ci.yml

name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
  schedule:
    # 04:17 UTC daily. An odd minute so this does not join the stampede of
    # cron jobs that every project schedules on the hour.
    - cron: "17 4 * * *"
  workflow_dispatch:
    inputs:
      full_windows:
        description: Run the full Windows Go race suite in ten-minute shards
        type: boolean
        default: false
      repeat_windows_startup:
        description: Repeat the Windows fresh-install launcher test ten times
        type: boolean
        default: false

permissions:
  contents: read

# The pull request number is set only for pull_request, so every push to a
# PR shares one group and cancels the previous run instead of paying for a
# second full matrix that nobody reads. Pushes to main fall back
# to `run_id`, which is unique per run, so a main run never queues behind
# or cancels another and every commit on the default branch keeps its own
# full run.
#
# Keyed on the number rather than `head_ref`: a branch name is not unique
# across forks, and GitHub's web editor defaults every one of them to
# `patch-1`, so two outside contributors would have cancelled each other's
# runs (#850).
concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
  cancel-in-progress: true

jobs:
  # Pull requests and pushes to main test on Linux: a merge reruns code its PR
  # already tested, and a full matrix on every merge tripled the runner time.
  # Nightly and manual runs add macOS and a focused Windows smoke check.
  # The full Windows Go suite is manual only, with full_windows=true.
  #
  # One Linux job ran internal/cli and tests/integration side by side and
  # reached the ten-minute limit (#2610), so they run in shards split by test
  # name. Each last shard skips the earlier ones, so a new test lands in
  # exactly one shard.
  linux:
    name: Test (ubuntu-latest, ${{ matrix.shard }})
    runs-on: ubuntu-latest
    timeout-minutes: 10
    strategy:
      fail-fast: false
      matrix:
        include:
          - shard: packages
            packages: ''
            run: ''
            skip: ''
          - shard: cli a-h
            packages: ./internal/cli
            run: '^Test[A-H]'
            skip: ''
          - shard: cli i-l
            packages: ./internal/cli
            run: '^Test[I-L]'
            skip: ''
          - shard: cli m-z
            packages: ./internal/cli
            run: ''
            skip: '^Test[A-L]'
          - shard: integration a-h
            packages: ./tests/integration
            run: '^Test[A-H]'
            skip: ''
          - shard: integration i-z
            packages: ./tests/integration
            run: ''
            skip: '^Test[A-H]'
            require_zola: '1'
    # gh attestation verify reads the Zola release attestation.
    permissions:
      contents: read
      attestations: read
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          persist-credentials: false

      - name: Set up Go
        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
        with:
          go-version-file: go.mod
          cache: true

      # The site tests (TestSiteDocs_, TestTargetUpdates_) sort into this
      # shard and fail instead of skipping without the pinned Zola.
      - name: Install Zola 0.23.6
        if: matrix.require_zola == '1'
        env:
          GH_TOKEN: ${{ github.token }}
          ZOLA_VERSION: 0.23.6
        run: |
          set -euo pipefail
          archive="zola-v${ZOLA_VERSION}-x86_64-unknown-linux-gnu.tar.gz"
          curl -fsSLo "$archive" "https://github.com/getzola/zola/releases/download/v${ZOLA_VERSION}/${archive}"
          gh attestation verify "$archive" --repo getzola/zola
          tar -xzf "$archive" zola
          sudo install -m 0755 zola /usr/local/bin/zola
          rm -f "$archive" zola
          test "$(zola --version)" = "zola ${ZOLA_VERSION}"

      - name: Test with coverage
        shell: bash
        env:
          PACKAGES: ${{ matrix.packages }}
          RUN: ${{ matrix.run }}
          SKIP: ${{ matrix.skip }}
          AGNOSTIC_AI_REQUIRE_ZOLA: ${{ matrix.require_zola }}
        run: |
          packages=()
          if [ -n "$PACKAGES" ]; then
            packages=("$PACKAGES")
          else
            module=$(go list -m)
            all_packages=$(go list ./...)
            while IFS= read -r package; do
              case "$package" in
                "$module/tests/integration"|"$module/internal/cli") ;;
                *) packages+=("$package") ;;
              esac
            done <<< "$all_packages"
          fi
          go test -timeout=10m -count=1 -race -coverprofile=coverage.out -covermode=atomic -run "$RUN" -skip "$SKIP" "${packages[@]}"

      - name: Upload coverage to Codecov
        uses: codecov/codecov-action@303a32d7a59b442fa8d48b6a1cc6825c09c847a5 # v7
        with:
          files: coverage.out
          fail_ci_if_error: false

  # Branch protection requires this check name, so it passes only when every
  # Linux shard passed.
  linux-result:
    name: Test (ubuntu-latest)
    if: always()
    needs: linux
    runs-on: ubuntu-latest
    timeout-minutes: 2
    steps:
      - name: Require every Linux shard
        env:
          RESULT: ${{ needs.linux.result }}
        run: test "$RESULT" = success

  test:
    name: Test
    if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'
    timeout-minutes: ${{ matrix.os == 'windows-latest' && inputs.full_windows != true && 7 || 10 }}
    strategy:
      fail-fast: false
      matrix:
        os: [macos-latest, windows-latest]
    runs-on: ${{ matrix.os }}
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          persist-credentials: false

      - name: Set up Go
        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
        with:
          go-version-file: go.mod
          cache: true

      - name: macOS unit tests
        if: matrix.os == 'macos-latest'
        shell: bash
        run: |
          module=$(go list -m)
          all_packages=$(go list ./...)
          packages=()
          while IFS= read -r package; do
            case "$package" in
              "$module/tests/integration"|"$module/tests/integration/"*|"$module/internal/cli") ;;
              *) packages+=("$package") ;;
            esac
          done <<< "$all_packages"
          go test -vet=all -timeout=10m -count=1 -race "${packages[@]}"

      - name: Windows smoke
        if: matrix.os == 'windows-latest' && inputs.full_windows != true
        shell: bash
        run: |
          go test -timeout=5m -count=1 ./internal/config ./internal/adapters/internal/emit ./internal/adapters/pi ./internal/adapters/grok ./internal/adapters/qwen ./internal/adapters/vibe ./internal/adapters/kimi ./internal/adapters/codebuddy
          go test -timeout=5m -count=1 ./internal/adapters/cline -run 'VSCode|GlobalHooks_|ActualBuiltin'
          go test -timeout=5m -count=1 ./internal/cli -run '^(TestCodebuddy_(Import|Scoped|Controlled|Instruction|DeleteCapability|Overrides|GlobalRejects|DefaultSync)|TestInstallHook_SharedFromLinkedWorktreeWritesUnderMainToplevel$|TestHandoffList_|TestSessionRetention_|TestSyncGlobal_Cline|TestInit_Memory|TestHookMemory_Trae|TestHookMemory_Devin|TestSync_DevinMemory|TestHookMemory_Augment|TestSyncGlobal_AugmentMemory|TestSyncGlobal_AugmentLocal|TestSync_AugmentLocal|TestSync_AntigravityMemory|TestSyncGlobal_AntigravityMemory|TestHookMemory_Cline|TestHookRun_ClineVSCode|TestHookRun_VSCodeRuntime|TestSync_ClineUnixRemoves|TestSync_CaseOnlyRename|TestSync_RemovesDistinctHardLinkedOutput|TestGitRepo_DoesNotStartAutomaticMaintenance$|TestImportPi_|TestImportGlobal_Pi|TestSyncGlobal_Pi|TestSyncPi_|TestPiExposure_|TestPiMCPMap_|TestPiBOM_|TestLintMCPMissingRequiredField_PiControls|TestImportGrok_|TestSyncGlobal_Grok|TestGrokTOML_|TestQwen_|TestImportVibe_|TestSyncVibe_|TestSyncGlobal_Vibe|TestImportGlobal_Vibe|TestImportKimi_|TestSyncKimi_|TestSyncGlobal_Kimi|TestImportGlobal_Kimi|TestTOMLArray_)'
          go test -timeout=5m -count=1 ./tests/integration -run '^(TestProjectLifecycle_FirstLaunchAfterFreshInstall|TestProjectLifecycle_LaunchDiagnostic.*|TestPiRoundTrip_NativeProject|TestGrokNativeProject_ImportSyncCheckAndLint|TestQwenNativeProject_BuiltBinaryImportSyncCheck|TestVibeRoundTrip_NativeProject|TestKimiRoundTrip_NativeProject|TestCodebuddy_NativeImportRecreatesAnEmptyOutputTree|TestVerify_.*)$'

      - name: Windows local API, verification, and MCP lifecycle
        if: matrix.os == 'windows-latest' && inputs.full_windows != true
        shell: bash
        run: |
          go test -timeout=2m -count=1 ./internal/authority ./internal/overview ./internal/preview ./internal/mcpprobe
          go test -timeout=2m -count=1 ./internal/cli -run '^(TestServe|TestVerify|TestBuiltinChanges_|TestEdit|TestSetBool|TestSetBuiltin|TestMCPTools_|TestMCPServer_|TestHookWorktreeRefresh_CancelsReadyDescendant|TestHookWorktreeRefresh_KeepsSuccessfulBackgroundSetup)'

      - name: Repeat Windows fresh-install startup
        if: github.event_name == 'workflow_dispatch' && matrix.os == 'windows-latest' && inputs.full_windows != true && inputs.repeat_windows_startup == true
        timeout-minutes: 3
        shell: bash
        env:
          AGNOSTIC_AI_WINDOWS_STARTUP_TESTS: "1"
        run: go test -v -failfast -timeout=3m -count=10 ./tests/integration -run '^TestProjectLifecycle_FirstLaunchAfterFreshInstall$'

  # The full Windows race suite took about 32 minutes in one job (#2760), so
  # it runs in shards split by test name, each well under the ten-minute
  # limit. Each last shard skips the earlier ones, so a new test lands in
  # exactly one shard.
  windows-full:
    name: Test full (windows-latest, ${{ matrix.shard }})
    if: github.event_name == 'workflow_dispatch' && inputs.full_windows == true
    runs-on: windows-latest
    timeout-minutes: 10
    strategy:
      fail-fast: false
      matrix:
        include:
          - shard: packages
            packages: ''
            run: ''
            skip: ''
          - shard: cli a-c
            packages: ./internal/cli
            run: '^Test[A-C]'
            skip: ''
          - shard: cli d-h
            packages: ./internal/cli
            run: '^Test[D-H]'
            skip: ''
          - shard: cli import
            packages: ./internal/cli
            run: '^TestImport_'
            skip: ''
          - shard: cli i-l
            packages: ./internal/cli
            run: '^Test[I-L]'
            skip: '^TestImport_'
          - shard: cli sync
            packages: ./internal/cli
            run: '^TestSync_'
            skip: ''
          - shard: cli m-z
            packages: ./internal/cli
            run: ''
            skip: '^Test([A-L]|Sync_)'
          - shard: integration a-b
            packages: ./tests/integration
            run: '^Test[A-B]'
            skip: ''
          - shard: integration h
            packages: ./tests/integration
            run: '^TestH'
            skip: ''
          - shard: integration i-r
            packages: ./tests/integration
            run: '^Test[I-R]'
            skip: ''
          - shard: integration c-g, s-z
            packages: ./tests/integration
            run: ''
            skip: '^Test[A-BH-R]'
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          persist-credentials: false

      - name: Set up Go
        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
        with:
          go-version-file: go.mod
          cache: true

      - name: Test
        shell: bash
        env:
          PACKAGES: ${{ matrix.packages }}
          RUN: ${{ matrix.run }}
          SKIP: ${{ matrix.skip }}
        run: |
          packages=()
          if [ -n "$PACKAGES" ]; then
            packages=("$PACKAGES")
          else
            module=$(go list -m)
            all_packages=$(go list ./...)
            while IFS= read -r package; do
              case "$package" in
                "$module/tests/integration"|"$module/internal/cli") ;;
                *) packages+=("$package") ;;
              esac
            done <<< "$all_packages"
          fi
          go test -vet=all -timeout=10m -count=1 -race -run "$RUN" -skip "$SKIP" "${packages[@]}"

  # Split the macOS CLI race tests by name to stay within the job timeout.
  # The last shard skips the first two, so new tests land in exactly one shard.
  macos-cli:
    name: Test cli (macos-latest, ${{ matrix.shard }})
    if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'
    runs-on: macos-latest
    timeout-minutes: 10
    strategy:
      fail-fast: false
      matrix:
        include:
          - shard: a-h
            run: '^Test[A-H]'
            skip: ''
          - shard: i-l
            run: '^Test[I-L]'
            skip: ''
          - shard: m-z
            run: ''
            skip: '^Test[A-L]'
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          persist-credentials: false

      - name: Set up Go
        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
        with:
          go-version-file: go.mod
          cache: true

      - name: Test
        shell: bash
        run: go test -vet=all -timeout=10m -count=1 -race ./internal/cli -run '${{ matrix.run }}' -skip '${{ matrix.skip }}'

  windows-handoffs:
    name: Test handoffs (windows-latest, ${{ matrix.suite }})
    if: (github.event_name == 'schedule' || github.event_name == 'workflow_dispatch') && inputs.full_windows != true
    runs-on: windows-latest
    timeout-minutes: 7
    strategy:
      fail-fast: false
      matrix:
        include:
          - suite: hooks-worktrees
            tests: '^TestBuiltinHandoffHooks$/^(automatic-snapshots-preserve-repository-boundaries|metadata-and-replacement-failures-preserve-files|claude-native-input-validation|shared-auto-snapshots-survive-worktrees|global-source-at-home-keeps-checkout-root|task-handoffs-across-worktrees)$'
            skip: ''
          - suite: hooks-rest
            tests: '^TestBuiltinHandoffHooks$'
            skip: '^TestBuiltinHandoffHooks$/^(automatic-snapshots-preserve-repository-boundaries|metadata-and-replacement-failures-preserve-files|claude-native-input-validation|shared-auto-snapshots-survive-worktrees|global-source-at-home-keeps-checkout-root|task-handoffs-across-worktrees)$'
          - suite: permissions-shared-store
            tests: '^TestHandoffAccess_(SharedStoreJoinsNativeWriteRoots|EveryGrantAddedByHandSurvives)$'
            skip: ''
          - suite: permissions-rest
            tests: '^TestHandoffAccess_'
            skip: '^TestHandoffAccess_(SharedStoreJoinsNativeWriteRoots|EveryGrantAddedByHandSurvives)$'
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          persist-credentials: false

      - name: Set up Go
        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
        with:
          go-version-file: go.mod
          cache: true

      - name: Test
        shell: bash
        run: go test -timeout=5m -count=1 ./tests/integration -run '${{ matrix.tests }}' -skip '${{ matrix.skip }}'

  macos-integration:
    name: Test integration (macos-latest)
    if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'
    runs-on: macos-latest
    timeout-minutes: 10
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          persist-credentials: false

      - name: Set up Go
        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
        with:
          go-version-file: go.mod
          cache: true

      - name: Test
        shell: bash
        run: go test -vet=all -timeout=10m -count=1 -race ./tests/integration/...


  opencode-hooks:
    name: OpenCode hooks
    timeout-minutes: ${{ matrix.os == 'windows-latest' && 7 || 10 }}
    strategy:
      fail-fast: false
      matrix:
        os: ${{ (github.event_name == 'pull_request' || github.event_name == 'push') && fromJSON('["ubuntu-latest"]') || fromJSON('["ubuntu-latest", "macos-latest", "windows-latest"]') }}
    runs-on: ${{ matrix.os }}
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          persist-credentials: false

      - name: Set up Go
        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
        with:
          go-version-file: go.mod
          cache: true

      - name: Set up Node
        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7
        with:
          node-version: '22'
          cache: 'npm'
          cache-dependency-path: tests/vendor/opencode/package-lock.json

      - name: Validate released plugin types and native behavior
        shell: bash
        run: make opencode-hooks-test

  lint:
    name: Lint
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          persist-credentials: false

      - name: Set up Go
        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
        with:
          go-version-file: go.mod
          cache: true

      - name: golangci-lint
        uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a # v9
        with:
          version: v2.14.0

  vulncheck:
    name: Vulnerability scan
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          persist-credentials: false

      - name: Set up Go
        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
        with:
          go-version-file: go.mod

      # Fails only on a known vulnerability the code can reach, so a flaw in
      # an unused corner of a dependency does not block every PR. The daily
      # scheduled run catches a new advisory against code already on main.
      - name: govulncheck
        run: go run golang.org/x/vuln/cmd/govulncheck@v1.8.0 ./...

  build:
    name: Build
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          persist-credentials: false

      - name: Set up Go
        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
        with:
          go-version-file: go.mod
          cache: true

      - name: Build
        run: go build ./...

      - name: Build WASM playground
        run: GOOS=js GOARCH=wasm go build -o /tmp/agnostic-ai.wasm ./cmd/agnostic-ai-wasm

      - name: Test WASM playground
        run: GOOS=js GOARCH=wasm go test -exec="$(go env GOROOT)/lib/wasm/go_js_wasm_exec" ./cmd/agnostic-ai-wasm

      - name: Test OpenCode browser permissions
        run: GOOS=js GOARCH=wasm go test -exec="$(go env GOROOT)/lib/wasm/go_js_wasm_exec" ./internal/adapters/opencode -run '^TestProjectPermissionBrowserReplaysPlannedRulesWithoutFilesystem$'

      - name: Test browser TOML capture
        timeout-minutes: 2
        run: GOOS=js GOARCH=wasm go test -timeout=30s -count=1 -exec="$(go env GOROOT)/lib/wasm/go_js_wasm_exec" ./internal/adapters/internal/emit -run '^TestMergeTOMLFileBrowserCapturesWithoutFilesystem$'

  schema:
    name: Schema drift
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          persist-credentials: false

      - name: Set up Go
        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
        with:
          go-version-file: go.mod
          cache: true

      - name: Regenerate schema
        run: go run ./cmd/schemagen

      - name: Fail on drift
        run: git diff --exit-code docs/schemas/config.schema.json

  speclint:
    name: Spec lint
    # Runs against this repo's own specs under .agnostic-ai/. Note there is no
    # `sync --check` counterpart: the managed .gitignore block deliberately
    # leaves emitted output uncommitted, so a fresh checkout has nothing to
    # compare against. Source specs are committed, so lint works here.
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          persist-credentials: false

      - name: Set up Go
        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
        with:
          go-version-file: go.mod
          cache: true

      - name: Build
        run: make build

      - name: Lint specs
        run: ./agnostic-ai lint

      - name: Binary size
        run: make size-check

  plugin:
    name: Plugin version bump
    # The marketplace pins the plugin to plugin.json's version, so an edit that
    # ships without a bump never reaches anyone who already installed it.
    if: github.event_name == 'pull_request'
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          persist-credentials: false
          fetch-depth: 0

      - name: Version bumped when the plugin changed
        env:
          BASE: ${{ github.event.pull_request.base.sha }}
          HEAD: ${{ github.event.pull_request.head.sha }}
        run: |
          manifest=plugins/agnostic-ai/.claude-plugin/plugin.json
          # Compare against the merge base, not the base tip: another PR's
          # plugin change landing on main must not read as this PR's work.
          BASE=$(git merge-base "$BASE" "$HEAD")
          changed=$(git diff --name-only "$BASE" "$HEAD" -- plugins/ .claude-plugin/)
          if [ -z "$changed" ]; then
            echo "plugin untouched, nothing to check"
            exit 0
          fi
          echo "changed:"; echo "$changed"
          before=$(git show "$BASE:$manifest" 2>/dev/null | grep '"version"' || true)
          after=$(grep '"version"' "$manifest")
          if [ "$before" = "$after" ]; then
            echo "error: plugin files changed but $manifest version is still $after" >&2
            echo "Bump it, or installed users keep the old copy." >&2
            exit 1
          fi
          echo "version moved: ${before:-<none>} -> $after"

  shell:
    name: Shell tests
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          persist-credentials: false

      - name: Set up Go
        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
        with:
          go-version-file: go.mod
          cache: true

      # One pinned release file, checked against its published sha256
      # before it runs, instead of piping an install script into bash.
      - name: Install bashunit
        env:
          BASHUNIT_VERSION: 0.51.0
          BASHUNIT_SHA256: 307e3a84d5561d1a1d8b5d378184bb1dfda3e7a7856c4a9435d63a53853cf72c
        run: |
          curl -fsSL -o /usr/local/bin/bashunit "https://github.com/TypedDevs/bashunit/releases/download/${BASHUNIT_VERSION}/bashunit"
          echo "${BASHUNIT_SHA256}  /usr/local/bin/bashunit" | sha256sum -c -
          chmod +x /usr/local/bin/bashunit

      - name: Run shell tests
        run: make test-shell

      - name: Run site script tests
        run: node --test docs/site/static/assets/scripts/*.test.js

  editor_changes:
    name: Editor changes
    runs-on: ubuntu-latest
    outputs:
      vscode: ${{ steps.filter.outputs.vscode }}
      jetbrains: ${{ steps.filter.outputs.jetbrains }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          persist-credentials: false
          fetch-depth: 0

      - id: filter
        env:
          EVENT_NAME: ${{ github.event_name }}
          PR_BASE: ${{ github.event.pull_request.base.sha }}
          PR_HEAD: ${{ github.event.pull_request.head.sha }}
          PUSH_BEFORE: ${{ github.event.before }}
          PUSH_AFTER: ${{ github.sha }}
        run: |
          case "$EVENT_NAME" in
            pull_request)
              base=$(git merge-base "$PR_BASE" "$PR_HEAD" || true)
              head=$PR_HEAD
              ;;
            push)
              base=$PUSH_BEFORE
              head=$PUSH_AFTER
              ;;
            *)
              printf 'vscode=true\njetbrains=true\n' >> "$GITHUB_OUTPUT"
              exit 0
              ;;
          esac

          if [ -z "$base" ] || ! git cat-file -e "$base^{commit}" 2>/dev/null || ! git cat-file -e "$head^{commit}" 2>/dev/null; then
            printf 'vscode=true\njetbrains=true\n' >> "$GITHUB_OUTPUT"
            exit 0
          fi

          for editor in vscode jetbrains; do
            if git diff --quiet "$base" "$head" -- "editors/$editor/" .github/workflows/ci.yml cmd/agnostic-ai/ internal/cli/ internal/config/ internal/spec/ docs/schemas/config.schema.json; then
              echo "$editor=false" >> "$GITHUB_OUTPUT"
            else
              echo "$editor=true" >> "$GITHUB_OUTPUT"
            fi
          done

  vscode:
    name: VS Code extension (${{ matrix.os }})
    timeout-minutes: ${{ matrix.os == 'windows-latest' && 7 || 10 }}
    needs: editor_changes
    if: ${{ !cancelled() && (needs.editor_changes.result != 'success' || needs.editor_changes.outputs.vscode == 'true') }}
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, macos-latest, windows-latest]
    defaults:
      run:
        working-directory: editors/vscode
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          persist-credentials: false

      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7
        with:
          node-version: '22'
          cache: 'npm'
          cache-dependency-path: editors/vscode/package-lock.json

      - name: Install
        run: npm ci

      # npm test compiles first.
      - name: Compile and test
        run: npm test

      - name: Package
        run: npx vsce package --skip-license

  jetbrains:
    name: JetBrains plugin
    needs: editor_changes
    if: ${{ !cancelled() && (needs.editor_changes.result != 'success' || needs.editor_changes.outputs.jetbrains == 'true') }}
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: editors/jetbrains
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          persist-credentials: false

      # Fails if the committed gradle-wrapper.jar is not a published Gradle
      # release, the jar the build would otherwise run unchecked.
      - name: Validate the Gradle wrapper
        uses: gradle/actions/wrapper-validation@8da46b539cd8fe6ab27ca75128919a18d757604c # v6.4.1

      - uses: actions/setup-java@77dd5b2ce225ea11469928ac317850245a74ae78 # v6.2.0
        with:
          distribution: 'temurin'
          java-version: '21'

      - name: Cache Gradle
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
        with:
          path: |
            ~/.gradle/caches
            ~/.gradle/wrapper
            editors/jetbrains/.gradle
          key: gradle-${{ hashFiles('editors/jetbrains/**/*.gradle*', 'editors/jetbrains/gradle/wrapper/gradle-wrapper.properties') }}

      # One Gradle start instead of two cold ones.
      - name: Test and build plugin
        run: ./gradlew --no-daemon test buildPlugin

  ui:
    name: Web client
    runs-on: ubuntu-24.04
    timeout-minutes: 10
    defaults:
      run:
        working-directory: ui
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          persist-credentials: false

      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7
        with:
          node-version: '22'
          cache: 'npm'
          cache-dependency-path: ui/package-lock.json

      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
        with:
          go-version-file: go.mod
          cache: true

      - name: Install
        run: npm ci

      - name: Typecheck
        run: npm run typecheck

      - name: Test
        run: npm test

      - name: Build
        run: npm run build

      - name: Check bundled client against sources
        run: npm run bundle:check

      - name: Build local server
        working-directory: .
        run: go build -o agnostic-ai ./cmd/agnostic-ai

      - name: Install browser
        run: npx playwright install chromium

      - name: Fixture browser tests
        env:
          E2E_PREVIEW: '1'
          E2E_MOCK: '1'
        run: npm run e2e

      - name: Live server browser tests
        env:
          AGNOSTIC_E2E_BIN: ${{ github.workspace }}/agnostic-ai
        run: npm run e2e:live