test.yml

name: test

on:
  push:
    branches:
      - main
  workflow_dispatch:

concurrency:
  # Keep every run on dev so cancelled checks do not pollute the default branch
  # commit history. PRs and other branches still share a group and cancel stale runs.
  group: ${{ case(github.ref == 'refs/heads/dev', format('{0}-{1}', github.workflow, github.run_id), format('{0}-{1}', github.workflow, github.event.pull_request.number || github.ref)) }}
  cancel-in-progress: true

permissions:
  contents: read
  checks: write

env:
  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true

jobs:
  public-source-boundary:
    name: public-source-boundary
    runs-on: ubuntu-24.04
    steps:
      - name: Checkout complete history
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
        with:
          fetch-depth: 0
          persist-credentials: false

      - name: Setup Bun
        uses: ./.github/actions/setup-bun

      - name: Verify public documents and complete history
        run: bun script/check-public-source-boundary.ts --history

  test-fixture-gate:
    name: test-fixture-gate
    # QUAL-003: forbid test fixtures from bypassing the durable session state
    # machine via direct inserts into authority tables. Pure grep gate, no deps.
    runs-on: ubuntu-24.04
    defaults:
      run:
        shell: bash
    steps:
      - name: Checkout repository
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
        with:
          token: ${{ secrets.GITHUB_TOKEN }}

      - name: Setup Bun
        uses: ./.github/actions/setup-bun

      - name: Run test fixture gate
        run: bun script/check-test-fixtures.ts

  manifest-digest-gate:
    name: manifest-digest-gate
    # K-05/B-11: the C7-10 deterministic manifest must reproduce from the committed
    # tree on any machine — byte-stable across runs, pinned to head-pin.ts, every
    # digest input git-tracked, and git-ignored .artifacts/ residue unable to
    # perturb the digest. Pure stateless gate, mirrors the test-fixture-gate pattern.
    runs-on: ubuntu-24.04
    defaults:
      run:
        shell: bash
    steps:
      - name: Checkout repository
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
        with:
          token: ${{ secrets.GITHUB_TOKEN }}

      - name: Setup Bun
        uses: ./.github/actions/setup-bun

      - name: Run manifest digest reproducibility gate
        working-directory: packages/core
        run: bun run manifest:assert-reproducible

  unit:
    name: unit (${{ matrix.settings.name }})
    strategy:
      fail-fast: false
      matrix:
        settings:
          - name: linux
            host: ubuntu-24.04
            timeout: 20
          - name: windows
            host: windows-2025
            timeout: 20
          - name: macos
            host: macos-14
            timeout: 120
    runs-on: ${{ matrix.settings.host }}
    defaults:
      run:
        shell: bash
    steps:
      - name: Checkout repository
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
        with:
          token: ${{ secrets.GITHUB_TOKEN }}

      - name: Setup Node
        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
        with:
          node-version: "24"

      - name: Setup Bun
        uses: ./.github/actions/setup-bun

      - name: Configure git identity
        run: |
          git config --global user.email "bot@ai.deepagent.ltd"
          git config --global user.name "deepagent-code"

      - name: Cache Turbo
        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
        with:
          path: node_modules/.cache/turbo
          key: turbo-${{ runner.os }}-${{ hashFiles('turbo.json', '**/package.json') }}-${{ github.sha }}
          restore-keys: |
            turbo-${{ runner.os }}-${{ hashFiles('turbo.json', '**/package.json') }}-
            turbo-${{ runner.os }}-

      - name: Install locked IM SDK build tools
        run: npm ci --ignore-scripts --prefix packages/im-kernel-sdk/upstream

      - name: Install locked Chromium for component IndexedDB
        working-directory: packages/app
        run: bun x playwright install --only-shell --with-deps chromium

      - name: Prepare test search dependency
        run: |
          if ! bun -e 'process.exit(Bun.which("rg") ? 0 : 1)'; then
            if [[ "$RUNNER_OS" == 'Linux' ]]; then
              sudo apt-get update
              sudo apt-get install --no-install-recommends -y ripgrep
            elif [[ "$RUNNER_OS" == 'macOS' ]]; then
              brew install ripgrep
            else
              choco install ripgrep --yes --no-progress
            fi
          fi
          bun -e 'if (!Bun.which("rg")) throw new Error("ripgrep test executable is unavailable")'
          rg --version

      - name: Prepare the locked Linux Electron sandbox
        if: runner.os == 'Linux'
        run: |
          dac_electron_sandbox=$(node -p 'require("node:path").join(require("node:path").dirname(require("./packages/desktop/node_modules/electron")), "chrome-sandbox")')
          test -f "$dac_electron_sandbox"
          sudo chown root:root "$dac_electron_sandbox"
          sudo chmod 4755 "$dac_electron_sandbox"
          test "$(stat -c '%U:%G:%a' "$dac_electron_sandbox")" = 'root:root:4755'
          command -v xvfb-run

      - name: Run unit tests
        timeout-minutes: ${{ matrix.settings.timeout }}
        run: |
          if [[ "$RUNNER_OS" == 'Linux' ]]; then
            xvfb-run -a --server-args='-screen 0 1920x1080x24' bun run test:ci --log-order=stream --log-prefix=task
          else
            bun run test:ci --log-order=stream --log-prefix=task
          fi
        env:
          DEEPAGENT_CODE_EXPERIMENTAL_DISABLE_FILEWATCHER: ${{ runner.os == 'Windows' && 'true' || 'false' }}

      - name: Run HttpApi exerciser gates
        if: runner.os == 'Linux'
        working-directory: packages/deepagent-code
        run: bun run test:httpapi

      - name: Publish unit reports
        if: always()
        uses: mikepenz/action-junit-report@bccf2e31636835cf0874589931c4116687171386 # v6.4.0
        with:
          report_paths: |
            packages/*/.artifacts/unit/junit.xml
            .artifacts/unit/junit.xml
          check_name: "unit results (${{ matrix.settings.name }})"
          detailed_summary: true
          include_time_in_summary: true
          fail_on_failure: false

      - name: Upload unit artifacts
        if: always()
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          name: unit-${{ matrix.settings.name }}-${{ github.run_attempt }}
          include-hidden-files: true
          if-no-files-found: ignore
          retention-days: 7
          path: |
            packages/*/.artifacts/unit/junit.xml
            .artifacts/unit/junit.xml

  desktop-smoke:
    name: desktop-smoke (macos)
    # The prevent-sleep smoke drives the real packaged main bundle through Playwright and asserts
    # against pmset, so it needs a macOS runner with a window server; keep it out of the unit matrix.
    runs-on: macos-14
    defaults:
      run:
        shell: bash
    steps:
      - name: Checkout repository
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
        with:
          token: ${{ secrets.GITHUB_TOKEN }}

      - name: Setup Node
        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
        with:
          node-version: "24"

      - name: Setup Bun
        uses: ./.github/actions/setup-bun

      - name: Build desktop main bundle
        working-directory: packages/desktop
        run: bun run build
        timeout-minutes: 15

      - name: Run prevent-sleep smoke
        working-directory: packages/desktop
        run: bun run test:prevent-sleep-smoke
        timeout-minutes: 10

  e2e:
    name: e2e (${{ matrix.settings.name }})
    strategy:
      fail-fast: false
      matrix:
        settings:
          - name: linux
            host: ubuntu-24.04
          - name: windows
            host: windows-2025
    runs-on: ${{ matrix.settings.host }}
    env:
      PLAYWRIGHT_BROWSERS_PATH: ${{ github.workspace }}/.playwright-browsers
    defaults:
      run:
        shell: bash
    steps:
      - name: Checkout repository
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
        with:
          token: ${{ secrets.GITHUB_TOKEN }}

      - name: Setup Node
        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
        with:
          node-version: "24"

      - name: Setup Bun
        uses: ./.github/actions/setup-bun

      - name: Read Playwright version
        id: playwright-version
        run: |
          version=$(node -e 'console.log(require("./package.json").workspaces.catalog["@playwright/test"])')
          echo "version=$version" >> "$GITHUB_OUTPUT"

      - name: Cache Playwright browsers
        id: playwright-cache
        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
        with:
          path: ${{ github.workspace }}/.playwright-browsers
          key: ${{ runner.os }}-${{ runner.arch }}-playwright-${{ steps.playwright-version.outputs.version }}-chromium

      - name: Install Playwright system dependencies
        if: runner.os == 'Linux'
        working-directory: packages/app
        run: bunx playwright install-deps chromium

      - name: Install Playwright browsers
        if: steps.playwright-cache.outputs.cache-hit != 'true'
        working-directory: packages/app
        run: bunx playwright install chromium

      - name: Run app e2e tests
        run: bun --cwd packages/app test:e2e:local
        env:
          CI: true
          PLAYWRIGHT_JUNIT_OUTPUT: e2e/junit-${{ matrix.settings.name }}.xml
        timeout-minutes: 30

      - name: Upload Playwright artifacts
        if: always()
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          name: playwright-${{ matrix.settings.name }}-${{ github.run_attempt }}
          if-no-files-found: ignore
          retention-days: 7
          path: |
            packages/app/e2e/junit-*.xml
            packages/app/e2e/test-results
            packages/app/e2e/playwright-report