ci.yml

name: CI

on:
  push:
    branches: [master, dev]
  pull_request:
    branches: [master, dev]
    types: [opened, synchronize, reopened, ready_for_review]
  merge_group:

permissions:
  contents: read
  pull-requests: read

# A superseded PR run (force-push / new commit) is pure waste and its jobs
# hold runner slots that other runs then queue behind — cancel it outright.
# Pushes and merge-queue runs are never cancelled: `github.ref` is unique per
# merge-queue attempt, and successive pushes to dev/master just queue.
concurrency:
  group: ci-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

env:
  CARGO_TERM_COLOR: always
  CARGO_INCREMENTAL: "0"

jobs:
  changes:
    name: Detect changes
    runs-on: ubuntu-latest
    outputs:
      rust: ${{ steps.filter.outputs.rust }}
      infra: ${{ steps.filter.outputs.infra }}
      dashboard: ${{ steps.filter.outputs.dashboard }}
      sdk: ${{ steps.filter.outputs.sdk }}
      deps: ${{ steps.filter.outputs.deps }}
      subdomains: ${{ steps.filter.outputs.subdomains }}
      tooling: ${{ steps.filter.outputs.tooling }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: dorny/paths-filter@ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d # v4.0.3
        id: filter
        with:
          # Every path a build, test or gate reads belongs to some filter, or
          # a PR touching only that path skips every substantive job and
          # `ci-ok` goes green on nothing. Deliberately in no filter, because
          # no CI job reads them and running one would prove nothing: prose
          # (docs/**, root *.md other than SKILL.md, LICENSE), the generated
          # SCHEMA.sql reference dump, .gitignore/.dockerignore, agent and
          # editor config (.claude/**, .mcp.json, .actrc, .env.example) and
          # the dev-only test-mcp-elicitation/ probe. `docs` still runs.
          filters: |
            rust:
              - 'crates/**'
              # Workspace member (mock upstream for the integration tests).
              - 'tests/mock-target/**'
              - 'Cargo.toml'
              - 'Cargo.lock'
              - 'rust-toolchain.toml'
              - 'clippy.toml'
              - '.sqlx/**'
              - '.config/nextest.toml'
              # Shipped templates: the registry corpus tests load every file.
              - 'services/**'
              # Compiled in via include_str! (icons.rs, slugs.rs, SKILL.md)
              # and cross-checked against the templates by registry tests.
              - 'assets/**'
              - 'SKILL.md'
              # lint runs the line-count / rust-version gates, e2e runs
              # `make e2e` → scripts/e2e-up.sh.
              - 'scripts/**'
              - 'Makefile'
              - '.github/actions/**'
              - 'codecov.yml'
              - '.github/workflows/ci.yml'
            infra:
              - 'infra/**'
              - '.github/workflows/ci.yml'
            dashboard:
              - 'dashboard/**'
              - '.github/workflows/ci.yml'
            sdk:
              - 'sdk/**'
              - '.github/workflows/ci.yml'
            deps:
              - '**/Cargo.toml'
              - 'Cargo.lock'
              - 'dashboard/package.json'
              - 'dashboard/package-lock.json'
              - 'sdk/package.json'
              - 'sdk/package-lock.json'
              - 'deny.toml'
              - 'osv-scanner.toml'
              - 'scripts/check-deny-reviews.sh'
              - 'scripts/check-security-txt.sh'
              - 'dashboard/static/.well-known/security.txt'
              - 'scripts/check-subdomains.sh'
              - 'docs/compliance/casa/subdomain-inventory.md'
              - '.github/workflows/deps-audit.yml'
              - '.github/workflows/ci.yml'
            # The subset that runs the subdomain check against live DNS. Any
            # other `deps` change gets the offline table parse only, so DNS
            # drift or a resolver hiccup cannot block a lockfile PR.
            subdomains:
              - 'scripts/check-subdomains.sh'
              - 'docs/compliance/casa/subdomain-inventory.md'
            # CI and release plumbing no other job exercises: the other
            # workflows (release, release-please, sync-dev, allocate-decision,
            # deps-audit-report), dependabot and release-please config, the
            # git hooks, and the operator scripts under bin/ and docker/.
            tooling:
              - '.github/**'
              - '.githooks/**'
              - 'scripts/**'
              - 'bin/**'
              - 'docker/**'
              - 'Makefile'
              - 'release-please-config.json'
              - '.release-please-manifest.json'

  # Unconditional, unlike `lint`: the `rust` paths filter skips a docs-only PR,
  # which is exactly the PR that moves a decision number. Checkout plus bash,
  # no toolchain, so it costs seconds. Runs on merge_group too, which is where
  # a number that went stale during review finally becomes visible.
  docs:
    name: Docs (decision numbering)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          # On a pull_request the checked-out ref is refs/pull/N/merge, whose
          # first parent is the base tip — cheaper and more reliable than
          # fetching origin/<base> by name.
          fetch-depth: 2
      - name: Decision numbering gate
        env:
          # Only against dev. A PR into master is the release PR, where every
          # decision merged since the last release is legitimately numbered
          # and would otherwise read as newly hardcoded.
          BASE_REF: ${{ github.event_name == 'pull_request' && github.base_ref == 'dev' && 'HEAD^1' || '' }}
          # dev tolerates a placeholder for the minute before the allocator
          # workflow runs; master never may.
          STRICT_ALLOCATED: ${{ (github.ref == 'refs/heads/master' || github.base_ref == 'master') && '1' || '' }}
        run: bash scripts/check-decisions.sh

  # Lint and the sqlx offline-cache check share one job: both are short
  # (~1.5 min each), neither is on the critical path (coverage is), and one
  # fewer job per run means one fewer runner slot competing with coverage
  # when the org hits its concurrency limit.
  lint:
    name: Lint + SQLx Verify
    needs: changes
    if: needs.changes.outputs.rust == 'true'
    runs-on: ubuntu-latest
    services:
      postgres:
        image: pgvector/pgvector:pg16
        env:
          POSTGRES_USER: overslash
          POSTGRES_PASSWORD: overslash
          POSTGRES_DB: overslash
        ports:
          - 5432:5432
        options: >-
          --health-cmd pg_isready
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5
    env:
      DATABASE_URL: postgres://overslash:overslash@localhost:5432/overslash
      SECRETS_ENCRYPTION_KEY: "0000000000000000000000000000000000000000000000000000000000000000"
      SIGNING_KEY: "1111111111111111111111111111111111111111111111111111111111111111"
      SQLX_OFFLINE: "true"
    steps:
      - name: Tune Postgres for CI (durability off; data is throwaway)
        run: |
          PGPASSWORD=overslash psql -h localhost -U overslash -d overslash <<'SQL'
          ALTER SYSTEM SET fsync = 'off';
          ALTER SYSTEM SET full_page_writes = 'off';
          ALTER SYSTEM SET synchronous_commit = 'off';
          ALTER SYSTEM SET wal_compression = 'off';
          ALTER SYSTEM SET wal_writer_delay = '10s';
          ALTER SYSTEM SET commit_delay = '100000';
          ALTER SYSTEM SET work_mem = '32MB';
          SELECT pg_reload_conf();
          SQL
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      # Before the toolchain, so an oversized file fails in seconds rather
      # than after ~1.5 min of setup. Needs nothing but git and awk.
      - name: Line-count gate (crates/*/src)
        run: bash scripts/check-line-counts.sh

      # Same rationale as the line-count gate: nothing but bash, so a toolchain
      # pin that drifted from the Dockerfiles fails in seconds. rust-toolchain.toml
      # is .dockerignore'd, so this check is the only thing linking the two.
      - name: Rust version gate (Dockerfiles vs rust-toolchain.toml)
        run: bash scripts/check-rust-version.sh

      - uses: dtolnay/rust-toolchain@4be7066ada62dd38de10e7b70166bc74ed198c30 # stable branch
        with:
          # Pinned explicitly rather than left to the action's `stable` default:
          # keep in sync with rust-toolchain.toml, or the action installs one
          # toolchain and cargo silently downloads another on the first build.
          toolchain: "1.98"
          components: rustfmt, clippy
      # The `key` suffix must be rotated whenever [profile.*] settings in
      # Cargo.toml change: rust-cache's primary key doesn't hash profiles, so
      # without a rotation it restores stale artifacts that refingerprint
      # (full rebuild every run) and never saves the new ones because the
      # primary key already exists. -deps-opt1 dates from the
      # [profile.dev.package."*"] opt-level bump.
      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
        with:
          key: lint-deps-opt1
      # cdn.pyke.io (ort-sys prebuilt binaries) 403s from CI runners; seed
      # its cache from a release asset so cold-cache builds don't touch it.
      - uses: ./.github/actions/seed-ort-cache
      # Pin sqlx-cli to 0.9 so the CLI's offline-cache format matches the
      # workspace sqlx 0.9 (the .sqlx/ files it verifies).
      - uses: taiki-e/install-action@8cca0918f8471c33515202b73f56ab27f2bed283 # v2.87.29
        with:
          tool: sqlx-cli@0.9

      - name: Format check
        run: cargo fmt --check

      - name: Clippy
        run: cargo clippy --workspace --all-targets -- -D warnings

      - name: Ban sqlx::test (use common::test_pool instead)
        run: |
          if grep -rn 'sqlx::test' crates/*/tests/; then
            echo "::error::Found sqlx::test usage. Use #[tokio::test] + common::test_pool() instead."
            exit 1
          fi

      - name: Run migrations
        run: cargo sqlx migrate run --source crates/overslash-db/migrations

      - name: Verify sqlx offline cache
        run: cargo sqlx prepare --workspace --check -- --tests

  # Single job, not a shard matrix. Sharding only pays when test execution
  # dominates; here it never did — every shard paid the full ~3m36s compile
  # to run 25-53s of tests (run 29754452256). Five shards therefore bought
  # ~3 min of wall clock for 5x the runner time, and those five slots were
  # the main thing queueing behind the org concurrency limit. Consolidating
  # the api integration tests into one binary (crates/overslash-api/tests/
  # api.rs) cut the compile enough that one job runs the whole suite in
  # about what a single shard used to take.
  coverage:
    name: Test + Coverage
    needs: changes
    if: needs.changes.outputs.rust == 'true'
    runs-on: ubuntu-latest
    services:
      postgres:
        image: pgvector/pgvector:pg16
        env:
          POSTGRES_USER: overslash
          POSTGRES_PASSWORD: overslash
          POSTGRES_DB: overslash
        ports:
          - 5432:5432
        options: >-
          --health-cmd pg_isready
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5
      valkey:
        image: valkey/valkey:8-alpine
        ports:
          - 6380:6379
        options: >-
          --health-cmd "valkey-cli ping"
          --health-interval 5s
          --health-timeout 3s
          --health-retries 5
    env:
      DATABASE_URL: postgres://overslash:overslash@localhost:5432/overslash
      SECRETS_ENCRYPTION_KEY: "0000000000000000000000000000000000000000000000000000000000000000"
      SIGNING_KEY: "1111111111111111111111111111111111111111111111111111111111111111"
      SQLX_OFFLINE: "true"
      # Points oversla-sh integration tests at the valkey service above.
      VALKEY_URL: redis://localhost:6380
      # Same service, the name the API crate reads. Without it the resolver
      # cache (D64) falls back to its in-memory store and the Redis backend —
      # the one a deployed instance actually uses — ships unexercised.
      REDIS_URL: redis://localhost:6380
    steps:
      # Free ~25 GB of pre-installed tooling we never use (Android SDK,
      # .NET, Haskell, CodeQL, cached Docker images, etc.) so the
      # combined footprint of the Rust target/ tree, llvm-cov .profraw
      # files, and runner _diag logs doesn't push the disk to 100%.
      # Without this, mid-run writes occasionally fail with
      # `System.IO.IOException: No space left on device` from the runner's
      # own log handle, which surfaces as a confusing job failure that
      # has nothing to do with the tests themselves.
      #
      # Runs in the background so its ~90s doesn't sit on the critical path:
      # the deleted paths are not touched by any later step, and the deletion
      # finishes long before disk pressure builds (peak usage is during the
      # test run, ~3 min in). Orphaned background processes survive step
      # boundaries for the lifetime of the job.
      - name: Free disk space on runner (background)
        run: |
          (sudo rm -rf /usr/share/dotnet /usr/local/lib/android /opt/ghc \
             /opt/hostedtoolcache/CodeQL /usr/local/share/boost \
             "$AGENT_TOOLSDIRECTORY"
           sudo docker image prune --all --force
           df -h /) >"$RUNNER_TEMP/free-disk-space.log" 2>&1 &
      # max_connections needs a full restart (not just a reload): the ci
      # nextest profile runs 8 tests concurrently, each with its own pools
      # (test pool + in-process API server pool), so the default 100 is too
      # tight. fsync/full_page_writes off speeds up the per-test
      # `CREATE DATABASE … TEMPLATE` clones — data is throwaway.
      - name: Tune Postgres for CI (durability off; data is throwaway)
        run: |
          PGPASSWORD=overslash psql -h localhost -U overslash -d overslash <<'SQL'
          ALTER SYSTEM SET fsync = 'off';
          ALTER SYSTEM SET full_page_writes = 'off';
          ALTER SYSTEM SET synchronous_commit = 'off';
          ALTER SYSTEM SET wal_compression = 'off';
          ALTER SYSTEM SET wal_writer_delay = '10s';
          ALTER SYSTEM SET commit_delay = '100000';
          ALTER SYSTEM SET work_mem = '32MB';
          ALTER SYSTEM SET max_connections = '500';
          SQL
          docker restart ${{ job.services.postgres.id }}
          # Fail the step if Postgres never comes back (timeout exits 124)
          # instead of letting the test step run against a dead database.
          timeout 60 bash -c 'until pg_isready -h localhost -U overslash; do sleep 1; done'
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: dtolnay/rust-toolchain@4be7066ada62dd38de10e7b70166bc74ed198c30 # stable branch
        with:
          # See the lint job for why the toolchain is pinned explicitly (and
          # must stay in sync with rust-toolchain.toml).
          toolchain: "1.98"
          # rust-toolchain.toml declares rustfmt + clippy, so rustup fetches
          # them on the first cargo call whether or not they are listed here.
          # Listing them keeps that cost in the setup step instead of buried,
          # untimed, inside the first build.
          components: rustfmt, clippy, llvm-tools-preview
      # See the lint job for why the key carries a -deps-opt1 suffix (and
      # must be rotated again on the next [profile.*] change).
      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
        with:
          key: coverage-deps-opt1
      # cdn.pyke.io (ort-sys prebuilt binaries) 403s from CI runners; seed
      # its cache from a release asset so cold-cache builds don't touch it.
      - uses: ./.github/actions/seed-ort-cache
      # mold replaces the system linker (no RUSTFLAGS change, so cached
      # artifacts stay valid). Linking ~99 instrumented test binaries is
      # the bulk of a warm-cache "compile" phase; mold cuts it sharply.
      - uses: rui314/setup-mold@da13e0b42e392e3a45d1215033a2270b849d7d36 # v1 (mutable tag)
      - uses: taiki-e/install-action@8cca0918f8471c33515202b73f56ab27f2bed283 # v2.87.29
        with:
          tool: cargo-llvm-cov,cargo-nextest

      # --profile ci selects the nextest profile in .config/nextest.toml
      # (test-threads = 8 — the suite is IO-bound, see the profile comments).
      - name: Tests with coverage
        run: >-
          cargo llvm-cov nextest --workspace
          --profile ci
          --lcov --output-path lcov.info
        env:
          RUST_LOG: warn

      - name: Upload coverage to Codecov
        uses: codecov/codecov-action@303a32d7a59b442fa8d48b6a1cc6825c09c847a5 # v7.1.1
        with:
          files: lcov.info
          token: ${{ secrets.CODECOV_TOKEN }}
          slug: overfolder/overslash
          # Coverage reporting is non-critical — don't block CI on Codecov-side
          # flakes (e.g. upstream GPG signature verification failures on their
          # CLI binary). Tests themselves still gate the merge.
          fail_ci_if_error: false

  # D42/D43: the SQL-policy classifier is behind the default-off `sql_policy`
  # feature (it builds vendored libpg_query — a C dep the default jobs must
  # not pay for), so nothing above compiles it. This job is the feature's
  # only CI surface: clippy + the classifier matrix + the feature-gated
  # Metabase integration tier (mock upstream; the real-Metabase suite stays
  # local behind `make metabase-e2e`).
  sql-policy:
    name: SQL Policy (feature)
    needs: changes
    if: needs.changes.outputs.rust == 'true'
    runs-on: ubuntu-latest
    services:
      postgres:
        image: pgvector/pgvector:pg16
        env:
          POSTGRES_USER: overslash
          POSTGRES_PASSWORD: overslash
          POSTGRES_DB: overslash
        ports:
          - 5432:5432
        options: >-
          --health-cmd pg_isready
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5
    env:
      DATABASE_URL: postgres://overslash:overslash@localhost:5432/overslash
      SECRETS_ENCRYPTION_KEY: "0000000000000000000000000000000000000000000000000000000000000000"
      SIGNING_KEY: "1111111111111111111111111111111111111111111111111111111111111111"
      SQLX_OFFLINE: "true"
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: dtolnay/rust-toolchain@4be7066ada62dd38de10e7b70166bc74ed198c30 # stable branch
        with:
          # See the lint job for why the toolchain is pinned explicitly (and
          # must stay in sync with rust-toolchain.toml).
          toolchain: "1.98"
          # rust-toolchain.toml declares rustfmt + clippy, so rustup fetches
          # them on the first cargo call whether or not they are listed here.
          # Listing them keeps that cost in the setup step instead of buried,
          # untimed, inside the first build.
          components: rustfmt, clippy
      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
        with:
          key: sql-policy-deps
      - uses: ./.github/actions/seed-ort-cache
      - uses: rui314/setup-mold@da13e0b42e392e3a45d1215033a2270b849d7d36 # v1 (mutable tag)
      # bindgen (pg_query's build) needs libclang; make it deterministic
      # rather than relying on the runner image's LLVM layout.
      - name: Install libclang
        run: sudo apt-get update -qq && sudo apt-get install -y -qq libclang-dev
      - name: Clippy (feature on)
        run: cargo clippy -p overslash-core -p overslash-api --all-targets --features sql_policy -- -D warnings
      - name: Classifier matrix (overslash-core)
        run: cargo test -p overslash-core --features sql_policy sql_policy
      - name: Feature-gated integration tier (overslash-api)
        run: cargo test -p overslash-api --features sql_policy --test api metabase
        env:
          RUST_LOG: warn

  infra:
    name: Infrastructure
    needs: changes
    if: needs.changes.outputs.infra == 'true'
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: infra

    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Install OpenTofu
        uses: opentofu/setup-opentofu@a1320f892987e89d278cc92dc5adc984fb93aca4 # v2.0.2
        with:
          tofu_version: "1.13"
          tofu_wrapper: false

      - name: Format check
        run: tofu fmt -check -recursive

      - name: Initialize
        run: tofu init -backend=false

      - name: Validate
        run: tofu validate

  dashboard:
    name: Dashboard
    needs: changes
    if: needs.changes.outputs.dashboard == 'true'
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: dashboard
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
        with:
          node-version: "24"
          cache: npm
          cache-dependency-path: dashboard/package-lock.json
      - name: Install dependencies
        run: npm ci
      - name: Type check (svelte-check)
        run: npm run check
      - name: Build (strict — fails on any warning)
        run: npm run build:strict
      - name: Build Storybook (component workbench → components.overslash.com)
        run: npm run build-storybook

  sdk:
    name: SDK (@overslash/sdk)
    needs: changes
    if: needs.changes.outputs.sdk == 'true'
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: sdk
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
        with:
          node-version: "24"
          cache: npm
          cache-dependency-path: sdk/package-lock.json
      - name: Install dependencies
        run: npm ci
      - name: Type check
        run: npm run check
      - name: Unit tests
        run: npm test
      - name: Build
        run: npm run build

  e2e:
    name: E2E (Playwright)
    needs: changes
    if: needs.changes.outputs.rust == 'true' || needs.changes.outputs.dashboard == 'true'
    runs-on: ubuntu-latest
    services:
      postgres:
        image: pgvector/pgvector:pg16
        env:
          POSTGRES_USER: overslash
          POSTGRES_PASSWORD: overslash
          POSTGRES_DB: overslash
        ports:
          - 5432:5432
        options: >-
          --health-cmd pg_isready
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5
    env:
      DATABASE_URL: postgres://overslash:overslash@localhost:5432/overslash
      SQLX_OFFLINE: "true"
    steps:
      - name: Set WORKTREE_STATE_DIR to a per-job temp dir
        run: echo "WORKTREE_STATE_DIR=$RUNNER_TEMP" >> "$GITHUB_ENV"
      # e2e-up builds the API with sql_policy (matching the release build);
      # bindgen for the vendored libpg_query needs libclang.
      - name: Install libclang
        run: sudo apt-get update -qq && sudo apt-get install -y -qq libclang-dev
      - name: Tune Postgres for CI (durability off; data is throwaway)
        run: |
          PGPASSWORD=overslash psql -h localhost -U overslash -d overslash <<'SQL'
          ALTER SYSTEM SET fsync = 'off';
          ALTER SYSTEM SET full_page_writes = 'off';
          ALTER SYSTEM SET synchronous_commit = 'off';
          ALTER SYSTEM SET wal_compression = 'off';
          ALTER SYSTEM SET wal_writer_delay = '10s';
          ALTER SYSTEM SET commit_delay = '100000';
          ALTER SYSTEM SET work_mem = '32MB';
          SELECT pg_reload_conf();
          SQL
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: dtolnay/rust-toolchain@4be7066ada62dd38de10e7b70166bc74ed198c30 # stable branch
        with:
          # See the lint job for why the toolchain is pinned explicitly (and
          # must stay in sync with rust-toolchain.toml).
          toolchain: "1.98"
          # rust-toolchain.toml declares rustfmt + clippy, so rustup fetches
          # them on the first cargo call whether or not they are listed here.
          # Listing them keeps that cost in the setup step instead of buried,
          # untimed, inside the first build.
          components: rustfmt, clippy
      # See the lint job for why the key carries a -deps-opt1 suffix (and
      # must be rotated again on the next [profile.*] change).
      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
        with:
          key: e2e-deps-opt1
      # cdn.pyke.io (ort-sys prebuilt binaries) 403s from CI runners; seed
      # its cache from a release asset so cold-cache builds don't touch it.
      - uses: ./.github/actions/seed-ort-cache
      - uses: rui314/setup-mold@da13e0b42e392e3a45d1215033a2270b849d7d36 # v1 (mutable tag)
      - uses: taiki-e/install-action@8cca0918f8471c33515202b73f56ab27f2bed283 # v2.87.29
        with:
          tool: sqlx-cli@0.9
      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
        with:
          node-version: "24"
          cache: npm
          cache-dependency-path: dashboard/package-lock.json

      - name: Install dashboard dependencies
        working-directory: dashboard
        run: npm ci --include=dev

      - name: Install Playwright browsers
        working-directory: dashboard
        run: npx playwright install --with-deps chromium

      - name: Run e2e suite
        run: make e2e

      - name: Upload Playwright trace artifacts on failure
        if: failure()
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: playwright-traces
          # `runner.temp` is available in step `with:` (unlike job-level `env:`).
          # The harness writes its state dir at $WORKTREE_STATE_DIR/.e2e/ which
          # we set to runner.temp in the first step.
          path: |
            dashboard/test-results
            ${{ runner.temp }}/.e2e
          if-no-files-found: ignore
          retention-days: 7

  # CASA 6.1.1: cargo-deny + npm audit + OSV over every lockfile. The jobs
  # live in deps-audit.yml so its daily schedule (which catches advisories
  # published against an unchanged lockfile) runs the exact same checks.
  # Here it gates only changes that can alter the dependency set or the
  # scanner config — see that file for why an unrelated PR is not blocked by
  # a fresh advisory. No toolchain, no build: well under a minute.
  deps-audit:
    name: Dependency audit
    needs: changes
    if: needs.changes.outputs.deps == 'true'
    uses: ./.github/workflows/deps-audit.yml
    with:
      subdomains-live: ${{ needs.changes.outputs.subdomains == 'true' }}

  # Static checks for the files no other job reads: actionlint over every
  # workflow (expression typos, unknown `needs`, bad action inputs — the
  # mistakes that otherwise surface only when a release or schedule fires),
  # and a parse of every hook, script and release-please config. The rest of
  # the Makefile is exercised by e2e (`make e2e`). shellcheck/pyflakes are off on
  # purpose: the runner image ships shellcheck, so leaving it implicit would
  # make the result depend on whatever version the image carries.
  tooling:
    name: Workflows + scripts
    needs: changes
    if: needs.changes.outputs.tooling == 'true'
    runs-on: ubuntu-latest
    env:
      ACTIONLINT_VERSION: "1.7.12"
      ACTIONLINT_SHA256: 8aca8db96f1b94770f1b0d72b6dddcb1ebb8123cb3712530b08cc387b349a3d8
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Install actionlint (checksum-pinned)
        run: |
          tarball="actionlint_${ACTIONLINT_VERSION}_linux_amd64.tar.gz"
          curl -sSfLo "$RUNNER_TEMP/$tarball" \
            "https://github.com/rhysd/actionlint/releases/download/v${ACTIONLINT_VERSION}/$tarball"
          echo "$ACTIONLINT_SHA256  $RUNNER_TEMP/$tarball" | sha256sum -c -
          tar -xzf "$RUNNER_TEMP/$tarball" -C "$RUNNER_TEMP" actionlint
      - name: actionlint
        run: '"$RUNNER_TEMP/actionlint" -color -shellcheck= -pyflakes='
      - name: Bash syntax (hooks + scripts)
        run: |
          status=0
          for f in .githooks/* scripts/*.sh scripts/lib/*.sh bin/*.sh docker/*/*.sh; do
            bash -n "$f" || { echo "::error file=$f::bash -n failed"; status=1; }
          done
          exit "$status"
      - name: Python syntax (scripts)
        run: python3 -m py_compile scripts/*.py
      - name: release-please config parses
        run: jq empty release-please-config.json .release-please-manifest.json

  # Reports how much *production code* the PR touches: files under `src/`,
  # source extensions only, test files, the test-support crates and inline
  # `#[cfg(test)]` modules stripped out. `git diff --shortstat` is useless here
  # — one `make sqlx-prepare` run dwarfs a real change — so this is the number
  # to size a review by.
  #
  # Purely informational, and deliberately absent from `ci-ok`'s `needs`: a
  # reporter must never block a merge. If the script itself breaks, the job
  # still shows a red X in the PR's check list — visible without being a gate.
  #
  # Not wired to the `changes` paths-filter on purpose: every PR gets a number,
  # including the docs-only ones (where the number is zero, which is the point).
  diff-stats:
    name: PR diff size
    if: github.event_name == 'pull_request'
    runs-on: ubuntu-latest
    # The workflow default is `pull-requests: read`; the sticky comment needs
    # write. Scoped to this job rather than hoisted — no other job posts.
    permissions:
      contents: read
      pull-requests: write
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          # The script diffs against the merge-base, so it needs real history.
          fetch-depth: 0

      # A PR that touches no `src/` file exercises only the empty path, so the
      # interesting code (rename pairing, test stripping, per-crate grouping,
      # recovering paths from `git diff --no-index`) could sit broken and green.
      # This runs the whole pipeline over a synthetic repo with known-correct
      # expected counts. stdlib-only Python 3.10+; the runner ships 3.12, so no
      # setup-python step.
      - name: Self-test
        run: ./scripts/pr-diff-stats.py --self-test

      - name: Measure code diff
        id: stats
        run: |
          ./scripts/pr-diff-stats.py \
            "${{ github.event.pull_request.base.sha }}" \
            "${{ github.event.pull_request.head.sha }}" \
            --out pr-diff-stats.md
          cat pr-diff-stats.md >> "$GITHUB_STEP_SUMMARY"
          {
            echo 'markdown<<PR_DIFF_STATS_EOF'
            cat pr-diff-stats.md
            echo 'PR_DIFF_STATS_EOF'
          } >> "$GITHUB_OUTPUT"

      # The step summary above already carries the number, so a fork PR — where
      # `GITHUB_TOKEN` is read-only and this step fails — still reports it.
      - name: Comment on PR
        uses: marocchino/sticky-pull-request-comment@5770ad5eb8f42dd2c4f34da00c94c5381e49af88 # v3.0.5
        with:
          header: diff-stats
          message: ${{ steps.stats.outputs.markdown }}

  # The one required check. Each gated job must have *succeeded* if its
  # paths filter says the PR needs it, and may be skipped only when the filter
  # says it does not — so a job skipped for any other reason (a broken `if:`,
  # an output the `changes` job forgot to export) fails the gate instead of
  # passing it. `changes` and `docs` always run. `failure` and `cancelled`
  # never pass: a cancelled run proved nothing. A job listed in `needs` but
  # missing from the map below is treated as always required.
  #
  # `always()`, not `!cancelled()`: a required check that is *skipped* counts
  # as passing, so a cancelled workflow must still reach this job and fail it.
  # A superseded PR run therefore shows a red ci-ok on its old SHA; the new
  # run owns the new SHA.
  ci-ok:
    name: ci-ok
    if: always()
    needs: [changes, docs, lint, coverage, sql-policy, infra, dashboard, sdk, e2e, deps-audit, tooling]
    runs-on: ubuntu-latest
    steps:
      - name: Verify every needed job passed
        env:
          NEEDS: ${{ toJSON(needs) }}
          # Whether each gated job was needed, from the same outputs its `if:`
          # reads. Expressions render booleans as bare true/false, so this is
          # JSON. Keep it in step with the `if:` of every job in `needs`.
          REQUIRED: >-
            {
              "lint": ${{ needs.changes.outputs.rust == 'true' }},
              "coverage": ${{ needs.changes.outputs.rust == 'true' }},
              "sql-policy": ${{ needs.changes.outputs.rust == 'true' }},
              "e2e": ${{ needs.changes.outputs.rust == 'true' || needs.changes.outputs.dashboard == 'true' }},
              "infra": ${{ needs.changes.outputs.infra == 'true' }},
              "dashboard": ${{ needs.changes.outputs.dashboard == 'true' }},
              "sdk": ${{ needs.changes.outputs.sdk == 'true' }},
              "deps-audit": ${{ needs.changes.outputs.deps == 'true' }},
              "tooling": ${{ needs.changes.outputs.tooling == 'true' }}
            }
        run: |
          jq -rn --argjson needs "$NEEDS" --argjson required "$REQUIRED" '
            [ $needs | to_entries[]
              | .value.result as $r
              # has(), not `// true`: `//` also replaces an explicit false.
              | (.key as $k | if $required | has($k) then $required[$k] else true end) as $q
              | {job: .key, result: $r, needed: $q,
                 ok: ($r == "success" or ($r == "skipped" and ($q | not)))} ]
            | (.[] | "\(if .ok then "ok  " else "FAIL" end)  \(.job): \(.result) (needed: \(.needed))"),
              (if all(.ok) then empty else error("a needed job did not succeed") end)'