerfile
            versions_env: apps/workers/coder-acp-claude-code/versions.env
            test_pattern: apps/workers/coder-acp-claude-code
            images: |
              source apps/workers/coder-acp-claude-code/versions.env
              docker buildx build \
                -t coder-acp-claude-code-integration-test \
                -f apps/workers/coder-acp-claude-code/Dockerfile \
                --target dev \
                --build-arg CLAUDE_CODE_ACP_VERSION=$CLAUDE_CODE_ACP_VERSION \
                --build-arg CLAUDE_AGENT_SDK_VERSION=$CLAUDE_AGENT_SDK_VERSION \
                --cache-from type=local,src=/tmp/.buildx-cache \
                --cache-to type=local,dest=/tmp/.buildx-cache-new,mode=min \
                --load \
                .

    steps:
      - name: Free disk space
        run: |
          sudo rm -rf /usr/local/lib/android /usr/share/dotnet /opt/ghc \
            /usr/local/share/boost /usr/local/graalvm /usr/local/share/chromium \
            /usr/local/.ghcup /opt/hostedtoolcache/CodeQL
          sudo docker image prune --all --force
          df -h /

      - name: Checkout repository
        uses: actions/checkout@v4

      # pnpm/action-setup@v4 is not allowed on EMU
      - name: Install pnpm
        run: |
          corepack enable
          corepack prepare pnpm@10.29.1 --activate
          pnpm --version

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: "22"
          registry-url: "https://registry.npmjs.org"
          cache: "pnpm"

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Build shared packages
        run: pnpm --filter shared --filter github-auth build

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v4.0.0
        with:
          driver: docker-container

      - name: Cache Docker layers
        uses: actions/cache@v4
        with:
          path: /tmp/.buildx-cache
          key: docker-${{ matrix.worker.name }}-${{ hashFiles(matrix.worker.dockerfile, matrix.worker.versions_env) }}
          restore-keys: docker-${{ matrix.worker.name }}-

      - name: Log in to Docker Hub
        if: env.TRUSTED_CODE == 'true' && env.DOCKERHUB_LOGIN_ENABLED == 'true'
        uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      - name: Pre-build Docker test images
        run: |
          ${{ matrix.worker.images }}
          # Rotate cache to avoid unbounded growth
          if [ -d /tmp/.buildx-cache-new ]; then
            rm -rf /tmp/.buildx-cache
            mv /tmp/.buildx-cache-new /tmp/.buildx-cache
          fi

      - name: Run integration tests
        run: npx vitest run --config vitest.integration.config.ts --silent=false ${{ matrix.worker.test_pattern }}
        env:
          GH_AUTH_USERNAME: ${{ env.TRUSTED_CODE == 'true' && secrets.GH_AUTH_USERNAME || '' }}
          GH_AUTH_PASSWORD: ${{ env.TRUSTED_CODE == 'true' && secrets.GH_AUTH_PASSWORD || '' }}
          GH_AUTH_TOTP_SECRET: ${{ env.TRUSTED_CODE == 'true' && secrets.GH_AUTH_TOTP_SECRET || '' }}
          GITHUB_TOKEN: ${{ env.TRUSTED_CODE == 'true' && secrets.COPILOT_GITHUB_TOKEN || '' }}
          # NOTE: Claude Code credentials disabled — out of budget.
          # The expensive "completes coding prompts" test auto-skips when
          # these are absent; tool-check tests still run.
          # ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
          # CLAUDE_CODE_OAUTH_TOKEN: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}

      - name: Generate GitHub test summary from CTRF
        if: always()
        run: |
          pnpm exec github-actions-ctrf "ctrf/*-integration-ctrf-report.json" --title "Integration Test Results (${{ matrix.worker.name }})" || true

      - name: Upload CTRF integration test results
        uses: actions/upload-artifact@v4
        if: always()
        with:
          name: ctrf-integration-test-results-${{ matrix.worker.name }}
          path: ctrf/
          if-no-files-found: ignore

      - name: Upload test snapshots
        uses: actions/upload-artifact@v4
        if: always()
        with:
          name: test-snapshots-${{ matrix.worker.name }}
          path: test-snapshots/
          if-no-files-found: ignore

      - name: Collect test videos
        if: always()
        run: |
          mkdir -p test-videos
          i=0; find apps/workers -type f -path "*/test-output/*" -name "*.webm" | sort | while IFS= read -r f; do
            cp "$f" "test-videos/recording-$i.webm"
            i=$((i+1))
          done

      - name: Upload test videos
        uses: actions/upload-artifact@v4
        if: always()
        with:
          name: test-videos-${{ matrix.worker.name }}
          path: test-videos/
          if-no-files-found: ignore

  # ---------------------------------------------------------------------------
  # Queue recovery integration tests (stuck-run fix). Self-provision their own
  # MongoDB/Redis/Azurite via testcontainers — no docker-compose infra needed.
  # ---------------------------------------------------------------------------
  integration-test-queue:
    name: Integration Tests (queue recovery)
    needs: [detect-changes]
    if: >-
      github.repository == 'microsoft/scope' &&
      (
        github.event_name == 'workflow_dispatch' ||
        needs.detect-changes.outputs.ci == 'true' ||
        needs.detect-changes.outputs.shared == 'true' ||
        needs.detect-changes.outputs.scheduler == 'true'
      )
    runs-on: ubuntu-latest
    permissions:
      contents: read
    env:
      DOCKERHUB_LOGIN_ENABLED: ${{ secrets.DOCKERHUB_USERNAME != '' && secrets.DOCKERHUB_TOKEN != '' }}

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      # pnpm/action-setup@v4 is not allowed on EMU
      - name: Install pnpm
        run: |
          corepack enable
          corepack prepare pnpm@10.29.1 --activate
          pnpm --version

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: "22"
          registry-url: "https://registry.npmjs.org"
          cache: "pnpm"

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      # The scheduler reaper test imports CodingAgentQueueProcessor from the
      # built `shared` dist (the integration config resolves bare imports to
      # dist, not source), so shared must be built first.
      - name: Build shared packages
        run: pnpm --filter shared build

      # Authenticate when available on trusted code; fork PRs use public images
      # anonymously so missing secrets do not prevent these local-service tests.
      - name: Log in to Docker Hub
        if: >-
          env.DOCKERHUB_LOGIN_ENABLED == 'true' &&
          (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository)
        uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      - name: Run queue recovery integration tests
        run: pnpm vitest run --config vitest.integration.config.ts --silent=false packages/shared/src/queue/redelivery.integration.test.ts apps/scheduler/src/stuck-run-reaper.integration.test.ts

      - name: Generate GitHub test summary from CTRF
        if: always()
        run: |
          pnpm exec github-actions-ctrf "ctrf/*-integration-ctrf-report.json" --title "Integration Test Results (queue recovery)" || true

      - name: Upload CTRF integration test results
        uses: actions/upload-artifact@v4
        if: always()
        with:
          name: ctrf-integration-test-results-queue-recovery
          path: ctrf/
          if-no-files-found: ignore

  lint:
    name: Lint Code
    needs: [detect-changes]
    if: >
      github.event_name == 'workflow_dispatch' ||
      needs.detect-changes.outputs.typescript == 'true'
    runs-on: ubuntu-latest

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      # pnpm/action-setup@v4 is not allowed on EMU
      - name: Install pnpm
        run: |
          corepack enable
          corepack prepare pnpm@10.29.1 --activate
          pnpm --version

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: "22"
          registry-url: "https://registry.npmjs.org"
          cache: "pnpm"

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Lint
        # TODO: remove continue-on-error once ESLint is added as a dependency
        continue-on-error: true
        run: pnpm lint

  build:
    name: Build Applications
    needs: [detect-changes]
    if: >
      github.event_name == 'workflow_dispatch' ||
      needs.detect-changes.outputs.typescript == 'true'
    runs-on: ubuntu-latest

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      # pnpm/action-setup@v4 is not allowed on EMU
      - name: Install pnpm
        run: |
          corepack enable
          corepack prepare pnpm@10.29.1 --activate
          pnpm --version

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: "22"
          registry-url: "https://registry.npmjs.org"
          cache: "pnpm"

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Build
        run: pnpm build

  cli-bundle-test:
    name: CLI Bundle Integration Tests
    needs: [detect-changes]
    if: >
      github.event_name == 'workflow_dispatch' ||
      needs.detect-changes.outputs.typescript == 'true'
    runs-on: ubuntu-latest

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Install pnpm
        run: |
          corepack enable
          corepack prepare pnpm@10.29.1 --activate

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: "22"
          cache: "pnpm"

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Build CLI bundle
        run: pnpm build:cli

      - name: Run integration tests
        run: pnpm vitest run --config vitest.integration.config.ts apps/cli/src/bundle.integration.test.ts apps/cli/src/utils/update-check.integration.test.ts

      - name: Upload CLI bundle
        uses: actions/upload-artifact@v4
        with:
          name: scope-cli-bundle
          path: apps/cli/dist/scope.mjs
          retention-days: 7

  # ---------------------------------------------------------------------------
  # License headers — verify every first-party source file carries the
  # Microsoft MIT header. Not gated on detect-changes: it always runs so the
  # check is enforced on every PR. Run `pnpm headers` locally to add any that
  # are missing (same include/exclude set as the check).
  # ---------------------------------------------------------------------------
  license-headers:
    name: License Headers
    runs-on: ubuntu-latest

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      # pnpm/action-setup@v4 is not allowed on EMU
      - name: Install pnpm
        run: |
          corepack enable
          corepack prepare pnpm@10.29.1 --activate
          pnpm --version

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: "22"
          registry-url: "https://registry.npmjs.org"
          cache: "pnpm"

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Verify license headers
        run: pnpm headers:check

  gateway:
    name: "Gateway: lint, test & build"
    needs: [detect-changes]
    if: >
      github.event_name == 'workflow_dispatch' ||
      needs.detect-changes.outputs.gateway == 'true'
    runs-on: ubuntu-latest

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@1.94.1
        with:
          toolchain: 1.94.1
          components: rustfmt, clippy

      - name: Cache Cargo registry + build
        uses: Swatinem/rust-cache@v2.9.1
        with:
          workspaces: apps/gateway
          # Fall back to the most recent partial cache when Cargo.lock changes,
          # rather than starting cold. The exact-match key still takes priority.
          save-if: ${{ github.ref == 'refs/heads/main' }}

      - name: Install cargo-nextest
        run: |
          curl -LsSf https://get.nexte.st/latest/linux | tar zxf - -C ${CARGO_HOME:-~/.cargo}/bin

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: "22"

      - name: Check formatting
        working-directory: apps/gateway
        run: cargo fmt --check

      - name: Clippy
        working-directory: apps/gateway
        run: cargo clippy --all-targets -- -D warnings

      - name: Run tests (nextest + JUnit XML)
        working-directory: apps/gateway
        run: cargo nextest run --profile ci

      - name: Convert JUnit XML to CTRF
        if: always()
        run: |
          npx junit-to-ctrf apps/gateway/target/nextest/ci/junit.xml \
            -o ctrf/gateway-ctrf-report.json \
            -t gateway

      - name: Generate GitHub test summary from CTRF
        if: always()
        run: |
          npx github-actions-ctrf "ctrf/gateway-ctrf-report.json" --title "Gateway: lint, test & build"

      - name: Post test results to Pull Request
        if: always() && github.event_name == 'pull_request'
        run: |
          npx github-actions-ctrf pull-request "ctrf/gateway-ctrf-report.json" --title "Gateway: lint, test & build" || {
            echo "⚠️ Failed to post PR comment (may be due to permissions)"
            exit 0
          }
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Upload CTRF test results
        uses: actions/upload-artifact@v4
        if: always()
        with:
          name: ctrf-test-results-gateway
          path: ctrf/

  notice-check:
    name: Third-party NOTICE
    # Runs on every PR with no detect-changes gate: the NOTICE / NOTICE-REVIEW
    # attributions must always match the installed production dependencies.
    # Dependency, script and config edits are the only changes that can stale it
    # and they all fall under this workflow's paths filter, so a drifted NOTICE
    # can never slip through unnoticed.
    runs-on: ubuntu-latest

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      # pnpm/action-setup@v4 is not allowed on EMU
      - name: Install pnpm
        run: |
          corepack enable
          corepack prepare pnpm@10.29.1 --activate
          pnpm --version

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: "22"
          registry-url: "https://registry.npmjs.org"
          cache: "pnpm"

      # --ignore-scripts skips postinstall native downloads (Playwright browsers,
      # etc.): the NOTICE only depends on which packages and LICENSE files are
      # present, which the lockfile fully determines, so this stays exact while
      # being faster.
      - name: Install dependencies
        run: pnpm install --frozen-lockfile --ignore-scripts

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@1.94.1
        with:
          toolchain: 1.94.1

      # cargo-about only reads `cargo metadata` + each crate's LICENSE file, so
      # this caches the crates.io index and downloaded sources — no target build.
      - name: Cache Cargo registry
        uses: Swatinem/rust-cache@v2.9.1
        with:
          workspaces: apps/gateway
          save-if: ${{ github.ref == 'refs/heads/main' }}

      # Cache the prebuilt cargo-about binary so warm runs skip the download.
      - name: Cache cargo-about
        id: cache-cargo-about
        uses: actions/cache@v4
        with:
          path: ~/.cargo/bin/cargo-about
          key: cargo-about-0.9.1-${{ runner.os }}-x86_64

      - name: Install cargo-about
        if: steps.cache-cargo-about.outputs.cache-hit != 'true'
        run: |
          mkdir -p "${CARGO_HOME:-$HOME/.cargo}/bin"
          curl -LsSf "https://github.com/EmbarkStudios/cargo-about/releases/download/0.9.1/cargo-about-0.9.1-x86_64-unknown-linux-musl.tar.gz" \
            | tar zxf - --strip-components=1 -C "${CARGO_HOME:-$HOME/.cargo}/bin" \
                "cargo-about-0.9.1-x86_64-unknown-linux-musl/cargo-about"

      - name: Show cargo-about version
        run: cargo-about --version

      # Regenerates NOTICE + NOTICE-REVIEW.txt from the installed dependencies and
      # fails if they differ from the committed files (verbatim, tool-extracted).
      - name: Verify NOTICE is up to date
        run: pnpm notice:check

  windows-build:
    name: Windows Worker Build
    needs: [detect-changes]
    if: >
      github.repository == 'microsoft/scope' &&
      (github.event_name == 'workflow_dispatch' ||
      needs.detect-changes.outputs.ci == 'true' ||
      needs.detect-changes.outputs.coder-acp-copilot-windows == 'true' ||
      needs.detect-changes.outputs.coder-acp-copilot == 'true' ||
      needs.detect-changes.outputs.shared == 'true')
    runs-on: windows-2022
    timeout-minutes: 60
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@v4
        with:
          persist-credentials: false
      - name: Build and smoke-test local Windows images
        shell: pwsh
        run: ./scripts/build-windows-worker.ps1

  # ---------------------------------------------------------------------------
  # Detect changed components (runs in parallel with CI jobs)
  # ---------------------------------------------------------------------------
  detect-changes:
    runs-on: ubuntu-latest
    outputs:
      ci: ${{ steps.changes.outputs.ci }}
      api: ${{ steps.changes.outputs.api }}
      judge: ${{ steps.changes.outputs.judge }}
      portal: ${{ steps.changes.outputs.portal }}
      coder-acp-copilot: ${{ steps.changes.outputs.coder-acp-copilot }}
      coder-acp-claude-code: ${{ steps.changes.outputs.coder-acp-claude-code }}
      token-manager: ${{ steps.changes.outputs.token-manager }}
      model-scanner-copilot: ${{ steps.changes.outputs.model-scanner-copilot }}
      model-scanner-anthropic: ${{ steps.changes.outputs.model-scanner-anthropic }}
      report-generator: ${{ steps.changes.outputs.report-generator }}
      post-processor: ${{ steps.changes.outputs.post-processor }}
      scheduler: ${{ steps.changes.outputs.scheduler }}
      db-migrations: ${{ steps.changes.outputs.db-migrations }}
      shared: ${{ steps.changes.outputs.shared }}
      gateway: ${{ steps.changes.outputs.gateway }}
      coder-acp-copilot-windows: ${{ steps.changes.outputs.coder-acp-copilot-windows }}
      model-scanning: ${{ steps.changes.outputs.model-scanning }}
      typescript: ${{ steps.changes.outputs.typescript }}
      evals: ${{ steps.changes.outputs.evals }}
    steps:
      - uses: actions/checkout@v4
        if: github.event_name == 'push' || github.event_name == 'pull_request'
      - uses: dorny/paths-filter@v3.0.2
        if: github.event_name == 'push' || github.event_name == 'pull_request'
        id: changes
        with:
          base: ${{ github.event.before }}
          filters: |
            ci:
              - '.github/workflows/ci.yml'
              - 'scripts/ci-workflow.test.ts'
            shared:
              - 'packages/shared/**'
              - 'package.json'
              - 'pnpm-lock.yaml'
              - 'tsconfig.base.json'
            model-scanning:
              - 'packages/model-scanning/**'
            api:
              - 'apps/api/**'
            judge:
              - 'apps/judge/**'
            portal:
              - 'apps/portal/**'
            coder-acp-copilot:
              - 'apps/workers/coder-acp-copilot/**'
              - 'packages/test-utils/**'
            coder-acp-claude-code:
              - 'apps/workers/coder-acp-claude-code/**'
              - 'packages/copilot-driver-ext/**'
              - 'packages/test-utils/**'
            token-manager:
              - 'apps/token-manager/**'
            model-scanner-copilot:
              - 'apps/model-scanners/copilot/**'
            model-scanner-anthropic:
              - 'apps/model-scanners/anthropic/**'
            report-generator:
              - 'apps/workers/report-generator/**'
            post-processor:
              - 'apps/workers/post-processor/**'
            scheduler:
              - 'apps/scheduler/**'
            db-migrations:
              - 'packages/db-migrations/**'
            gateway:
              - 'apps/gateway/**'
            coder-acp-copilot-windows:
              - 'apps/workers/coder-acp-copilot-windows/**'
              - 'apps/workers/coder-acp-copilot/versions.env'
              - 'packages/telemetry/**'
              - 'scripts/build-windows-worker.ps1'
              - 'pnpm-workspace.yaml'
              - '.dockerignore'
              - 'packages/test-utils/**'
            typescript:
              - '.github/workflows/ci.yml'
              - '.github/workflows/publish-cli.yml'
              - 'scripts/ci-workflow.test.ts'
              - 'scripts/install-cli.test.ts'
              - 'scripts/build-windows-worker.test.ts'
              - 'scripts/build-windows-worker.ps1'
              - 'install-cli.sh'
              - 'website/install-cli.sh'
              - '.dockerignore'
              - 'pnpm-workspace.yaml'
              - 'apps/**'
              - '!apps/gateway/**'
              - 'packages/**'
              - 'package.json'
              - 'pnpm-lock.yaml'
              - 'tsconfig.base.json'
              - 'vitest.config.ts'
              - 'vitest.integration.config.ts'
            evals:
              - '**/*.eval.test.ts'
              - 'apps/api/src/llm.ts'
              - 'apps/api/src/llm-token.ts'
              - 'vitest.eval.config.ts'
              - 'packages/llm-eval/**'

  # ---------------------------------------------------------------------------
  # Summary
  # ---------------------------------------------------------------------------
  ci-summary:
    name: CI Summary
    runs-on: ubuntu-latest
    needs: [test, integration-test, integration-test-queue, windows-build, lint, build, cli-bundle-test, gateway, llm-evals, notice-check, license-headers]
    if: always()

    steps:
      - name: Check overall status
        run: |
          if [ "${{ needs.test.result }}" = "success" ] && \
             [ "${{ needs.integration-test.result }}" = "success" -o "${{ needs.integration-test.result }}" = "skipped" ] && \
             [ "${{ needs.integration-test-queue.result }}" = "success" -o "${{ needs.integration-test-queue.result }}" = "skipped" ] && \
             [ "${{ needs.windows-build.result }}" = "success" -o "${{ needs.windows-build.result }}" = "skipped" ] && \
             [ "${{ needs.lint.result }}" = "success" ] && \
             [ "${{ needs.build.result }}" = "success" ] && \
             [ "${{ needs.cli-bundle-test.result }}" = "success" -o "${{ needs.cli-bundle-test.result }}" = "skipped" ] && \
             [ "${{ needs.llm-evals.result }}" = "success" -o "${{ needs.llm-evals.result }}" = "skipped" ] && \
             [ "${{ needs.notice-check.result }}" = "success" -o "${{ needs.notice-check.result }}" = "skipped" ] && \
             [ "${{ needs.license-headers.result }}" = "success" ] && \
             [ "${{ needs.gateway.result }}" = "success" -o "${{ needs.gateway.result }}" = "skipped" ]; then
            echo "✅ All checks passed!"
            exit 0
          else
            echo "❌ Some checks failed:"
            echo "  Unit Tests: ${{ needs.test.result }}"
            echo "  Integration Tests: ${{ needs.integration-test.result }}"
            echo "  Integration Tests (queue recovery): ${{ needs.integration-test-queue.result }}"
            echo "  Windows Worker Build: ${{ needs.windows-build.result }}"
            echo "  Lint: ${{ needs.lint.result }}"
            echo "  Build: ${{ needs.build.result }}"
            echo "  CLI Bundle Tests: ${{ needs.cli-bundle-test.result }}"
            echo "  LLM Evals: ${{ needs.llm-evals.result }}"
            echo "  Third-party NOTICE: ${{ needs.notice-check.result }}"
            echo "  License Headers: ${{ needs.license-headers.result }}"
            echo "  Gateway: ${{ needs.gateway.result }}"
            exit 1
          fi