ci.yaml

name: CI

on:
  push:
    branches:
      - main
      - ci-bisect
      - ci-bisect-**
  pull_request:
  workflow_dispatch:

# Pull requests: a new push cancels the run in progress for the same branch.
# Pushes to main share one group but never cancel a run in progress: GitHub
# keeps at most one running and one pending run per group, and a newer pending
# run replaces the older one. A burst of merges therefore runs the commit in
# progress and then the newest, rather than every commit in between. Every run
# that starts still finishes, so the index-cache artifact and the realm-server
# test weights always come from complete main runs. ci-bisect pushes, whose
# every commit must be tested, and hand-run builds keep a group of their own.
# The main group is `push:main` because `:` cannot appear in a branch name, so
# no pull request's head_ref (a fork's `main`, say) can land in it and cancel a
# main run.
concurrency:
  group: ci-${{ github.head_ref || (github.event_name == 'push' && github.ref == 'refs/heads/main' && 'push:main') || github.run_id }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

permissions:
  checks: write
  contents: read
  id-token: write
  # Lets the warm-test-images step pull the private GHCR mirror packages.
  packages: read
  pull-requests: write

jobs:
  change-check:
    name: Check which packages changed
    runs-on: ubuntu-latest
    timeout-minutes: 10
    outputs:
      boxel: ${{ steps.filter.outputs.boxel }}
      ai-bot: ${{ steps.filter.outputs.ai-bot }}
      bot-runner: ${{ steps.filter.outputs.bot-runner }}
      eslint-plugin-boxel: ${{ steps.filter.outputs.eslint-plugin-boxel }}
      eslint-plugin-cardstack-host: ${{ steps.filter.outputs.eslint-plugin-cardstack-host }}
      postgres-migrations: ${{ steps.filter.outputs.postgres-migrations }}
      boxel-icons: ${{ steps.filter.outputs.boxel-icons }}
      boxel-ui: ${{ steps.filter.outputs.boxel-ui }}
      pretui: ${{ steps.filter.outputs.pretui }}
      choreo: ${{ steps.filter.outputs.choreo }}
      choreo-addon: ${{ steps.filter.outputs.choreo-addon }}
      glimmer-motion: ${{ steps.filter.outputs.glimmer-motion }}
      matrix: ${{ steps.filter.outputs.matrix }}
      realm-server: ${{ steps.filter.outputs.realm-server }}
      vscode-boxel-tools: ${{ steps.filter.outputs.vscode-boxel-tools }}
      boxel-cli: ${{ steps.filter.outputs.boxel-cli }}
      bxl: ${{ steps.filter.outputs.bxl }}
      bench-amd: ${{ steps.filter.outputs.bench-amd }}
      bench-realm: ${{ steps.filter.outputs.bench-realm }}
      deployed-realms: ${{ steps.filter.outputs.deployed-realms }}
      secure-origin: ${{ steps.filter.outputs.secure-origin }}
      # Force all tests to run when on ci-bisect* branches
      run_all: ${{ steps.force-run-all.outputs.run_all }}
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1
        id: filter
        with:
          filters: |
            shared: &shared
              - '.github/workflows/ci.yaml'
              - 'packages/runtime-common/**'
              - 'package.json'
              - 'pnpm-lock.yaml'
              - 'pnpm-workspace.yaml'
              # CI boot path. Each gated suite runs `./.github/actions/init`
              # (which calls `jdx/mise-action`, sourcing `.mise.toml` for tool
              # versions) and then `mise run test-services:*` (which sources
              # every script under mise-tasks/, with dev-log-tee.sh as a
              # runtime dep). A breaking change to any of these can take down
              # all the suites without matching a per-package filter — the
              # exact failure mode that hid PR #4671.
              - '.mise.toml'
              - '.github/actions/**'
              - 'mise-tasks/**'
              - 'packages/observability/scripts/**'
            boxel:
              - *shared
              # The host compiles this package's source as a workspace dependency,
              # so a change here is a host change.
              - 'packages/pretui/**'
              - '.github/workflows/build-host.yml'
              - '.github/workflows/deploy-host.yml'
              - '.github/workflows/deploy-release.yml'
              - '.github/workflows/deploy-ui.yml'
              - '.github/workflows/manual-deploy.yml'
              - 'packages/ai-bot/**'
              - 'packages/bot-runner/**'
              - 'packages/base/**'
              - 'packages/boxel-icons/**'
              - 'packages/boxel-ui/**'
              - 'packages/bxl/**'
              - 'packages/host/**'
              - 'packages/realm-server/**'
              - 'packages/secure-origin/**'
              - 'packages/test-realm-cards/**'
            ai-bot:
              - *shared
              - '.github/workflows/pr-ai-bot.yml'
              - 'packages/ai-bot/**'
              - 'packages/billing/**'
              - 'packages/postgres/**'
            bot-runner:
              - *shared
              - 'packages/bot-runner/**'
              - 'packages/postgres/**'
            eslint-plugin-boxel:
              - *shared
              - 'packages/eslint-plugin-boxel/**'
            eslint-plugin-cardstack-host:
              - *shared
              - 'packages/eslint-plugin-cardstack-host/**'
            postgres-migrations:
              - 'packages/postgres/migrations/**'
              - 'packages/postgres/migrations-removal/**'
              - 'packages/postgres/scripts/determine-changed-migrations.sh'
            boxel-icons:
              - *shared
              - 'packages/boxel-icons/**'
            boxel-ui:
              - *shared
              - 'packages/boxel-icons/**'
              - 'packages/boxel-ui/**'
              - 'packages/boxel-ui/docs-app/**'
            pretui:
              - *shared
              - 'packages/pretui/**'
            choreo:
              - *shared
              - 'packages/choreo/**'
              - 'packages/choreo-film-app/**'
              - 'packages/choreo-gallery/**'
              - 'packages/choreo-player/**'
              - 'packages/glimmer-motion/**'
            # choreo builds on glimmer-motion's extension point, so a
            # glimmer-motion change runs choreo's suite too.
            choreo-addon:
              - *shared
              - 'packages/choreo/**'
              - 'packages/glimmer-motion/**'
            glimmer-motion:
              - *shared
              - 'packages/glimmer-motion/**'
            secure-origin:
              - *shared
              - 'packages/secure-origin/**'
            # Realm content the realm-server image carries and each deploy
            # copies onto the realm's disk, so a change to it needs a staging
            # deploy even when it touches no other boxel package. The gallery
            # realm's film app is built from choreo-film-app, which compiles
            # choreo and glimmer-motion from source.
            deployed-realms:
              - 'packages/choreo-gallery/realm/**'
              - 'packages/choreo-film-app/**'
              - 'packages/choreo/**'
              - 'packages/glimmer-motion/**'
            matrix:
              - *shared
              - 'packages/base/**'
              - 'packages/boxel-icons/**'
              - 'packages/boxel-ui/**'
              - 'packages/host/**'
              - 'packages/matrix/**'
              - 'packages/realm-server/**'
              - 'packages/secure-origin/**'
              - 'packages/test-realm-cards/**'
            realm-server:
              - *shared
              - 'packages/billing/**'
              - 'packages/boxel-icons/**'
              - 'packages/boxel-ui/**'
              - 'packages/bxl/**'
              - 'packages/host/**'
              - 'packages/eslint-plugin-boxel/**'
              - 'packages/postgres/**'
              - 'packages/realm-server/**'
              - 'packages/secure-origin/**'
              - 'packages/test-realm-cards/**'
            vscode-boxel-tools:
              - *shared
              - 'packages/vscode-boxel-tools/**'
            boxel-cli:
              - *shared
              - 'packages/boxel-cli/**'
              # The boxel-skills pin lives in the marketplaces, and the
              # boxel-cli suite checks it (both refs agree, the pinned release
              # is installable), so a pin-only change has to run that suite.
              - '.claude-plugin/marketplace.json'
              - '.agents/plugins/marketplace.json'
              # boxel-cli bundles these packages' source for `boxel parse`.
              - 'packages/glimmer-motion/**'
              - 'packages/choreo/**'
            bxl:
              # The suite is self-contained — plain objects under Node, no
              # stack and no browser — so it stays cheap even when the
              # shared CI-boot paths trigger it.
              - *shared
              - 'packages/bxl/**'
              # The card-authoring skill's claims are pinned by a BXL suite
              # that reads the skill from the pinned boxel-skills release, so
              # moving the pin has to run that suite too.
              - '.claude-plugin/marketplace.json'
              - 'packages/boxel-cli/scripts/boxel-skills.mts'
              # That suite also asserts the host suites the skill cites still
              # exist. `bxl-test` runs unconditionally on main, so without
              # these a host-only rename would merge green and redden main on
              # a commit whose own CI never ran the failing suite.
              - 'packages/host/tests/integration/bxl-*'
              - 'packages/host/tests/helpers/cards/bxl-*'
            bench-amd:
              # The AMD transpiler is a runtime-common module with no
              # cross-workspace deps that affect its wall-time, so the
              # bench only needs to fire for runtime-common edits and
              # the committed bench fixtures.
              - 'packages/runtime-common/**'
              - 'bench-fixtures/runtime-common/amd-transpile/**'
            bench-realm:
              # HTTP GET + search regression bench. Self-contained — the
              # bench's source-realm snapshot lives under
              # packages/realm-server/scripts/bench-realm/fixtures/, so
              # software-factory changes can't move the bench medians.
              # The packages that *can* affect the medians are the ones
              # the bench's wire path actually exercises:
              # runtime-common (definition lookup, query engine, file
              # serializer), realm-server itself, postgres (schema
              # migrations + the pg adapter the bench writes through),
              # host (FastBoot prerender), the base realm, and the
              # harness that spins up the ephemeral stack.
              - *shared
              - 'packages/base/**'
              - 'packages/host/**'
              - 'packages/postgres/**'
              - 'packages/realm-server/**'
              - 'packages/realm-test-harness/**'
      - name: Force run all jobs on ci-bisect branches
        id: force-run-all
        shell: bash
        run: |
          echo "run_all=${{ startsWith(github.ref, 'refs/heads/ci-bisect') || startsWith(github.ref, 'refs/heads/ci-bisect-') || startsWith(github.head_ref || '', 'ci-bisect') }}" >> "$GITHUB_OUTPUT"

  test-web-assets:
    name: Build test web assets
    needs: change-check
    # choreo: the gallery's tests run against this host, which bundles
    # glimmer-motion and Choreo from the same commit
    if: needs.change-check.outputs.boxel == 'true' || needs.change-check.outputs.boxel-ui == 'true' || needs.change-check.outputs.matrix == 'true' || needs.change-check.outputs.realm-server == 'true' || needs.change-check.outputs.vscode-boxel-tools == 'true' || needs.change-check.outputs.boxel-cli == 'true' || needs.change-check.outputs.choreo == 'true' || github.ref == 'refs/heads/main' || needs.change-check.outputs.run_all == 'true'
    uses: ./.github/workflows/test-web-assets.yaml
    with:
      caller: ci
    concurrency:
      group: ci-test-web-assets-${{ github.head_ref || github.run_id }}
      cancel-in-progress: true

  ai-bot-test:
    name: AI bot Tests
    needs: change-check
    if: needs.change-check.outputs.ai-bot == 'true' || github.ref == 'refs/heads/main' || needs.change-check.outputs.run_all == 'true'
    runs-on: ubuntu-latest
    timeout-minutes: 15
    services:
      postgres:
        image: postgres:16
        env:
          POSTGRES_USER: postgres
          POSTGRES_PASSWORD: postgres
        ports:
          - 5432:5432
        options: >-
          --health-cmd "pg_isready -U postgres"
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5
    env:
      PGHOST: localhost
      PGPORT: 5432
      PGUSER: postgres
      PGPASSWORD: postgres
    concurrency:
      group: ai-bot-test-${{ github.head_ref || github.run_id }}
      cancel-in-progress: true
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - uses: ./.github/actions/init
      - name: AI Bot test suite
        run: pnpm test
        working-directory: packages/ai-bot

  bot-runner-test:
    name: Bot Runner Tests
    needs: change-check
    if: needs.change-check.outputs.bot-runner == 'true' || github.ref == 'refs/heads/main' || needs.change-check.outputs.run_all == 'true'
    runs-on: ubuntu-latest
    timeout-minutes: 15
    concurrency:
      group: bot-runner-test-${{ github.head_ref || github.run_id }}
      cancel-in-progress: true
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - uses: ./.github/actions/init
      - name: Bot Runner test suite
        run: pnpm test
        working-directory: packages/bot-runner

  bxl-test:
    name: BXL Tests
    needs: change-check
    if: needs.change-check.outputs.bxl == 'true' || github.ref == 'refs/heads/main' || needs.change-check.outputs.run_all == 'true'
    runs-on: ubuntu-latest
    timeout-minutes: 15
    concurrency:
      group: bxl-test-${{ github.head_ref || github.run_id }}
      cancel-in-progress: true
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - uses: ./.github/actions/init
      - name: BXL test suite
        run: pnpm test
        working-directory: packages/bxl
      # The suites above read `src/`. This packs the npm artifact, installs it
      # outside the monorepo the way a consumer does, and checks that every
      # published subpath loads under plain Node and type-checks — the only
      # pre-merge signal about the thing bxl-publish.yml ships. Unlike the
      # suites, it reaches the npm registry, to install the package's own
      # dependencies into the throwaway consumer project.
      - name: BXL published package check
        run: pnpm run verify:package
        working-directory: packages/bxl

  host-deploy-cache-control-test:
    name: Host Deploy Cache-Control Tests
    needs: change-check
    if: needs.change-check.outputs.boxel == 'true' || github.ref == 'refs/heads/main' || needs.change-check.outputs.run_all == 'true'
    runs-on: ubuntu-latest
    timeout-minutes: 10
    concurrency:
      group: host-deploy-cache-control-test-${{ github.head_ref || github.run_id }}
      cancel-in-progress: true
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - uses: ./.github/actions/init
      # Which `Cache-Control` each deployed file carries is decided entirely by
      # config/deploy.js, and the deploy itself is the first place a mistake
      # shows up — by which point a wrong directive is already in browsers that
      # will not ask again. Needs nothing running.
      - name: Host deploy cache-control suite
        run: pnpm test:deploy-cache-control
        working-directory: packages/host

  eslint-plugin-boxel-test:
    name: ESLint Plugin Boxel Tests
    needs: change-check
    if: needs.change-check.outputs.eslint-plugin-boxel == 'true' || github.ref == 'refs/heads/main' || needs.change-check.outputs.run_all == 'true'
    runs-on: ubuntu-latest
    timeout-minutes: 15
    concurrency:
      group: eslint-plugin-boxel-test-${{ github.head_ref || github.run_id }}
      cancel-in-progress: true
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - uses: ./.github/actions/init
      - name: ESLint Plugin Boxel test suite
        run: pnpm test
        working-directory: packages/eslint-plugin-boxel
      - name: Check generated files are up to date
        working-directory: packages/eslint-plugin-boxel
        run: |
          pnpm run update
          git diff --exit-code || (echo "::error::Generated files are out of date. Run 'pnpm run update' in packages/eslint-plugin-boxel and commit the result." && exit 1)

  eslint-plugin-cardstack-host-test:
    name: ESLint Plugin Cardstack Host Tests
    needs: change-check
    if: needs.change-check.outputs.eslint-plugin-cardstack-host == 'true' || github.ref == 'refs/heads/main' || needs.change-check.outputs.run_all == 'true'
    runs-on: ubuntu-latest
    timeout-minutes: 15
    concurrency:
      group: eslint-plugin-cardstack-host-test-${{ github.head_ref || github.run_id }}
      cancel-in-progress: true
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - uses: ./.github/actions/init
      - name: ESLint Plugin Cardstack Host test suite
        run: pnpm test
        working-directory: packages/eslint-plugin-cardstack-host
      - name: Check generated files are up to date
        working-directory: packages/eslint-plugin-cardstack-host
        run: |
          pnpm run update
          git diff --exit-code || (echo "::error::Generated files are out of date. Run 'pnpm run update' in packages/eslint-plugin-cardstack-host and commit the result." && exit 1)

  postgres-migration-test:
    name: Postgres Migration Test
    needs: change-check
    if: needs.change-check.outputs.postgres-migrations == 'true' || needs.change-check.outputs.run_all == 'true'
    runs-on: ubuntu-latest
    timeout-minutes: 20
    concurrency:
      group: postgres-migration-${{ github.head_ref || github.run_id }}
      cancel-in-progress: true
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          fetch-depth: 0
      - uses: ./.github/actions/init

      # Warm the test images from the GHCR mirror so the steps
      # below start from a local image instead of an unauthenticated Docker Hub
      # pull (the cause of the recurring registry-1.docker.io timeouts).
      # Best-effort: a miss falls back to a hardened-retry Docker Hub pull.
      - name: Warm test Docker images from the GHCR mirror
        continue-on-error: true
        uses: ./.github/actions/warm-test-images
      - name: Start Postgres
        run: pnpm start:pg
        working-directory: packages/postgres

      - name: Determine changed migrations
        id: migrations
        env:
          PULL_REQUEST_BASE_SHA: ${{ github.event.pull_request.base.sha || '' }}
          GITHUB_EVENT_BEFORE: ${{ github.event.before || '' }}
        shell: bash
        run: packages/postgres/scripts/determine-changed-migrations.sh

      # Fail fast if a newly added additive migration drops/renames a column or
      # table in its up() — those belong in migrations-removal/ (post-deploy) so
      # they don't break the previous code revision mid-rollout.
      - name: Guard removal-phase migrations
        if: steps.migrations.outputs.count && steps.migrations.outputs.count != '0'
        env:
          # Newline-separated file list; the guard reads it from this env var
          # (no shell word-splitting, no multiline value inlined into the script).
          CHANGED_MIGRATIONS: ${{ steps.migrations.outputs.files }}
        run: node packages/postgres/scripts/check-removal-phase.cjs

      - name: Apply migrations
        if: steps.migrations.outputs.count && steps.migrations.outputs.count != '0'
        working-directory: packages/postgres
        env:
          PGHOST: localhost
          PGPORT: 5435
        run: pnpm migrate up
      - name: Run down migrations
        if: steps.migrations.outputs.count && steps.migrations.outputs.count != '0'
        working-directory: packages/postgres
        env:
          MIGRATION_DOWN_COUNT: ${{ steps.migrations.outputs.down_count }}
        run: pnpm migrate down "$MIGRATION_DOWN_COUNT"
      - name: Reapply migrations
        if: steps.migrations.outputs.count && steps.migrations.outputs.count != '0'
        working-directory: packages/postgres
        run: pnpm migrate up

  boxel-ui-test:
    name: Boxel UI Tests
    needs: [change-check]
    if: needs.change-check.outputs.boxel-ui == 'true' || github.ref == 'refs/heads/main' || needs.change-check.outputs.run_all == 'true'
    runs-on: ubuntu-latest
    timeout-minutes: 15
    concurrency:
      group: boxel-ui-test-${{ github.head_ref || github.run_id }}
      cancel-in-progress: true
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - uses: ./.github/actions/init
      - name: Restore boxel-icons build cache
        id: icons-cache
        uses: ./.github/actions/restore-icons-cache
      - name: Build boxel-icons and boxel-ui
        run: mise run build:ui
        env:
          SKIP_ICONS_BUILD: ${{ steps.icons-cache.outputs.cache-hit }}
      - name: Run test suite
        run: pnpm test
        working-directory: packages/boxel-ui
      - name: Run docs app test suite
        run: pnpm test
        working-directory: packages/boxel-ui/docs-app

  pretui-test:
    name: Pret UI Tests (shard ${{ matrix.shard }} of ${{ strategy.job-total }})
    needs: [change-check]
    if: needs.change-check.outputs.pretui == 'true' || github.ref == 'refs/heads/main' || needs.change-check.outputs.run_all == 'true'
    runs-on: ubuntu-latest
    timeout-minutes: 15
    strategy:
      fail-fast: false
      matrix:
        shard: [1, 2, 3, 4, 5]
    concurrency:
      group: pretui-test-${{ matrix.shard }}-${{ github.head_ref || github.run_id }}
      cancel-in-progress: true
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version: "24"
      # Linting lives in ci-lint.yaml, which runs on every change to this
      # package. This job only runs the package's *.test.gts files, through
      # the boxel-cli test engine: it mounts the directory as an in-memory
      # realm and drives the host test harness bundled with that CLI release,
      # so no workspace install or realm-server is needed. The pin decides
      # which host harness the tests run against; bump it deliberately.
      - name: Install Boxel CLI
        run: npm install -g @cardstack/boxel-cli@0.5.0
      # The browser revision must match the CLI's own @playwright/test pin,
      # so install through the CLI's nested playwright binary.
      - name: Install Chromium
        run: |
          "$(npm root -g)/@cardstack/boxel-cli/node_modules/.bin/playwright" install --with-deps chromium
      # `boxel test` caps a whole QUnit run at 300 s, so each job keeps a
      # deterministic slice of the test files, balanced by the per-file run
      # times in scripts/test-timings.json (refresh them with
      # `node scripts/test-shards.mjs --record`). The shard count follows the
      # matrix length, so resizing the matrix resizes the split.
      - name: Select this shard's test files
        run: node scripts/test-shards.mjs ${{ matrix.shard }} ${{ strategy.job-total }}
        working-directory: packages/pretui
      - name: Run tests
        run: boxel test .
        working-directory: packages/pretui

  choreo-test:
    name: Choreo Tests
    needs: [change-check]
    if: needs.change-check.outputs.choreo == 'true' || github.ref == 'refs/heads/main' || needs.change-check.outputs.run_all == 'true'
    runs-on: ubuntu-latest
    timeout-minutes: 15
    concurrency:
      group: choreo-test-${{ github.head_ref || github.run_id }}
      cancel-in-progress: true
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - uses: ./.github/actions/init
      # The gallery resolves these packages through their built output
      # (package.json#exports maps into dist/ and declarations/). glimmer-motion
      # builds first: choreo's declarations build resolves it the same way.
      - name: Build Glimmer Motion, Choreo and Choreo Player
        id: build-libs
        if: ${{ !cancelled() }}
        run: |
          (cd packages/glimmer-motion && pnpm run build)
          (cd packages/choreo && pnpm run build)
          (cd packages/choreo-player && pnpm run build)
      # npm consumers resolve every subpath to the built output. For
      # glimmer-motion and choreo that means without the `developing:choreo`
      # condition the workspace builds from source with. Each check packs its
      # package and resolves every module's subpath against the tarball, so a
      # `files` / `exports` mismatch fails here instead of on install.
      - name: Check the packed glimmer-motion, Choreo and Choreo Player exports
        if: ${{ !cancelled() && steps.build-libs.outcome == 'success' }}
        run: |
          (cd packages/glimmer-motion && pnpm run check:packed-exports)
          (cd packages/choreo && pnpm run check:packed-exports)
          (cd packages/choreo-player && pnpm run check:packed-exports)
      - name: Choreo Player unit tests
        if: ${{ !cancelled() && steps.build-libs.outcome == 'success' }}
        run: pnpm run test:unit
        working-directory: packages/choreo-player
      # The release decisions choreo-player-publish.yml runs on, as pure
      # functions under Node.
      - name: Choreo Player release script tests
        if: ${{ !cancelled() }}
        run: pnpm run test:release
        working-directory: packages/choreo-player

  # The gallery realm's *.test.gts files. The realm's lint and its content
  # check run in ci-lint.yaml.
  choreo-gallery-test:
    name: Choreo Gallery Tests
    needs: [change-check, test-web-assets]
    if: needs.change-check.outputs.choreo == 'true' || github.ref == 'refs/heads/main' || needs.change-check.outputs.run_all == 'true'
    runs-on: ubuntu-latest
    timeout-minutes: 15
    concurrency:
      group: choreo-gallery-test-${{ github.head_ref || github.run_id }}
      cancel-in-progress: true
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version: "24"
      # The boxel-cli test engine mounts realm/ as an in-memory realm and
      # drives a host test harness, so no workspace install or realm-server
      # is needed. The harness is this commit's host, from test-web-assets,
      # not the one bundled with the CLI release: the gallery uses
      # glimmer-motion and Choreo as they are in this commit, which a
      # published CLI's host predates. The pin decides only the test engine.
      - name: Download test web assets
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: ${{ needs.test-web-assets.outputs.artifact_name }}
          path: .test-web-assets-artifact
      - name: Restore test web assets into workspace
        shell: bash
        run: |
          shopt -s dotglob
          cp -a .test-web-assets-artifact/. ./
      - name: Install Boxel CLI
        run: npm install -g @cardstack/boxel-cli@0.9.0-unstable.1
      # The browser revision must match the CLI's own @playwright/test pin,
      # so install through the CLI's nested playwright binary.
      - name: Install Chromium
        run: |
          "$(npm root -g)/@cardstack/boxel-cli/node_modules/.bin/playwright" install --with-deps chromium
      - name: Run tests
        run: boxel test realm
        working-directory: packages/choreo-gallery
        env:
          # the host package directory; the CLI reads its dist/
          TEST_HARNESS_HOST_DIST_PACKAGE_DIR: ${{ github.workspace }}/packages/host

  # glimmer-motion's own QUnit suite, which compiles the package from source.
  glimmer-motion-test:
    name: Glimmer Motion Tests
    needs: [change-check]
    if: needs.change-check.outputs.glimmer-motion == 'true' || github.ref == 'refs/heads/main' || needs.change-check.outputs.run_all == 'true'
    runs-on: ubuntu-latest
    timeout-minutes: 30
    concurrency:
      group: glimmer-motion-test-${{ github.head_ref || github.run_id }}
      cancel-in-progress: true
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - uses: ./.github/actions/init
      # The lockstep release decisions glimmer-motion-choreo-publish.yml runs
      # on, as pure functions under Node.
      - name: Release script tests
        run: pnpm test:release
        working-directory: packages/glimmer-motion
      - name: Run test suite
        run: pnpm test
        working-directory: packages/glimmer-motion

  # choreo's own QUnit suite (Choreo and film), which compiles choreo and
  # glimmer-motion from source through the `developing:choreo` export
  # condition.
  choreo-addon-test:
    name: Choreo Addon Tests
    needs: [change-check]
    if: needs.change-check.outputs.choreo-addon == 'true' || github.ref == 'refs/heads/main' || needs.change-check.outputs.run_all == 'true'
    runs-on: ubuntu-latest
    timeout-minutes: 30
    concurrency:
      group: choreo-addon-test-${{ github.head_ref || github.run_id }}
      cancel-in-progress: true
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - uses: ./.github/actions/init
      - name: Run test suite
        run: pnpm test
        working-directory: packages/choreo

  # The secure origin's pages: the credential frame's protocol and the
  # components each page draws, run in Chrome against a development build of
  # the package with its tests entry.
  secure-origin-test:
    name: Secure Origin Tests
    needs: [change-check]
    if: needs.change-check.outputs.secure-origin == 'true' || github.ref == 'refs/heads/main' || needs.change-check.outputs.run_all == 'true'
    runs-on: ubuntu-latest
    timeout-minutes: 15
    concurrency:
      group: secure-origin-test-${{ github.head_ref || github.run_id }}
      cancel-in-progress: true
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - uses: ./.github/actions/init
      - name: Run test suite
        run: pnpm test:components
        working-directory: packages/secure-origin

  # The film app's QUnit suite: the reference films' scores against their
  # golden fixtures. It compiles glimmer-motion and Choreo from source through
  # the `developing:choreo` export condition. Then the realm build `pnpm push`
  # makes, so a change that breaks it fails here rather than at deploy.
  choreo-film-app-test:
    name: Choreo Film App Tests
    needs: [change-check]
    if: needs.change-check.outputs.choreo == 'true' || github.ref == 'refs/heads/main' || needs.change-check.outputs.run_all == 'true'
    runs-on: ubuntu-latest
    timeout-minutes: 20
    concurrency:
      group: choreo-film-app-test-${{ github.head_ref || github.run_id }}
      cancel-in-progress: true
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - uses: ./.github/actions/init
      - name: Run test suite
        run: pnpm test
        working-directory: packages/choreo-film-app
      - name: Build the film app into the gallery realm
        if: ${{ !cancelled() }}
        run: pnpm build:realm
        working-directory: packages/choreo-film-app

  # glimmer-motion's and choreo's suites against the packages' built output,
  # the code npm consumers get. Only the rollup build
  # inlines and tree-shakes framer-motion's internals, so these are the runs
  # that exercise it. CHOREO_LIBS=dist leaves the `developing:choreo`
  # condition out of each suite's Vite config.
  choreo-dist-test:
    name: Glimmer Motion and Choreo Tests (built output)
    needs: [change-check]
    if: needs.change-check.outputs.choreo == 'true' || github.ref == 'refs/heads/main' || needs.change-check.outputs.run_all == 'true'
    runs-on: ubuntu-latest
    timeout-minutes: 30
    concurrency:
      group: choreo-dist-test-${{ github.head_ref || github.run_id }}
      cancel-in-progress: true
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - uses: ./.github/actions/init
      # glimmer-motion builds first: choreo's declarations build resolves it
      # through its built output.
      - name: Build Glimmer Motion, Choreo and Choreo Player
        id: build-libs
        run: |
          (cd packages/glimmer-motion && pnpm run build)
          (cd packages/choreo && pnpm run build)
          (cd packages/choreo-player && pnpm run build)
      - name: Glimmer Motion test suite
        if: ${{ !cancelled() && steps.build-libs.outcome == 'success' }}
        run: pnpm test
        working-directory: packages/glimmer-motion
        env:
          CHOREO_LIBS: dist
      - name: Choreo test suite
        if: ${{ !cancelled() && steps.build-libs.outcome == 'success' }}
        run: pnpm test
        working-directory: packages/choreo
        env:
          CHOREO_LIBS: dist

  boxel-ui-raw-icon-changes-only:
    name: Boxel UI ensure raw icon changes only
    needs: change-check
    if: needs.change-check.outputs.boxel-ui == 'true' || github.ref == 'refs/heads/main' || needs.change-check.outputs.run_all == 'true'
    runs-on: ubuntu-latest
    timeout-minutes: 15
    concurrency:
      group: boxel-ui-raw-icon-changes-only-${{ github.head_ref || github.run_id }}
      cancel-in-progress: true
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - uses: ./.github/actions/init
      - name: Rebuild boxel-ui icons
        run: pnpm rebuild:icons
        working-directory: packages/boxel-ui
      - name: Fail if generated icons have been changed without underlying raw icon changing
        run: git diff --exit-code

  boxel-icons-raw-icon-changes-only:
    name: Boxel Icons ensure raw icon changes only
    needs: change-check
    if: needs.change-check.outputs.boxel-icons == 'true' || github.ref == 'refs/heads/main' || needs.change-check.outputs.run_all == 'true'
    runs-on: ubuntu-latest
    timeout-minutes: 15
    concurrency:
      group: boxel-icons-raw-icon-changes-only-${{ github.head_ref || github.run_id }}
      cancel-in-progress: true
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - uses: ./.github/actions/init
      - name: Rebuild boxel-icons icons
        run: pnpm rebuild:all
        working-directory: packages/boxel-icons
      - name: Fail if generated icons have been changed without underlying raw icon changing
        run: git diff --exit-code

  matrix-client-test:
    name: Matrix Client Tests
    needs: [change-check, test-web-assets]
    if: needs.change-check.outputs.matrix == 'true' || github.ref == 'refs/heads/main' || needs.change-check.outputs.run_all == 'true'
    runs-on: ubuntu-latest
    timeout-minutes: 40
    strategy:
      fail-fast: false
      matrix:
        shardIndex: [1, 2, 3]
        shardTotal: [3]
        include:
          # The specs under packages/matrix/tests/with-synapse/<template>/
          # need a Synapse configured otherwise than the one the shards share,
          # so each template's run is a job of its own, unsharded. Its
          # `shardIndex` is a label naming the job and its artifacts.
          - shardIndex: without-registration-token
            synapseTemplate: test-without-registration-token
    concurrency:
      group: matrix-client-test-${{ matrix.shardIndex }}-${{ github.head_ref || github.run_id }}
      cancel-in-progress: true
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - uses: ./.github/actions/init
      - name: Download test web assets
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: ${{ needs.test-web-assets.outputs.artifact_name }}
          path: .test-web-assets-artifact
      - name: Restore test web assets into workspace
        shell: bash
        run: |
          shopt -s dotglob
          cp -a .test-web-assets-artifact/. ./
      - name: Install Playwright Browsers
        # Chromium only: playwright.config.ts declares no other project and no
        # spec here launches Firefox or WebKit. Fetching them anyway makes
        # Playwright's host validation warn that their libraries (libgtk-4,
        # libgst*, libflite*) are missing, which reads like a broken install
        # rather than two browsers this suite never uses.
        run: pnpm exec playwright install chromium
        working-directory: packages/matrix
      # Warm the test images from the GHCR mirror so the services
      # below (and the Playwright synapse/smtp fixtures) start from a local
      # image instead of an unauthenticated Docker Hub pull (the cause of the
      # recurring registry-1.docker.io timeouts). Best-effort: a miss falls
      # back to a hardened-retry Docker Hub pull.
      - name: Warm test Docker images from the GHCR mirror
        continue-on-error: true
        uses: ./.github/actions/warm-test-images
      - name: Run OIDC mapping provider unit tests
        # Fast (~no boot) and stack-independent — it only needs the warmed
        # Synapse image — so run it once on shard 1 rather than every shard.
        if: matrix.shardIndex == 1
        run: pnpm test:oidc-mapping-provider
        working-directory: packages/matrix
      - name: Run shard-assignment unit tests
        # Guards the property the split below rests on: the shards partition
        # the spec files, so every spec runs on exactly one of them. Needs
        # nothing running, so once on shard 1 is enough.
        if: matrix.shardIndex == 1
        run: pnpm test:shard-assignment
        working-directory: packages/matrix
      - name: Run compact-synapse-db unit tests
        # Runs the script against SQLite fixtures in temp directories. It only
        # needs docker to list running containers, so once on shard 1.
        if: matrix.shardIndex == 1
        run: pnpm test:compact-synapse-db
        working-directory: packages/matrix
      - name: Start test services (icons + host dist + base realm)
        run: |
          MATRIX_REGISTRATION_SHARED_SECRET='xxxx' mise run test-services:matrix | tee -a /tmp/server.log &
          timeout 300 bash -c 'until curl -ksf https://localhost:4200 > /dev/null && curl -sf http://localhost:4206 > /dev/null; do sleep 2; done'
      - name: Run Playwright tests
        run: pnpm test:group ${{ matrix.shardTotal && format('{0}/{1}', matrix.shardIndex, matrix.shardTotal) || '' }}
        working-directory: packages/matrix
        env:
          MATRIX_SYNAPSE_TEMPLATE: ${{ matrix.synapseTemplate }}
      # The services above stream their output into this job's log as the run
      # goes, so the file is a second copy of what is already there — and at
      # tens of thousands of lines it pushes the Playwright run's own output
      # past the tail the Actions logs API will serve, which is what a failed
      # shard is read from. The tail below is for a glance; the whole file is
      # the realm server log artifact.
      - name: Print the tail of the realm server log
        if: ${{ !cancelled() }}
        run: tail -n 500 /tmp/server.log
      - name: Extract worker and prerender logs
        if: ${{ !cancelled() }}
        run: |
          grep -E '^\[start:worker-base|^\[start:worker-development|^\[start:worker-test' /tmp/server.log > /tmp/worker-manager.log || true
          grep -E '^\[start:prerender-dev' /tmp/server.log > /tmp/prerender-server.log || true
          grep -E '^\[start:prerender-manager-dev' /tmp/server.log > /tmp/prerender-manager.log || true
          grep -E '^\[start:icons' /tmp/server.log > /tmp/icon-server.log || true
          grep -E '^\[start:host-dist' /tmp/server.log > /tmp/host-dist.log || true
      # The log uploads below are for reading a shard after the fact. Nothing
      # downstream consumes them, so losing one loses that view of this shard
      # and nothing else, and a failed upload does not fail the shard. The
      # blob report further down stays fatal on purpose: the merge and
      # shard-timings jobs consume it, and a report that did not upload would
      # publish a smaller build as a complete one rather than show as a failed
      # shard.
      - name: Upload realm server log
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        if: ${{ !cancelled() }}
        continue-on-error: true
        with:
          name: matrix-test-realm-server-log-${{ matrix.shardIndex }}
          path: /tmp/server.log
          retention-days: 30
      - name: Upload worker manager log
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        if: ${{ !cancelled() }}
        continue-on-error: true
        with:
          name: matrix-test-worker-manager-log-${{ matrix.shardIndex }}
          path: /tmp/worker-manager.log
          retention-days: 30
      - name: Upload prerender server log
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        if: ${{ !cancelled() }}
        continue-on-error: true
        with:
          name: matrix-test-prerender-server-log-${{ matrix.shardIndex }}
          path: /tmp/prerender-server.log
          retention-days: 30
      - name: Upload prerender manager log
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        if: ${{ !cancelled() }}
        continue-on-error: true
        with:
          name: matrix-test-prerender-manager-log-${{ matrix.shardIndex }}
          path: /tmp/prerender-manager.log
          retention-days: 30
      - name: Upload icon server log
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        if: ${{ !cancelled() }}
        continue-on-error: true
        with:
          name: matrix-test-icon-server-log-${{ matrix.shardIndex }}
          path: /tmp/icon-server.log
          retention-days: 30
      - name: Upload host-dist log
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        if: ${{ !cancelled() }}
        continue-on-error: true
        with:
          name: matrix-test-host-dist-log-${{ matrix.shardIndex }}
          path: /tmp/host-dist.log
          retention-days: 30

      - name: Upload blob report to GitHub Actions Artifacts
        if: ${{ !cancelled() }}
        uses: ./.github/actions/upload-artifact-retry
        with:
          name: blob-report-${{ matrix.shardIndex }}
          path: packages/matrix/blob-report
          retention-days: 1

      # Traces are evidence for a human reading a failed spec. Nothing
      # downstream consumes them, so a failed upload does not fail the shard.
      - name: Upload Playwright traces
        if: ${{ !cancelled() }}
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        continue-on-error: true
        with:
          name: playwright-traces-${{ matrix.shardIndex }}
          path: packages/matrix/test-results/**/trace.zip
          retention-days: 30
          if-no-files-found: ignore

  matrix-client-merge-reports-and-publish:
    name: Merge Matrix reports and publish
    needs:
      - change-check
      - matrix-client-test
    # !cancelled() makes it run even if a matrix-client-test shard fails, but still respects cancellation
    if: ${{ !cancelled() && (needs.change-check.outputs.matrix == 'true' || github.ref == 'refs/heads/main' || needs.change-check.outputs.run_all == 'true') }}
    runs-on: ubuntu-latest
    timeout-minutes: 15
    concurrency:
      group: matrix-client-merge-reports-${{ github.head_ref || github.run_id }}
      cancel-in-progress: true

    permissions:
      id-token: write
      contents: write
      checks: write
      statuses: write

    outputs:
      timestamp: ${{ steps.timestampid.outputs.timestamp }}

    steps:
      - name: Create a timestamp as a directory to store reports in
        id: timestampid
        run: echo "timestamp=$(date --utc +%Y%m%d_%H%M%SZ)" >> "$GITHUB_OUTPUT"
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - uses: ./.github/actions/init

      - name: Download blob reports from GitHub Actions Artifacts
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          path: all-blob-reports
          pattern: blob-report-*
          merge-multiple: true

      - name: Merge blobs into one single report
        run: pnpm exec playwright merge-reports --reporter html ./all-blob-reports

      - name: Upload HTML report
        uses: ./.github/actions/upload-artifact-retry
        with:
          name: html-report--attempt-${{ github.run_attempt }}
          path: playwright-report
          retention-days: 14

      - name: Set up env
        env:
          INPUT_ENVIRONMENT: ${{ inputs.environment }}
        run: |
          echo "AWS_REGION=us-east-1" >> $GITHUB_ENV
          echo "AWS_ROLE_ARN=arn:aws:iam::680542703984:role/boxel-matrix-playwright-reports" >> $GITHUB_ENV
          echo "AWS_S3_BUCKET=cardstack-boxel-matrix-playwright-reports-staging" >> $GITHUB_ENV

      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@ec61189d14ec14c8efccab744f656cffd0e33f37 # v6.1.0
        with:
          role-to-assume: ${{ env.AWS_ROLE_ARN }}
          aws-region: us-east-1

      - name: Publish consolidated report to S3
        run: aws s3 sync ./playwright-report s3://cardstack-boxel-matrix-playwright-reports-staging/${{ github.head_ref || github.ref_name }}/${{ steps.timestampid.outputs.timestamp }}

      - name: Store Playwright report URL
        shell: bash
        run: echo "PLAYWRIGHT_REPORT_URL=https://boxel-matrix-playwright-reports.stack.cards/${{ github.head_ref || github.ref_name }}/${{ steps.timestampid.outputs.timestamp }}/index.html" >> $GITHUB_ENV

      - name: Add status with link to Playwright report
        shell: bash
        env:
          GITHUB_TOKEN: ${{ github.token }}
          REPOSITORY: ${{ github.repository }}
          HEAD_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
          MATRIX_TEST_RESULT: ${{ needs.matrix-client-test.result }}
        run: |
          state="success"
          description=""
          if [ "$MATRIX_TEST_RESULT" = "failure" ]; then
            state="failure"
            description="Matrix Playwright shard failures"
          fi
          curl \
            -X POST \
            -H "Authorization: token $GITHUB_TOKEN" \
            -H "Accept: application/vnd.github.v3+json" \
            https://api.github.com/repos/$REPOSITORY/statuses/$HEAD_SHA \
            -d '{"context":"Matrix Playwright tests report","description":"'"$description"'","target_url":"'"$PLAYWRIGHT_REPORT_URL"'","state":"'"$state"'"}'

  matrix-shard-timings-update:
    name: Update Matrix Shard Timings
    # Intentionally scoped to push-to-main only, so it only runs where the
    # workflow file cannot be modified by an untrusted branch — this is the
    # one job in this workflow holding `contents: write`.
    #
    # Maintains packages/matrix/tests/spec-timings.json, the per-spec-file
    # durations that decide which shard each spec file runs on (see
    # packages/matrix/support/shard-spec-files.ts). Refreshed whenever the
    # shards finish, success OR failure: spec files missing from a failed
    # shard's report keep their committed values, and skipping every red run
    # would leave the timings to rot on a flaky week.
    if: ${{ github.event_name == 'push' && github.ref == 'refs/heads/main' && !cancelled() && (needs.matrix-client-test.result == 'success' || needs.matrix-client-test.result == 'failure') }}
    needs: [matrix-client-test]
    runs-on: ubuntu-latest
    timeout-minutes: 15
    concurrency:
      group: matrix-shard-timings-update-${{ github.head_ref || github.run_id }}
      cancel-in-progress: true
    permissions:
      contents: write
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          # Need history past the triggering SHA so the staleness check below
          # can inspect commits between the workflow's SHA and origin/main.
          fetch-depth: 0
      - uses: ./.github/actions/init

      - name: Download blob reports from GitHub Actions Artifacts
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          path: all-blob-reports
          pattern: blob-report-*
          merge-multiple: true

      # The JSON reporter is the only merged form that carries per-test
      # durations; the HTML report the sibling job publishes does not.
      - name: Merge blob reports into a JSON report
        run: pnpm exec playwright merge-reports --reporter json ../../all-blob-reports > /tmp/matrix-report.json
        working-directory: packages/matrix

      - name: Update shard timings
        # Retry from the latest main: another PR may merge while this workflow
        # is running, causing `git push` to be rejected. Each retry fetches and
        # hard-resets to the freshest tip-of-main, then regenerates against it.
        #
        # Staleness guard: if a commit other than an automated measurement
        # update landed on main since this workflow was triggered, skip — that
        # newer push triggered its own run, which will publish timings derived
        # from its own code.
        run: |
          git config user.name "github-actions[bot]"
          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"

          WORKFLOW_SHA="${{ github.sha }}"

          for attempt in 1 2 3 4 5; do
            git fetch origin main

            if [ "$(git rev-parse origin/main)" != "$WORKFLOW_SHA" ] && \
               git log --format="%s" "$WORKFLOW_SHA..origin/main" \
                 | grep -qvE "Update (host test (memory )?baselines?|matrix shard timings|realm-server shard timings)"; then
              echo "main has advanced past $WORKFLOW_SHA — skipping (a newer CI run will publish the timings)."
              exit 0
            fi

            git reset --hard origin/main

            # Gated on drift: the file is only rewritten when regenerating it
            # improves the predicted slowest-shard time by over a minute, so
            # run-to-run jitter doesn't produce a commit per main push. The
            # shard count must match `shardTotal` on matrix-client-test above.
            node packages/matrix/scripts/generate-spec-timings.ts /tmp/matrix-report.json \
              --min-drift-seconds 60 --shard-count 3

            if git diff --quiet packages/matrix/tests/spec-timings.json; then
              echo "Shard timings unchanged — nothing to commit."
              exit 0
            fi
            git add packages/matrix/tests/spec-timings.json
            git commit -m "Update matrix shard timings [skip ci]"

            if git push; then
              exit 0
            fi
            echo "Push rejected on attempt $attempt — retrying after $((attempt * 5))s"
            sleep $((attempt * 5))
          done
          echo "Failed to push shard timings after 5 attempts"
          exit 1

  realm-server-test:
    name: Realm Server Tests
    needs: [change-check, test-web-assets]
    if: needs.change-check.outputs.realm-server == 'true' || github.ref == 'refs/heads/main' || needs.change-check.outputs.run_all == 'true'
    runs-on: ubuntu-latest
    timeout-minutes: 40
    concurrency:
      group: realm-server-test-${{ matrix.shardIndex }}-${{ github.head_ref || github.run_id }}
      cancel-in-progress: true
    strategy:
      fail-fast: false
      # Three places carry the shard count and must move together: this list,
      # `shardTotal` below, and `--shard-count` on the timings generator in
      # realm-server-shard-timings-update, which decides whether a rebalance
      # is worth committing by predicting the slowest shard.
      matrix:
        shardIndex: [1, 2, 3, 4, 5, 6]
        shardTotal: [6]
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - uses: ./.github/actions/init
      - name: Download test web assets
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: ${{ needs.test-web-assets.outputs.artifact_name }}
          path: .test-web-assets-artifact
      - name: Restore test web assets into workspace
        shell: bash
        run: |
          shopt -s dotglob
          cp -a .test-web-assets-artifact/. ./
      - name: Compute shard test modules
        id: shard_modules
        run: echo "modules=$(node scripts/shard-test-modules.cjs ${{ matrix.shardIndex }} ${{ matrix.shardTotal }})" >> "$GITHUB_OUTPUT"
        working-directory: packages/realm-server
      # Warm the test images from the GHCR mirror so the services
      # below start from a local image instead of an unauthenticated Docker Hub
      # pull (the cause of the recurring registry-1.docker.io timeouts).
      # Best-effort: a miss falls back to a hardened-retry Docker Hub pull.
      - name: Warm test Docker images from the GHCR mirror
        continue-on-error: true
        uses: ./.github/actions/warm-test-images
      - name: Start test services (icons + host dist + realm servers)
        run: mise run test-services:realm-server | tee -a /tmp/server.log &
      - name: create realm users
        run: pnpm register-realm-users
        working-directory: packages/matrix
      - name: realm server test suite
        run: pnpm test:wait-for-servers
        working-directory: packages/realm-server
        env:
          TEST_MODULES: ${{ steps.shard_modules.outputs.modules }}
          JUNIT_OUTPUT_FILE: ${{ github.workspace }}/junit/realm-server-${{ matrix.shardIndex }}.xml
      - name: Upload junit report
        uses: ./.github/actions/upload-artifact-retry
        if: ${{ !cancelled() }}
        with:
          name: realm-server-test-report-${{ matrix.shardIndex }}
          path: junit/realm-server-${{ matrix.shardIndex }}.xml
          retention-days: 30
      - name: Print realm server logs
        if: ${{ !cancelled() }}
        run: cat /tmp/server.log
      - name: Prepare artifact name
        id: artifact_name
        if: ${{ !cancelled() }}
        run: |
          export SAFE_ARTIFACT_NAME=shard-${{ matrix.shardIndex }}
          echo "artifact_name=$SAFE_ARTIFACT_NAME" >> "$GITHUB_OUTPUT"
      - name: Extract worker and prerender logs
        if: ${{ !cancelled() }}
        run: |
          grep -E '^\[start:worker-development|^\[start:worker-test' /tmp/server.log > /tmp/worker-manager.log || true
          grep -E '^\[start:prerender-dev' /tmp/server.log > /tmp/prerender-server.log || true
          grep -E '^\[start:prerender-manager-dev' /tmp/server.log > /tmp/prerender-manager.log || true
          grep -E '^\[start:development' /tmp/server.log > /tmp/start-development.log || true
          grep -E '^\[start:test-realms|^\[start:worker-test' /tmp/server.log > /tmp/test-realms.log || true
          grep -E '^\[start:icons' /tmp/server.log > /tmp/icon-server.log || true
          grep -E '^\[start:host-dist' /tmp/server.log > /tmp/host-dist.log || true
      # The log uploads below are for reading a shard after the fact. Nothing
      # downstream consumes them, so losing one loses that view of this shard
      # and nothing else, and a failed upload does not fail the shard. The
      # junit report above stays fatal on purpose: the merge job consumes it,
      # and a report that did not upload would publish a smaller build as a
      # complete one rather than show as a failed shard.
      - name: Upload realm server log
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        if: ${{ !cancelled() }}
        continue-on-error: true
        with:
          name: realm-server-test-realm-server-log-${{steps.artifact_name.outputs.artifact_name}}
          path: /tmp/server.log
          retention-days: 30
      - name: Upload worker manager log
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        if: ${{ !cancelled() }}
        continue-on-error: true
        with:
          name: realm-server-test-worker-manager-log-${{steps.artifact_name.outputs.artifact_name}}
          path: /tmp/worker-manager.log
          retention-days: 30
      - name: Upload prerender server log
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        if: ${{ !cancelled() }}
        continue-on-error: true
        with:
          name: realm-server-test-prerender-server-log-${{steps.artifact_name.outputs.artifact_name}}
          path: /tmp/prerender-server.log
          retention-days: 30
      - name: Upload prerender manager log
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        if: ${{ !cancelled() }}
        continue-on-error: true
        with:
          name: realm-server-test-prerender-manager-log-${{steps.artifact_name.outputs.artifact_name}}
          path: /tmp/prerender-manager.log
          retention-days: 30
      - name: Upload start:development log
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        if: ${{ !cancelled() }}
        continue-on-error: true
        with:
          name: realm-server-test-start-development-log-${{steps.artifact_name.outputs.artifact_name}}
          path: /tmp/start-development.log
          retention-days: 30
      - name: Upload test-realms log
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        if: ${{ !cancelled() }}
        continue-on-error: true
        with:
          name: realm-server-test-test-realms-log-${{steps.artifact_name.outputs.artifact_name}}
          path: /tmp/test-realms.log
          retention-days: 30
      - name: Upload icon server log
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        if: ${{ !cancelled() }}
        continue-on-error: true
        with:
          name: realm-server-test-icon-server-log-${{steps.artifact_name.outputs.artifact_name}}
          path: /tmp/icon-server.log
          retention-days: 30
      - name: Upload host-dist log
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        if: ${{ !cancelled() }}
        continue-on-error: true
        with:
          name: realm-server-test-host-dist-log-${{steps.artifact_name.outputs.artifact_name}}
          path: /tmp/host-dist.log
          retention-days: 30

  realm-server-merge-reports:
    name: Merge Realm Server reports and publish
    if: ${{ !cancelled() && (needs.change-check.outputs.realm-server == 'true' || github.ref == 'refs/heads/main' || needs.change-check.outputs.run_all == 'true') }}
    concurrency:
      group: realm-server-merge-reports-${{ github.head_ref || github.run_id }}
      cancel-in-progress: true
    needs: [change-check, realm-server-test]
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - uses: ./.github/actions/init
      - name: Download JUnit reports
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          path: all-realm-server-reports
          pattern: realm-server-test-report-*
          merge-multiple: true
      - name: Merge reports
        run: npx junit-report-merger realm-server.xml "./all-realm-server-reports/*.xml"
      - name: Upload merged report
        uses: ./.github/actions/upload-artifact-retry
        if: ${{ !cancelled() }}
        with:
          name: realm-server-test-report-merged
          path: realm-server.xml
          retention-days: 30
      - name: Publish test results
        id: publish-tests
        uses: EnricoMi/publish-unit-test-result-action@170bf24d20d201b842d7a52403b73ed297e6645b # 2.18.0
        if: ${{ !cancelled() }}
        with:
          junit_files: realm-server.xml
          check_name: Realm Server Test Results
          comment_mode: "off"
          json_file: test-results.json

      - name: Build realm-tests slot
        if: ${{ !cancelled() && hashFiles('test-results.json') != '' }}
        run: |
          set -euo pipefail
          mkdir -p slot
          {
            echo "### Realm Server Test Results"
            echo
            jq -r '.summary' test-results.json

            failures=$(jq -r '((.stats.tests_fail // 0) + (.stats.tests_error // 0))' test-results.json)
            check_url=$(jq -r '.check_url // empty' test-results.json)
            if [ -n "$check_url" ] && [ "$failures" -gt 0 ]; then
              echo
              echo "For more details on these errors, see [this check]($check_url)."
            fi
          } > slot/slot.md

      - name: Upload realm-tests slot
        if: ${{ !cancelled() && hashFiles('slot/slot.md') != '' }}
        uses: ./.github/actions/upload-artifact-retry
        with:
          name: pr-comment-slot-realm-tests
          path: slot/
          retention-days: 7

  realm-server-shard-timings-update:
    name: Update Realm Server Shard Timings
    # Push-to-main only, like its two siblings: this is a job holding
    # `contents: write`, so it must not run from a ref an untrusted branch can
    # rewrite.
    #
    # Maintains packages/realm-server/tests/test-module-timings.json, the
    # per-file durations that decide which shard each test file runs on (see
    # packages/realm-server/scripts/shard-test-modules.cjs). Without this the
    # weights only change when someone remembers to regenerate them by hand,
    # and every file added in between packs at DEFAULT_WEIGHT no matter what it
    # actually costs.
    #
    # Runs off the merge job rather than the shards, because that is what
    # produces the merged report — and it runs whether or not the shards
    # passed. Files missing from a failed shard's report keep their committed
    # values, and skipping red runs would leave the weights to rot through a
    # flaky week.
    if: ${{ github.event_name == 'push' && github.ref == 'refs/heads/main' && !cancelled() && needs.realm-server-merge-reports.result == 'success' }}
    needs: [realm-server-merge-reports]
    runs-on: ubuntu-latest
    timeout-minutes: 15
    concurrency:
      group: realm-server-shard-timings-update-${{ github.head_ref || github.run_id }}
      cancel-in-progress: true
    permissions:
      contents: write
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          # History past the triggering SHA, so the staleness check below can
          # see what landed on main while this run was going.
          fetch-depth: 0

      # mise alone, not `./.github/actions/init`. The generator imports node
      # builtins and two local scripts and nothing else, so the frozen-lockfile
      # install that init performs would be several minutes spent on packages
      # this job never loads. .mise.toml still pins the node version.
      - uses: jdx/mise-action@c1ecc8f748cd28cdeabf76dab3cccde4ce692fe4 # v4.0.0
        with:
          install: true

      - name: Download the merged JUnit report
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: realm-server-test-report-merged
          path: merged-realm-server-report

      - name: Update shard timings
        # Retry from the latest main: another PR may merge while this workflow
        # is running, causing `git push` to be rejected. Each retry fetches and
        # hard-resets to the freshest tip-of-main, then regenerates against it.
        #
        # Staleness guard: if a commit other than an automated measurement
        # update landed on main since this workflow was triggered, skip — that
        # newer push triggered its own run, which will publish weights derived
        # from its own code.
        run: |
          git config user.name "github-actions[bot]"
          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"

          WORKFLOW_SHA="${{ github.sha }}"
          REPORT="$PWD/merged-realm-server-report/realm-server.xml"

          if [ ! -f "$REPORT" ]; then
            echo "No merged report at $REPORT — leaving the weights unchanged."
            exit 0
          fi

          for attempt in 1 2 3 4 5; do
            git fetch origin main

            if [ "$(git rev-parse origin/main)" != "$WORKFLOW_SHA" ] && \
               git log --format="%s" "$WORKFLOW_SHA..origin/main" \
                 | grep -qvE "Update (host test (memory )?baselines?|matrix shard timings|realm-server shard timings)"; then
              echo "main has advanced past $WORKFLOW_SHA — skipping (a newer CI run will publish the weights)."
              exit 0
            fi

            git reset --hard origin/main

            # Gated on drift: the weights are only rewritten when doing so
            # improves the predicted slowest shard by over a minute, so
            # run-to-run jitter doesn't produce a commit per main push. The
            # shard count must match `shardIndex` on realm-server-test above.
            #
            # A nonzero exit — the attribution floor, an unreadable report —
            # fails the job rather than committing degraded weights.
            node packages/realm-server/scripts/generate-test-module-timings.mjs "$REPORT" \
              --min-drift-seconds 60 --shard-count 6

            if git diff --quiet packages/realm-server/tests/test-module-timings.json; then
              echo "Shard timings unchanged — nothing to commit."
              exit 0
            fi
            git add packages/realm-server/tests/test-module-timings.json
            git commit -m "Update realm-server shard timings [skip ci]"

            if git push; then
              exit 0
            fi
            echo "Push rejected on attempt $attempt — retrying after $((attempt * 5))s"
            sleep $((attempt * 5))
          done
          echo "Failed to push shard timings after 5 attempts"
          exit 1

  amd-transpile-bench:
    name: AMD Transpile Bench
    needs: change-check
    # Parallel-independent bench of the loader's ES → AMD transpiler.
    # Compares production-candidate medians against
    # `packages/runtime-common/scripts/bench-amd/baseline.json`. When
    # baseline.json is absent the script runs in report-only mode and
    # exits 0 — used to anchor the initial baseline from real CI numbers
    # before enforcement is turned on. See CS-10983.
    if: needs.change-check.outputs.bench-amd == 'true' || github.ref == 'refs/heads/main' || needs.change-check.outputs.run_all == 'true'
    runs-on: ubuntu-latest
    timeout-minutes: 15
    concurrency:
      group: amd-transpile-bench-${{ github.head_ref || github.run_id }}
      cancel-in-progress: true
    env:
      # Doubled vs. the local default (50/5) to dampen GH-runner noise.
      ITER: 100
      WARMUP: 10
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - uses: ./.github/actions/init
      - name: Run bench gate
        run: pnpm bench:amd:check
        working-directory: packages/runtime-common

      - name: Trip-test (proves gate's failure path)
        # Synthetic stingy baseline → confirms exit 1, FAIL-message
        # format intact, every fixture appears in breach list. Runs
        # only after the real gate passes so a green pipeline means
        # "real gate accepts current code AND failure path still works."
        run: pnpm bench:amd:check:trip-test
        working-directory: packages/runtime-common

  realm-bench:
    name: Realm Performance Benchmark
    needs: change-check
    # HTTP GET and `_search` regression bench against a fixture realm
    # snapshot. Spins up an ephemeral realm-server stack (postgres +
    # prerender + worker + realm-server) via realm-test-harness and
    # times representative requests. Compares medians against
    # `packages/realm-server/scripts/bench-realm/baseline.json`. When
    # baseline.json is absent the script runs in report-only mode and
    # exits 0 — used to anchor the initial baseline from real CI numbers
    # before enforcement is turned on.
    #
    # Runs in parallel with everything else (only depends on
    # change-check, like `amd-transpile-bench`). The job builds host/dist
    # itself rather than consuming the shared `test-web-assets` artifact
    # so a slow web-assets build doesn't gate the bench.
    if: needs.change-check.outputs.bench-realm == 'true' || github.ref == 'refs/heads/main' || needs.change-check.outputs.run_all == 'true'
    runs-on: ubuntu-latest
    timeout-minutes: 20
    concurrency:
      group: realm-bench-${{ github.head_ref || github.run_id }}
      cancel-in-progress: true
    env:
      # CI default — local default is 50/5. The bench harness amortises
      # one stack startup across all scenarios, so doubling iterations
      # only adds ~tens of seconds for tighter medians.
      ITER: 100
      WARMUP: 10
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - uses: ./.github/actions/init
      # The harness mounts host/dist on the realm-server. Build it here
      # rather than consuming the test-web-assets artifact so the bench
      # stays parallel-independent. Host's build pulls in @cardstack/
      # boxel-ui and @cardstack/boxel-icons via their package exports, so
      # those need built dists before host's vite build can resolve them.
      - name: Build Boxel Icons
        run: pnpm run build
        working-directory: packages/boxel-icons
      - name: Build Boxel UI
        run: pnpm run build
        working-directory: packages/boxel-ui
      - name: Build host dist
        run: pnpm build
        working-directory: packages/host
      - name: Run bench gate
        run: pnpm bench:realm:check
        working-directory: packages/realm-server

  post-pr-status:
    name: Update PR status comment
    needs:
      - realm-server-merge-reports
    if: ${{ !cancelled() && needs.realm-server-merge-reports.result == 'success' }}
    uses: ./.github/workflows/pr-status-comment.yml
    permissions:
      contents: read
      issues: write
      pull-requests: write
      actions: read
    with:
      head-sha: ${{ github.event.pull_request.head.sha || github.sha }}
      pr-number: ${{ github.event.pull_request.number }}
      slots: realm-tests
    secrets: inherit

  vscode-boxel-tools-package:
    name: Boxel Tools VS Code Extension package
    needs: [change-check, test-web-assets]
    if: needs.change-check.outputs.vscode-boxel-tools == 'true' || github.ref == 'refs/heads/main' || needs.change-check.outputs.run_all == 'true'
    runs-on: ubuntu-latest
    timeout-minutes: 15
    concurrency:
      group: vscode-boxel-tools-test-${{ github.head_ref || github.run_id }}
      cancel-in-progress: true
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - uses: ./.github/actions/init
      - name: Download test web assets
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: ${{ needs.test-web-assets.outputs.artifact_name }}
          path: .test-web-assets-artifact
      - name: Restore test web assets into workspace
        shell: bash
        run: |
          shopt -s dotglob
          cp -a .test-web-assets-artifact/. ./
      - name: Prepublish
        run: pnpm vscode:prepublish
        working-directory: packages/vscode-boxel-tools
      - name: Package
        run: pnpm vscode:package
        working-directory: packages/vscode-boxel-tools
      - name: Upload
        uses: ./.github/actions/upload-artifact-retry
        with:
          name: vscode-boxel-tools
          path: packages/vscode-boxel-tools/boxel-tools*vsix

  boxel-cli-build:
    name: Boxel CLI Build
    needs: [change-check, test-web-assets]
    if: needs.change-check.outputs.boxel-cli == 'true' || github.ref == 'refs/heads/main' || needs.change-check.outputs.run_all == 'true'
    runs-on: ubuntu-latest
    timeout-minutes: 15
    concurrency:
      group: boxel-cli-build-${{ github.head_ref || github.run_id }}
      cancel-in-progress: true
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - uses: ./.github/actions/init
      # `pnpm build` in boxel-cli runs `build:test-harness`, which reads
      # from `packages/host/dist/`. Restore that from the shared
      # test-web-assets artifact so we don't have to rebuild the host
      # here (CS-11164).
      - name: Download test web assets
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: ${{ needs.test-web-assets.outputs.artifact_name }}
          path: .test-web-assets-artifact
      - name: Restore test web assets into workspace
        shell: bash
        run: |
          shopt -s dotglob
          cp -a .test-web-assets-artifact/. ./
      - name: Build boxel-cli
        run: pnpm build
        working-directory: packages/boxel-cli

  boxel-cli-test:
    name: Boxel CLI Tests
    needs: [change-check, test-web-assets]
    # Also run on realm-server changes: boxel-cli's integration tests cover
    # the publish/unpublish/readiness-check HTTP contract the realm-server
    # exposes, so a realm-server-only PR that drifts that contract (as in
    # CS-11161) needs to fail here pre-merge rather than on main post-merge.
    if: needs.change-check.outputs.boxel-cli == 'true' || needs.change-check.outputs.realm-server == 'true' || github.ref == 'refs/heads/main' || needs.change-check.outputs.run_all == 'true'
    runs-on: ubuntu-latest
    # A healthy run is ~10 minutes. The headroom is for the unhealthy one: a
    # fixture that wedges costs its whole hook budget
    # (packages/boxel-cli/vitest.config.mjs) before the file reports, and a job
    # cancelled on this cap reports nothing at all — the nameless failure that
    # budget exists to avoid. This covers a handful of wedged fixtures, not all
    # of them; a systemic fixture failure will still hit the cap.
    timeout-minutes: 30
    concurrency:
      group: boxel-cli-test-${{ github.head_ref || github.run_id }}
      cancel-in-progress: true
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - uses: ./.github/actions/init
      - name: Download test web assets
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: ${{ needs.test-web-assets.outputs.artifact_name }}
          path: .test-web-assets-artifact
      - name: Restore test web assets into workspace
        shell: bash
        run: |
          shopt -s dotglob
          cp -a .test-web-assets-artifact/. ./
      - name: Build
        run: pnpm build
        working-directory: packages/boxel-cli
      # The unit suite drives a real browser: local-mode `boxel test` runs the
      # host's compiled test bundle in chromium, so `tests/local-mode.test.ts`
      # launches one. Chromium only — `loadChromium` is the sole browser this
      # package launches, and firefox/webkit would pull system libraries this
      # job has no other use for.
      - name: Install Playwright Browsers
        run: pnpm exec playwright install chromium
        working-directory: packages/boxel-cli
      - name: Run unit tests
        run: pnpm test:unit
        working-directory: packages/boxel-cli
      # Warm the test images from the GHCR mirror so the steps
      # below start from a local image instead of an unauthenticated Docker Hub
      # pull (the cause of the recurring registry-1.docker.io timeouts).
      # Best-effort: a miss falls back to a hardened-retry Docker Hub pull.
      - name: Warm test Docker images from the GHCR mirror
        continue-on-error: true
        uses: ./.github/actions/warm-test-images
      - name: Start Matrix
        run: pnpm start:matrix
        working-directory: packages/realm-server
      - name: Create realm users
        run: pnpm register-realm-users
        working-directory: packages/matrix
      - name: Start dev stack (icons + host-dist + base realm + prerenderer)
        run: |
          mise run test-services:matrix | tee -a /tmp/server.log &
          # `-k` skips cert verification (the local realm-server speaks
          # HTTPS with the mkcert leaf cert). `-w '%{http_code}'` + grep
          # ensures we treat 3xx as still-not-ready instead of letting
          # `-f` return 0 on the dispatcher's redirect response, which
          # would race the tests ahead of the base realm finishing its
          # initial index.
          timeout 600 bash -c 'until curl -sk -o /dev/null -w "%{http_code}" https://localhost:4200/ | grep -qx 200 && curl -sk -o /dev/null -w "%{http_code}" -H "Accept: application/vnd.api+json" https://localhost:4201/base/_readiness-check | grep -qx 200; do sleep 2; done'
      # Run the integration suite against the CLI as an end user installs
      # it: `pnpm pack` the build from the step above, `npm install` the
      # tarball into a throwaway dir outside the monorepo (npm hoisting,
      # not pnpm's nested layout), and drive that binary via BOXEL_CLI_BIN.
      # This is the layout where `boxel parse`'s glint type-check silently
      # resolves nothing — which the in-process, function-call tests could
      # never exercise because they import command functions from src. The
      # `test:cli:tarball` script execs `pnpm test:integration` under the
      # installed binary, so the test-PG provisioning is unchanged.
      - name: Run integration tests against the packed npm install
        run: pnpm test:cli:tarball
        working-directory: packages/boxel-cli
      - name: Print server logs
        if: ${{ !cancelled() }}
        run: cat /tmp/server.log

  deploy:
    name: Deploy boxel to staging
    if: (needs.change-check.outputs.boxel == 'true' || needs.change-check.outputs.deployed-realms == 'true') && github.ref == 'refs/heads/main'
    needs:
      - change-check
      - ai-bot-test
      - bot-runner-test
      - boxel-ui-test
      - realm-server-test
    uses: ./.github/workflows/manual-deploy.yml
    # A called workflow's jobs may ask for no more than these, so they cover
    # every job in Manual Deploy, including the ones only production runs:
    # actions: write is the one that starts the Choreo gallery's republish.
    permissions:
      actions: write
      contents: read
      deployments: write
      id-token: write
    secrets: inherit
    with:
      environment: "staging"

  cache-index:
    name: Cache realm index
    needs: [change-check, test-web-assets]
    if: github.ref == 'refs/heads/main'
    runs-on: ubuntu-latest
    # Must exceed the ceiling on the index step below.
    timeout-minutes: 75
    concurrency:
      group: cache-index-${{ github.run_id }}
      cancel-in-progress: false
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - uses: ./.github/actions/init
      - name: Download test web assets
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: ${{ needs.test-web-assets.outputs.artifact_name }}
          path: .test-web-assets-artifact
      - name: Restore test web assets into workspace
        shell: bash
        run: |
          shopt -s dotglob
          cp -a .test-web-assets-artifact/. ./
      - name: Index all realms and dump tables
        # pipefail so a nonzero exit from the index/dump task fails the step
        # instead of being masked by tee's exit code.
        run: |
          set -o pipefail
          mise run ci:cache-index 2>&1 | tee /tmp/cache-index.log
        # Must exceed every wait the task can sit through, summed — a step
        # killed here reports neither which wait was outstanding nor for how
        # long, and that diagnosis is the point of the task's own budgets.
        # Both waits can expire in the same run, so the bound is their sum
        # plus the work around them:
        #   READINESS_TIMEOUT_MS       40m  (realm readiness)
        # + TEST_READINESS_TIMEOUT_MS  10m  (test-realm readiness)
        # + service startup             2m
        # + dump, verify, gzip          4m
        # = 56m, so 60 leaves a small margin. Raising either budget in
        # mise-tasks/ci/cache-index means raising this and the job's ceiling
        # with it.
        timeout-minutes: 60
      # Evidence for reading this job after the fact; the index caches below
      # are what it exists to publish and every consumer reads those. A failed
      # log upload therefore does not fail the job, and leaves the caches to be
      # verified and published.
      - name: Upload service logs
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        if: ${{ !cancelled() }}
        continue-on-error: true
        with:
          name: cache-index-log
          path: /tmp/cache-index.log
          retention-days: 7
      # Separate step so an incomplete cache (a table dropped out of the dump)
      # surfaces as its own short, clearly-labeled failure with an error
      # annotation, rather than an exit code buried in the dump log above.
      - name: Verify index cache is complete
        run: scripts/verify-index-cache.sh /tmp/boxel-index-cache.sql.gz
      - name: Upload index cache
        uses: ./.github/actions/upload-artifact-retry
        with:
          name: boxel-index-cache
          path: /tmp/boxel-index-cache.sql.gz
          retention-days: 30
      # The host-scoped snapshot covers only the realms a host test shard
      # serves, so a shard downloads and replays a fraction of the full one.
      # Verified with its own expected-tables sidecar (the script's default
      # would resolve to the full snapshot's, which happens to list the same
      # tables — passing it explicitly keeps that a fact rather than a
      # coincidence).
      - name: Verify host-scoped index cache is complete
        run: |
          scripts/verify-index-cache.sh \
            /tmp/boxel-index-cache-host.sql.gz \
            /tmp/boxel-index-cache-host.tables
      - name: Upload host-scoped index cache
        uses: ./.github/actions/upload-artifact-retry
        with:
          name: boxel-index-cache-host
          path: /tmp/boxel-index-cache-host.sql.gz
          retention-days: 30
      # The live test realms (`/test/`, `/node-test/`) index into their own
      # database, so they get their own snapshot. A test shard waits on their
      # readiness alongside base and skills.
      - name: Verify test-realm index cache is complete
        run: |
          scripts/verify-index-cache.sh \
            /tmp/boxel-index-cache-test.sql.gz \
            /tmp/boxel-index-cache-test.tables
      - name: Upload test-realm index cache
        uses: ./.github/actions/upload-artifact-retry
        with:
          name: boxel-index-cache-test
          path: /tmp/boxel-index-cache-test.sql.gz
          retention-days: 30