ci.yml

name: CI

on:
  push:
    branches:
      - main
    paths:
      - 'Sources/**'
      - 'Tests/**'
      - 'UITests/**'
      - 'Apps/VoidDisplay/**'
      - 'VoidDisplay.xcodeproj/**'
      - 'Tools/VoidDisplayRelay/**'
      - 'Package.swift'
      - 'Package.resolved'
      - '**/Package.resolved'
      - 'mise.toml'
      - 'mise.lock'
      - 'Brewfile'
      - '.swiftformat'
      - '.swiftlint.yml'
      - 'scripts/**'
      - '.github/workflows/**'
      - '.github/actions/**'
      - '.github/dependabot.yml'
  pull_request:

permissions:
  contents: read

concurrency:
  group: ci-${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

jobs:
  classify_changes:
    name: classify-changes
    runs-on: macos-26
    timeout-minutes: 5
    permissions:
      contents: read
      pull-requests: read
    outputs:
      code_relevant: ${{ steps.classify.outputs.code_relevant }}
      ui_relevant: ${{ steps.classify.outputs.ui_relevant }}
      script_relevant: ${{ steps.classify.outputs.script_relevant }}
      change_scope: ${{ steps.classify.outputs.change_scope }}
      product_code_relevant: ${{ steps.classify.outputs.product_code_relevant }}
      test_code_relevant: ${{ steps.classify.outputs.test_code_relevant }}
      ci_config_relevant: ${{ steps.classify.outputs.ci_config_relevant }}
      release_relevant: ${{ steps.classify.outputs.release_relevant }}
      dependency_manifest_relevant: ${{ steps.classify.outputs.dependency_manifest_relevant }}
      tooling_config_relevant: ${{ steps.classify.outputs.tooling_config_relevant }}
      docs_only: ${{ steps.classify.outputs.docs_only }}
      unknown_relevant: ${{ steps.classify.outputs.unknown_relevant }}
      requires_static: ${{ steps.classify.outputs.requires_static }}
      requires_dependency_review: ${{ steps.classify.outputs.requires_dependency_review }}
      requires_unit: ${{ steps.classify.outputs.requires_unit }}
      requires_xcode_build: ${{ steps.classify.outputs.requires_xcode_build }}
      requires_ui_smoke: ${{ steps.classify.outputs.requires_ui_smoke }}
      ui_selectors_json: ${{ steps.classify.outputs.ui_selectors_json }}
      requires_release_smoke: ${{ steps.classify.outputs.requires_release_smoke }}
    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          fetch-depth: 0
          persist-credentials: false

      - name: Classify changed files
        id: classify
        shell: bash
        env:
          EVENT_NAME: ${{ github.event_name }}
          BASE_REF: ${{ github.base_ref }}
          BASE_SHA: ${{ github.event_name == 'pull_request' && github.event.pull_request.base.sha || github.event.before }}
          HEAD_SHA: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.sha }}
        run: |
          set -euo pipefail
          tool_root="$GITHUB_WORKSPACE"

          ROOT_DIR="$GITHUB_WORKSPACE" TOOL_ROOT="$tool_root" "$tool_root/scripts/ci/classify.sh" \
            --base "$BASE_SHA" \
            --head "$HEAD_SHA" \
            --github-output "$GITHUB_OUTPUT" \
            --summary .ai-tmp/classify/classify-summary.json

      - name: Upload classify artifacts
        if: always()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: classify
          path: .ai-tmp/classify
          if-no-files-found: warn
          retention-days: 7

  dependency_review:
    name: dependency-review
    needs:
      - classify_changes
    if: ${{ github.event_name == 'pull_request' && needs.classify_changes.outputs.requires_dependency_review == 'true' }}
    runs-on: macos-26
    timeout-minutes: 10
    permissions:
      contents: read
      pull-requests: read
    steps:
      - name: Dependency review
        uses: actions/dependency-review-action@2031cfc080254a8a887f58cffee85186f0e49e48 # v4.9.0
        with:
          fail-on-severity: high
          comment-summary-in-pr: never

  script_static_checks:
    name: script-static-checks
    needs:
      - classify_changes
    if: ${{ needs.classify_changes.outputs.requires_static == 'true' }}
    runs-on: macos-26
    timeout-minutes: 15
    permissions:
      contents: read
    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          persist-credentials: false

      - name: Bootstrap static tools
        shell: bash
        run: |
          set -euo pipefail
          tool_root="$GITHUB_WORKSPACE"

          ROOT_DIR="$GITHUB_WORKSPACE" TOOL_ROOT="$tool_root" "$tool_root/scripts/dev/bootstrap.sh" --profile static

      - name: Validate static gates
        shell: bash
        run: |
          set -euo pipefail
          tool_root="$GITHUB_WORKSPACE"

          ROOT_DIR="$GITHUB_WORKSPACE" TOOL_ROOT="$tool_root" "$tool_root/scripts/ci/static.sh"

  unit_tests:
    name: unit-tests
    needs:
      - classify_changes
      - script_static_checks
    if: ${{ needs.classify_changes.outputs.requires_unit == 'true' }}
    uses: ./.github/workflows/_reusable-unit-tests.yml
    with:
      artifact_retention_days: 7

  xcode_build:
    name: xcode-build
    needs:
      - classify_changes
      - script_static_checks
    if: ${{ needs.classify_changes.outputs.requires_xcode_build == 'true' }}
    runs-on: macos-26
    timeout-minutes: 25
    permissions:
      contents: read
    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          persist-credentials: false

      - name: Select Xcode
        uses: ./.github/actions/xcode-select

      - name: Bootstrap tools
        shell: bash
        run: |
          set -euo pipefail
          tool_root="$GITHUB_WORKSPACE"

          ROOT_DIR="$GITHUB_WORKSPACE" TOOL_ROOT="$tool_root" "$tool_root/scripts/dev/bootstrap.sh" --profile xcode

      - name: Run doctor checks
        shell: bash
        run: |
          set -euo pipefail
          tool_root="$GITHUB_WORKSPACE"

          ROOT_DIR="$GITHUB_WORKSPACE" TOOL_ROOT="$tool_root" "$tool_root/scripts/dev/doctor.sh" \
            --out-dir .ai-tmp/xcode-build/doctor

      - name: Xcode Debug build
        shell: bash
        run: |
          set -euo pipefail
          tool_root="$GITHUB_WORKSPACE"

          ROOT_DIR="$GITHUB_WORKSPACE" TOOL_ROOT="$tool_root" "$tool_root/scripts/ci/xcode.sh" \
            --action build \
            --configuration Debug \
            --out-dir .ai-tmp/xcode-build

      - name: Upload Xcode build artifacts
        if: always()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: xcode-build
          path: |
            .ai-tmp/xcode-build
            !.ai-tmp/xcode-build/DerivedData
          if-no-files-found: warn
          retention-days: 7

  ui_smoke_tests:
    name: ui-smoke-tests
    needs:
      - classify_changes
      - script_static_checks
    if: ${{ needs.classify_changes.outputs.requires_ui_smoke == 'true' }}
    uses: ./.github/workflows/_reusable-ui-smoke-tests.yml
    with:
      only_testing_json: ${{ needs.classify_changes.outputs.ui_selectors_json }}
      artifact_retention_days: 7
      artifact_name_suffix: pr
      enforce_failure: true

  release_build_check_arm64:
    name: release-build-check (arm64)
    needs:
      - classify_changes
      - script_static_checks
    if: ${{ needs.classify_changes.outputs.requires_release_smoke == 'true' }}
    runs-on: macos-26
    timeout-minutes: 30
    permissions:
      contents: read
    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          persist-credentials: false

      - name: Bootstrap tools
        shell: bash
        run: |
          set -euo pipefail
          tool_root="$GITHUB_WORKSPACE"

          ROOT_DIR="$GITHUB_WORKSPACE" TOOL_ROOT="$tool_root" "$tool_root/scripts/dev/bootstrap.sh" --profile release-smoke

      - name: Release smoke
        shell: bash
        run: |
          set -euo pipefail
          tool_root="$GITHUB_WORKSPACE"

          ROOT_DIR="$GITHUB_WORKSPACE" TOOL_ROOT="$tool_root" "$tool_root/scripts/ci/release_smoke.sh" \
            --arch arm64 \
            --label arm64 \
            --out-dir .ai-tmp/release-check-arm64

      - name: Upload release smoke artifacts
        if: always()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: release-smoke-arm64
          path: |
            .ai-tmp/release-check-arm64
            !.ai-tmp/release-check-arm64/DerivedData
          if-no-files-found: warn
          retention-days: 7

  release_build_check_intel64:
    name: release-build-check (intel64)
    needs:
      - classify_changes
      - script_static_checks
    if: ${{ github.event_name == 'push' && needs.classify_changes.outputs.requires_release_smoke == 'true' }}
    runs-on: macos-26-intel
    timeout-minutes: 30
    permissions:
      contents: read
    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          persist-credentials: false

      - name: Bootstrap tools
        shell: bash
        run: |
          set -euo pipefail
          tool_root="$GITHUB_WORKSPACE"

          ROOT_DIR="$GITHUB_WORKSPACE" TOOL_ROOT="$tool_root" "$tool_root/scripts/dev/bootstrap.sh" --profile release-smoke

      - name: Release smoke
        shell: bash
        run: |
          set -euo pipefail
          tool_root="$GITHUB_WORKSPACE"

          ROOT_DIR="$GITHUB_WORKSPACE" TOOL_ROOT="$tool_root" "$tool_root/scripts/ci/release_smoke.sh" \
            --arch x86_64 \
            --label intel64 \
            --out-dir .ai-tmp/release-check-intel64

      - name: Upload release smoke artifacts
        if: always()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: release-smoke-intel64
          path: |
            .ai-tmp/release-check-intel64
            !.ai-tmp/release-check-intel64/DerivedData
          if-no-files-found: warn
          retention-days: 7

  ci_gate:
    name: ci-gate
    if: always()
    needs:
      - classify_changes
      - dependency_review
      - script_static_checks
      - unit_tests
      - xcode_build
      - ui_smoke_tests
      - release_build_check_arm64
      - release_build_check_intel64
    runs-on: macos-26
    timeout-minutes: 5
    permissions:
      contents: read
    steps:
      - name: Enforce CI gate
        env:
          CLASSIFY_RESULT: ${{ needs.classify_changes.result }}
          EVENT_NAME: ${{ github.event_name }}
          BASE_REF: ${{ github.base_ref }}
          CHANGE_SCOPE: ${{ needs.classify_changes.outputs.change_scope }}
          CODE_RELEVANT: ${{ needs.classify_changes.outputs.code_relevant }}
          UI_RELEVANT: ${{ needs.classify_changes.outputs.ui_relevant }}
          SCRIPT_RELEVANT: ${{ needs.classify_changes.outputs.script_relevant }}
          PRODUCT_CODE_RELEVANT: ${{ needs.classify_changes.outputs.product_code_relevant }}
          TEST_CODE_RELEVANT: ${{ needs.classify_changes.outputs.test_code_relevant }}
          CI_CONFIG_RELEVANT: ${{ needs.classify_changes.outputs.ci_config_relevant }}
          RELEASE_RELEVANT: ${{ needs.classify_changes.outputs.release_relevant }}
          DEPENDENCY_MANIFEST_RELEVANT: ${{ needs.classify_changes.outputs.dependency_manifest_relevant }}
          TOOLING_CONFIG_RELEVANT: ${{ needs.classify_changes.outputs.tooling_config_relevant }}
          DOCS_ONLY: ${{ needs.classify_changes.outputs.docs_only }}
          UNKNOWN_RELEVANT: ${{ needs.classify_changes.outputs.unknown_relevant }}
          REQUIRES_STATIC: ${{ needs.classify_changes.outputs.requires_static }}
          REQUIRES_DEPENDENCY_REVIEW: ${{ needs.classify_changes.outputs.requires_dependency_review }}
          REQUIRES_UNIT: ${{ needs.classify_changes.outputs.requires_unit }}
          REQUIRES_XCODE_BUILD: ${{ needs.classify_changes.outputs.requires_xcode_build }}
          REQUIRES_UI_SMOKE: ${{ needs.classify_changes.outputs.requires_ui_smoke }}
          REQUIRES_RELEASE_SMOKE: ${{ needs.classify_changes.outputs.requires_release_smoke }}
          DEPENDENCY_RESULT: ${{ needs.dependency_review.result }}
          SCRIPT_RESULT: ${{ needs.script_static_checks.result }}
          UNIT_RESULT: ${{ needs.unit_tests.result }}
          XCODE_RESULT: ${{ needs.xcode_build.result }}
          UI_RESULT: ${{ needs.ui_smoke_tests.result }}
          RELEASE_ARM64_RESULT: ${{ needs.release_build_check_arm64.result }}
          RELEASE_INTEL64_RESULT: ${{ needs.release_build_check_intel64.result }}
        run: |
          set -euo pipefail

          echo "Classify result: ${CLASSIFY_RESULT}"
          echo "Event: ${EVENT_NAME}"
          echo "Base ref: ${BASE_REF:-n/a}"
          echo "Change scope: ${CHANGE_SCOPE}"
          echo "Relevant: code=${CODE_RELEVANT} ui=${UI_RELEVANT} script=${SCRIPT_RELEVANT} product=${PRODUCT_CODE_RELEVANT} test=${TEST_CODE_RELEVANT} ci=${CI_CONFIG_RELEVANT} release=${RELEASE_RELEVANT} dependency=${DEPENDENCY_MANIFEST_RELEVANT} tooling=${TOOLING_CONFIG_RELEVANT} docs_only=${DOCS_ONLY} unknown=${UNKNOWN_RELEVANT}"
          echo "Required: static=${REQUIRES_STATIC} dependency=${REQUIRES_DEPENDENCY_REVIEW} unit=${REQUIRES_UNIT} xcode=${REQUIRES_XCODE_BUILD} ui=${REQUIRES_UI_SMOKE} release=${REQUIRES_RELEASE_SMOKE}"
          echo "Dependency review: ${DEPENDENCY_RESULT}"
          echo "Static: ${SCRIPT_RESULT}"
          echo "Unit: ${UNIT_RESULT}"
          echo "Xcode build: ${XCODE_RESULT}"
          echo "UI smoke: ${UI_RESULT}"
          echo "Release smoke arm64: ${RELEASE_ARM64_RESULT}"
          echo "Release smoke intel64: ${RELEASE_INTEL64_RESULT}"

          if [ "$CLASSIFY_RESULT" != "success" ]; then
            echo "Gate failed because classify-changes result is ${CLASSIFY_RESULT}."
            exit 1
          fi

          check_required() {
            local requirement="$1"
            local result="$2"
            local label="$3"

            if [ "$requirement" = "true" ] && [ "$result" != "success" ]; then
              echo "Gate failed because ${label} is required but result is ${result}."
              exit 1
            fi
            if [ "$requirement" = "true" ]; then
              echo "Gate accepted ${label}: required and passed."
            else
              echo "Gate accepted ${label}: not required, result is ${result}."
            fi
          }

          check_required "$REQUIRES_DEPENDENCY_REVIEW" "$DEPENDENCY_RESULT" "dependency-review"
          check_required "$REQUIRES_STATIC" "$SCRIPT_RESULT" "script-static-checks"
          check_required "$REQUIRES_UNIT" "$UNIT_RESULT" "unit-tests"
          check_required "$REQUIRES_XCODE_BUILD" "$XCODE_RESULT" "xcode-build"
          check_required "$REQUIRES_UI_SMOKE" "$UI_RESULT" "ui-smoke-tests"
          check_required "$REQUIRES_RELEASE_SMOKE" "$RELEASE_ARM64_RESULT" "release-build-check-arm64"
          if [ "$EVENT_NAME" = "push" ]; then
            check_required "$REQUIRES_RELEASE_SMOKE" "$RELEASE_INTEL64_RESULT" "release-build-check-intel64"
          else
            check_required "false" "$RELEASE_INTEL64_RESULT" "release-build-check-intel64"
          fi

          exit 0

  ci_summary:
    name: ci-summary
    if: always()
    needs:
      - classify_changes
      - dependency_review
      - script_static_checks
      - unit_tests
      - xcode_build
      - ui_smoke_tests
      - release_build_check_arm64
      - release_build_check_intel64
      - ci_gate
    runs-on: macos-26
    timeout-minutes: 5
    permissions:
      contents: read
      issues: write
      pull-requests: write
    steps:
      - name: Render summary and update PR sticky comment
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        env:
          EVENT_NAME: ${{ github.event_name }}
          BASE_REF: ${{ github.base_ref }}
          CHANGE_SCOPE: ${{ needs.classify_changes.outputs.change_scope }}
          CODE_RELEVANT: ${{ needs.classify_changes.outputs.code_relevant }}
          UI_RELEVANT: ${{ needs.classify_changes.outputs.ui_relevant }}
          SCRIPT_RELEVANT: ${{ needs.classify_changes.outputs.script_relevant }}
          PRODUCT_CODE_RELEVANT: ${{ needs.classify_changes.outputs.product_code_relevant }}
          TEST_CODE_RELEVANT: ${{ needs.classify_changes.outputs.test_code_relevant }}
          CI_CONFIG_RELEVANT: ${{ needs.classify_changes.outputs.ci_config_relevant }}
          RELEASE_RELEVANT: ${{ needs.classify_changes.outputs.release_relevant }}
          DEPENDENCY_MANIFEST_RELEVANT: ${{ needs.classify_changes.outputs.dependency_manifest_relevant }}
          TOOLING_CONFIG_RELEVANT: ${{ needs.classify_changes.outputs.tooling_config_relevant }}
          DOCS_ONLY: ${{ needs.classify_changes.outputs.docs_only }}
          UNKNOWN_RELEVANT: ${{ needs.classify_changes.outputs.unknown_relevant }}
          REQUIRES_STATIC: ${{ needs.classify_changes.outputs.requires_static }}
          REQUIRES_DEPENDENCY_REVIEW: ${{ needs.classify_changes.outputs.requires_dependency_review }}
          REQUIRES_UNIT: ${{ needs.classify_changes.outputs.requires_unit }}
          REQUIRES_XCODE_BUILD: ${{ needs.classify_changes.outputs.requires_xcode_build }}
          REQUIRES_UI_SMOKE: ${{ needs.classify_changes.outputs.requires_ui_smoke }}
          REQUIRES_RELEASE_SMOKE: ${{ needs.classify_changes.outputs.requires_release_smoke }}
          DEPENDENCY_RESULT: ${{ needs.dependency_review.result }}
          SCRIPT_RESULT: ${{ needs.script_static_checks.result }}
          UNIT_RESULT: ${{ needs.unit_tests.result }}
          UNIT_ARTIFACT: ${{ needs.unit_tests.outputs.artifact_name }}
          UNIT_SWIFT_TEST_COUNT: ${{ needs.unit_tests.outputs.swift_test_count }}
          UNIT_GO_PACKAGE_COUNT: ${{ needs.unit_tests.outputs.go_package_count }}
          UNIT_REASON: ${{ needs.unit_tests.outputs.unit_reason }}
          XCODE_RESULT: ${{ needs.xcode_build.result }}
          UI_RESULT: ${{ needs.ui_smoke_tests.result }}
          RELEASE_ARM64_RESULT: ${{ needs.release_build_check_arm64.result }}
          RELEASE_INTEL64_RESULT: ${{ needs.release_build_check_intel64.result }}
          GATE_RESULT: ${{ needs.ci_gate.result }}
          RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
        with:
          script: |
            const marker = '<!-- ci-summary-marker -->';
            const runUrl = process.env.RUN_URL;
            const artifactsUrl = `${runUrl}#artifacts`;
            const value = (name, fallback = 'n/a') => {
              const raw = process.env[name];
              return raw && raw.trim().length > 0 ? raw : fallback;
            };
            const unitDetails = [
              `Swift tests: ${value('UNIT_SWIFT_TEST_COUNT')}`,
              `Go packages: ${value('UNIT_GO_PACKAGE_COUNT')}`,
              `Reason: ${value('UNIT_REASON')}`,
              `Artifact: ${value('UNIT_ARTIFACT')}`,
            ].join('<br>');
            const uiDetails = [
              'The PR UI job builds once, runs its selectors serially, and writes aggregate failure classification to ui-smoke-summary.json.',
              'Artifact: ui-smoke-pr',
            ].join('<br>');
            const releaseStatus = context.eventName === 'pull_request'
              ? value('RELEASE_ARM64_RESULT', 'unknown')
              : `arm64=${value('RELEASE_ARM64_RESULT', 'unknown')}<br>intel64=${value('RELEASE_INTEL64_RESULT', 'unknown')}`;
            const releaseDetails = [
              `arm64=${value('RELEASE_ARM64_RESULT', 'unknown')}`,
              `intel64=${value('RELEASE_INTEL64_RESULT', 'unknown')}`,
              context.eventName === 'pull_request'
                ? 'PR release smoke requires arm64 only.'
                : 'Push release smoke requires arm64 and intel64.',
              context.eventName === 'pull_request'
                ? 'Artifacts: release-smoke-arm64'
                : 'Artifacts: release-smoke-arm64, release-smoke-intel64',
              'Release verify summaries are produced by release.yml before publishing.',
            ].join('<br>');
            const classificationDetails = [
              `code=${value('CODE_RELEVANT')}`,
              `ui=${value('UI_RELEVANT')}`,
              `script=${value('SCRIPT_RELEVANT')}`,
              `product=${value('PRODUCT_CODE_RELEVANT')}`,
              `test=${value('TEST_CODE_RELEVANT')}`,
              `ci=${value('CI_CONFIG_RELEVANT')}`,
              `release=${value('RELEASE_RELEVANT')}`,
              `dependency=${value('DEPENDENCY_MANIFEST_RELEVANT')}`,
              `tooling=${value('TOOLING_CONFIG_RELEVANT')}`,
              `docs_only=${value('DOCS_ONLY')}`,
              `unknown=${value('UNKNOWN_RELEVANT')}`,
            ].join('<br>');
            const requirementDetails = [
              `static=${value('REQUIRES_STATIC')}`,
              `dependency=${value('REQUIRES_DEPENDENCY_REVIEW')}`,
              `unit=${value('REQUIRES_UNIT')}`,
              `xcode=${value('REQUIRES_XCODE_BUILD')}`,
              `ui=${value('REQUIRES_UI_SMOKE')}`,
              `release=${value('REQUIRES_RELEASE_SMOKE')}`,
              'Static runs for every PR. Unit, Xcode, UI, and release gates follow the changed paths.',
            ].join('<br>');
            const rows = [
              ['Change Scope', value('CHANGE_SCOPE', 'unknown'), classificationDetails],
              ['Required Gates', 'derived', requirementDetails],
              ['Dependency Review', value('DEPENDENCY_RESULT', 'unknown'), `required=${value('REQUIRES_DEPENDENCY_REVIEW')}<br>high and critical vulnerabilities block`],
              ['Static Checks', value('SCRIPT_RESULT', 'unknown'), `required=${value('REQUIRES_STATIC')}<br>actionlint, shellcheck, shfmt, SwiftFormat, SwiftLint, action pinning`],
              ['Unit Tests', value('UNIT_RESULT', 'unknown'), `required=${value('REQUIRES_UNIT')}<br>${unitDetails}`],
              ['Xcode Build', value('XCODE_RESULT', 'unknown'), `required=${value('REQUIRES_XCODE_BUILD')}<br>Debug build with zero warning scan<br>Artifact: xcode-build`],
              ['UI Smoke', value('UI_RESULT', 'unknown'), `required=${value('REQUIRES_UI_SMOKE')}<br>${uiDetails}`],
              ['Release Smoke', releaseStatus, `required=${value('REQUIRES_RELEASE_SMOKE')}<br>${releaseDetails}`],
              ['Artifacts', 'link', `[Open artifacts](${artifactsUrl})`],
              ['CI Gate', value('GATE_RESULT', 'unknown'), 'single branch protection check'],
            ];
            const summaryLines = [
              '## CI Summary',
              '',
              `Run: [Open](${process.env.RUN_URL})`,
              '',
              '| Check | Status | Details |',
              '| --- | --- | --- |',
              ...rows.map(([check, status, details]) => `| ${check} | ${status} | ${details} |`),
            ];
            const summaryBody = summaryLines.join('\n');
            const commentBody = [marker, ...summaryLines].join('\n');
            const shouldCreateComment = value('GATE_RESULT', 'unknown') !== 'success';
            await core.summary.addRaw(summaryBody + '\n').write();

            if (context.eventName !== 'pull_request') {
              return;
            }

            const prNumber = context.payload.pull_request?.number;
            if (!prNumber) {
              return;
            }

            try {
              const comments = await github.paginate(github.rest.issues.listComments, {
                owner: context.repo.owner,
                repo: context.repo.repo,
                issue_number: prNumber,
                per_page: 100,
              });
              const existing = [...comments].reverse().find((comment) =>
                comment.user?.type === 'Bot' && typeof comment.body === 'string' && comment.body.includes(marker)
              );
              if (existing) {
                await github.rest.issues.updateComment({
                  owner: context.repo.owner,
                  repo: context.repo.repo,
                  comment_id: existing.id,
                  body: commentBody,
                });
              } else if (shouldCreateComment) {
                await github.rest.issues.createComment({
                  owner: context.repo.owner,
                  repo: context.repo.repo,
                  issue_number: prNumber,
                  body: commentBody,
                });
              }
            } catch (error) {
              core.warning(`Failed to update CI summary sticky comment: ${error.message}`);
            }