ci.yml

name: CI

on:
  push:
    branches:
      - main
  pull_request:
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: zcode-cli-ci-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true

jobs:
  validate:
    runs-on: ubuntu-latest
    timeout-minutes: 45
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
        with:
          persist-credentials: false

      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
        with:
          node-version: 22.19.0
          package-manager-cache: false

      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
        with:
          bun-version: 1.4.1

      - name: Install extraction tools
        run: sudo apt-get update && sudo apt-get install -y p7zip-full

      - name: Install dependencies
        run: bun install --frozen-lockfile

      - name: Build and test
        run: bun run release:build

      # Platform probing only checks that a transport is theoretically
      # supported. It cannot prove that this hosted runner has the required
      # kernel capability, helper, and mount privileges. Keep the real mount
      # test opt-in for a runner explicitly configured for Mountx; otherwise
      # the regular scenario test still covers the probe and skip behavior.
      - name: Run Mountx integration on an explicitly configured runner
        if: ${{ vars.ZCODE_TEST_MOUNTX == '1' }}
        timeout-minutes: 3
        run: timeout --foreground 120s env ZCODE_TEST_MOUNTX=1 bun test test/tui/scenario-mountx.test.ts

      - name: Pack and install-test
        run: bun run release:pack

      - name: Verify repository and npm metadata
        run: |
          npm pkg fix --dry-run --json
          git diff --check
          git diff --exit-code -- package.json zcode-runtime.lock.json

      # Transfer the exact validated package, preserving executable bits in
      # its tarball. Matrix jobs must not extract a different upstream runtime.
      - name: Upload runtime under test
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        with:
          name: node-runtime-under-test
          path: |
            .release/*.tgz
            .release/release.json
          include-hidden-files: true
          if-no-files-found: error
          retention-days: 3

  node-runtime:
    needs: validate
    name: Node ${{ matrix.node }} / ${{ matrix.os }}
    runs-on: ${{ matrix.os }}
    timeout-minutes: 20
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest]
        # validate already runs every suite and install-checks the package on
        # Node 22.19.0 / Linux. Only add distinct runtime environments here.
        node: ["24", "26"]
        include:
          - os: macos-latest
            node: "24"
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
        with:
          persist-credentials: false

      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
        with:
          node-version: ${{ matrix.node }}
          package-manager-cache: false

      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
        with:
          bun-version: 1.4.1

      - name: Install test dependencies
        run: bun install --frozen-lockfile

      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
        with:
          name: node-runtime-under-test
          path: .release

      - name: Restore validated runtime and launcher
        shell: bash
        run: |
          RUNTIME_TARBALL=$(node -p "JSON.parse(require('fs').readFileSync('.release/release.json', 'utf8')).tarball")
          tar -xzf "$RUNTIME_TARBALL" --strip-components=1
          node --version
          bun --version

      - name: Verify Node runtime and packaged installation
        run: |
          bun scripts/check-runtime.ts
          bun scripts/smoke-package.ts

      # Business-logic regressions run once in validate. Exercise the boundaries
      # affected by Node/OS differences here: launch, HTTP streaming, app-server
      # auth, both terminal modes, and the real SQLite driver below.
      - name: Run Node and OS compatibility tests
        run: bun run test:runtime:compat

      - name: Run real Node SQLite concurrency tests
        run: bun run test:node