ci.yml

name: CI

on:
  pull_request:
  push:
    branches: [main]

concurrency:
  group: ci-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true

permissions:
  contents: read

jobs:
  fast-checks:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v6
        with:
          fetch-depth: 0
      - uses: jdx/mise-action@82a612c5ab8bcda7cc5db6b7e81a8e7584c3dc6e # v5
        with:
          minimum_release_age: 0s
      - run: bun install --frozen-lockfile
      - name: Install the locked OC1 config dependency fixture
        run: npm ci --prefix packages/e2e-tests/fixtures/opencode1-config-deps --ignore-scripts --no-audit --no-fund
      - run: bun run check:workspace-lock
      - run: bun run types
      - run: bun run build
      - run: bun test --cwd packages/opencode scripts/check-bundle-globals.test.ts
      - run: bun test scripts/windows packages/opencode/scripts/runtime-packaging.test.ts
      - run: bun test scripts/check-pi-dist-imports.test.ts
      - run: bun run check:pi-dist-imports
      - run: bun run --cwd packages/core test:scripts
      - run: bun run check:claustrum-golden
        env:
          GITHUB_TOKEN: ${{ github.token }}
      # The vendored Claude OAuth wire vectors must stay byte-identical to
      # cortexkit/commons at the commit pinned in their SOURCE file, the only
      # place the pin lives.
      - name: Verify vendored Claude OAuth wire vectors match commons
        run: |
          set -euo pipefail
          dir=packages/opencode/src/tests/fixtures/claude-oauth-wire
          read_key() { sed -n "s/^$1=//p" "$dir/SOURCE"; }
          repo="$(read_key repository)"
          commit="$(read_key commit)"
          path="$(read_key path)"
          if [[ -z "$repo" || -z "$path" || ! "$commit" =~ ^[0-9a-f]{40}$ ]]; then
            echo "::error file=$dir/SOURCE::SOURCE must set repository, path and a 40-hex commit"
            exit 1
          fi
          commons="$(mktemp -d)"
          git -C "$commons" init -q
          git -C "$commons" fetch -q --depth 1 "$repo" "$commit"
          status=0
          for file in README.md vectors.json SHA256SUMS; do
            if ! git -C "$commons" show "FETCH_HEAD:$path/$file" | cmp -s - "$dir/$file"; then
              echo "::error file=$dir/$file::$dir/$file differs from $repo at $commit ($path/$file). Copy it byte for byte with git show $commit:$path/$file, or bump the commit in $dir/SOURCE together with all three files."
              status=1
            fi
          done
          if [ "$status" = 0 ]; then
            echo "claude-oauth-wire: README.md, vectors.json and SHA256SUMS match $repo at $commit"
          fi
          exit "$status"
      - run: bun test scripts/check-test-count-floors.test.ts
      - run: bun run --cwd packages/opencode smoke:tui
        env:
          TUI_SMOKE_SKIP_BUILD: "1"
      - run: bun run test:pi-host
      - run: scripts/check-cortexkit-layout.sh
      - run: bun run format:check
      - run: bun run lint

  unit:
    name: Unit (${{ matrix.suite }}, ${{ matrix.shard }})
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        include:
          - suite: core
            shard: 1/1
          - suite: opencode
            shard: 1/4
          - suite: opencode
            shard: 2/4
          - suite: opencode
            shard: 3/4
          - suite: opencode
            shard: 4/4
          - suite: opencode
            shard: miniflare
          - suite: pi
            shard: 1/1
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v6
      - uses: jdx/mise-action@82a612c5ab8bcda7cc5db6b7e81a8e7584c3dc6e # v5
        with:
          minimum_release_age: 0s
      - run: bun install --frozen-lockfile
      # Bun owns file sharding; the runner has no stable file-to-shard map.
      # Prepare hosts in every ordinary OpenCode shard, but not miniflare.
      - name: Read packed OpenCode host versions
        if: matrix.suite == 'opencode' && matrix.shard != 'miniflare'
        id: packed-host-versions
        run: |
          key=$(bun packages/opencode/scripts/install-packed-hosts.ts --version-key)
          echo "key=$key" >> "$GITHUB_OUTPUT"
      - name: Restore packed OpenCode host npm downloads
        if: matrix.suite == 'opencode' && matrix.shard != 'miniflare'
        id: packed-host-cache
        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: node_modules/.cache/opencode-host-npm
          key: packed-opencode-npm-v2-${{ runner.os }}-${{ runner.arch }}-${{ steps.packed-host-versions.outputs.key }}
      - name: Install packed OpenCode hosts
        if: matrix.suite == 'opencode' && matrix.shard != 'miniflare'
        id: packed-host-install
        timeout-minutes: 5
        run: |
          bun packages/opencode/scripts/install-packed-hosts.ts "$RUNNER_TEMP/packed-opencode-hosts"
          echo "ANTHROPIC_AUTH_PACKED_HOSTS=$RUNNER_TEMP/packed-opencode-hosts" >> "$GITHUB_ENV"
      # Save before tests so a test failure cannot leave the download cache cold.
      - name: Save packed OpenCode host npm downloads
        if: steps.packed-host-install.outcome == 'success' && steps.packed-host-cache.outputs.cache-hit != 'true'
        uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: node_modules/.cache/opencode-host-npm
          key: ${{ steps.packed-host-cache.outputs.cache-primary-key }}
      # A full rebuild takes 4-8s and avoids another job plus artifact transfer on every test's path.
      - run: bun run build
      - run: bun scripts/ci-unit-tests.ts --suite '${{ matrix.suite }}' --shard '${{ matrix.shard }}' --output-dir unit-counts
      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
        with:
          name: unit-count-${{ matrix.suite }}-${{ strategy.job-index }}
          path: unit-counts/*.json
          if-no-files-found: error

  e2e:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v6
      - uses: jdx/mise-action@82a612c5ab8bcda7cc5db6b7e81a8e7584c3dc6e # v5
        with:
          minimum_release_age: 0s
      - run: bun install --frozen-lockfile
      - name: Install the locked OC1 config dependency fixture
        run: npm ci --prefix packages/e2e-tests/fixtures/opencode1-config-deps --ignore-scripts --no-audit --no-fund
      - run: bun run build
      - run: bun run test:e2e
        env:
          ANTHROPIC_AUTH_E2E_OPENCODE_CONFIG_DEPS: ${{ github.workspace }}/packages/e2e-tests/fixtures/opencode1-config-deps

  check:
    if: always()
    needs: [fast-checks, unit, e2e]
    runs-on: ubuntu-latest
    steps:
      - name: Require every CI job to pass
        env:
          NEEDS: ${{ toJSON(needs) }}
        run: |
          echo "$NEEDS" | jq -e 'all(.[]; .result == "success")'
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v6
        with:
          fetch-depth: 0
      - uses: jdx/mise-action@82a612c5ab8bcda7cc5db6b7e81a8e7584c3dc6e # v5
        with:
          minimum_release_age: 0s
      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8
        with:
          pattern: unit-count-*
          path: unit-counts
          merge-multiple: true
      # UNCHECKED exits nonzero too: a missing merge target must not look green.
      - name: Verify unit-count floors
        env:
          FLOOR_BASE_SHA: ${{ github.event.pull_request.base.sha || github.event.before }}
        run: |
          if [[ ! "$FLOOR_BASE_SHA" =~ ^[0-9a-f]{40}$ || "$FLOOR_BASE_SHA" == 0000000000000000000000000000000000000000 ]]; then
            echo "::error::Unit-count floor verification requires a nonzero event base SHA."
            exit 1
          fi
          bun scripts/check-test-count-floors.ts --base-ref "$FLOOR_BASE_SHA" --counts-dir unit-counts