ci.yml

# Continuous integration for patchlab.
#
# Public-repo GitHub Actions usage is unmetered, so this workflow is sized
# for breadth (multi-OS, sharded integration) rather than minute-frugality.
#
# Jobs:
#   build-and-typecheck — `npm ci`, dependency audits (`audit:prod`, `audit`),
#       `tsc` over `src/` (the shipped package) and over
#       `src/` + `test/` (the test-only type-check gate added in
#       `tsconfig.tests.json`). Fast, OS-independent, no podman needed.
#   test-unit — vitest `unit` + `windows` + `macos` projects, on Ubuntu AND Windows.
#       The `windows` project self-gates with `process.platform !== 'win32'`
#       so it is inert on Ubuntu; running it on `windows-latest` is the
#       only place its assertions actually fire. The `macos` project self-
#       gates on non-darwin hosts and is inert on Ubuntu/Windows runners.
#   test-macos-platform — vitest `unit` + `macos` on macos-latest (real APFS,
#       no Lima required). Nerdctl integration (`integration-nerdctl`) is
#       local-macOS only: GHA arm64 runners cannot start Lima VMs.
#   test-posix — vitest `posix` project on Ubuntu. The local
#       `npm run test:posix` script wraps this in a Linux container on
#       Windows and macOS hosts; on a Linux runner the indirection is
#       unnecessary — execute the project natively.
#   test-integration — vitest `integration` project, sharded across four
#       runners. See the comment on that job for why CI can parallelize
#       what a single developer machine cannot.
#   verify-npm-pack — `npm pack` from a tree with no dist/ (prepack builds),
#       install the tarball in a temp prefix, and run `patchlab --version`
#       from a foreign cwd.
#   verify:integration-cleanup — after integration jobs, fail when patchlab
#       containers or archives remain under PATCHLAB_HOME.
#
# Jobs intentionally do not declare `needs:` dependencies on each other.
# On a public repo the minute cost is zero, and surfacing every failure
# in a single run is more useful than failing fast.

name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

# Cancel superseded PR builds; main-branch builds run to completion so the
# branch protection signal is stable.
concurrency:
  group: ci-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

jobs:
  build-and-typecheck:
    strategy:
      fail-fast: false
      matrix:
        node-version: [20, 24]
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: ${{ matrix.node-version }}
          cache: npm
      - run: npm ci
      - run: npm run audit:prod
      - run: npm run audit
      - run: npm run build
      - run: npm run typecheck:tests

  verify-npm-pack:
    strategy:
      fail-fast: false
      matrix:
        node-version: [20, 24]
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: ${{ matrix.node-version }}
          cache: npm
      - run: npm ci
      - run: npm run verify:pack

  test-unit:
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: ubuntu-latest
            node-version: 20
          - os: ubuntu-latest
            node-version: 24
          - os: windows-latest
            node-version: 24
    runs-on: ${{ matrix.os }}
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: ${{ matrix.node-version }}
          cache: npm
      - run: npm ci
      - run: npm run build
      # Run all three platform-gated projects on both OSes. The `windows`
      # and `macos` projects self-gate on the wrong platform, so on Ubuntu
      # this is effectively just the `unit` project.
      - run: npx vitest run --project unit --project windows --project macos
        env:
          PATCHLAB_CONTAINER_RUNTIME: podman

  test-posix:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: 24
          cache: npm
      - run: npm ci
      - run: npm run build
      # Run the posix project directly — `npm run test:posix`'s podman
      # wrapper is for Windows hosts that need Linux FS semantics. We are
      # already on Linux.
      - run: npx vitest run --project posix
        env:
          PATCHLAB_CONTAINER_RUNTIME: podman

  test-integration:
    # Four-way shard. Local developer machines must run integration files
    # serially (`fileParallelism: false` in vitest.config.ts) because all
    # files share one podman daemon and would collide on container names,
    # image cache writes, and port allocations. GitHub Actions assigns each
    # matrix job a fresh runner VM with its own podman daemon, so the
    # shared-state hazard does not cross shard boundaries — within a shard
    # files still run sequentially, but across shards they run in parallel.
    #
    # `vitest --shard=N/4` hashes the test-file paths and selects shard N.
    # Increasing the shard count past 4 has diminishing returns: per-shard
    # fixed overhead (runner start, `npm ci`, first-image build) starts to
    # dominate once each shard holds ~3 files.
    strategy:
      fail-fast: false
      matrix:
        shard: [1, 2, 3, 4]
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: 24
          cache: npm
      - run: npm ci
      - run: npm run build
      # Ubuntu runners ship with podman pre-installed; verify it is callable
      # before launching the integration suite so a missing-runtime failure
      # surfaces here rather than as a cryptic test error.
      - name: Verify podman runtime
        run: podman --version
      - name: Run integration tests
        run: |
          SOCKET_PATH="$(podman info --format '{{.Host.RemoteSocket.Path}}' | sed 's|^unix://||')"
          mkdir -p "$(dirname "$SOCKET_PATH")"
          if [ ! -S "$SOCKET_PATH" ]; then
            podman system service --time=0 "unix://${SOCKET_PATH}" &
            SERVICE_PID=$!
            for _ in $(seq 1 50); do
              if [ -S "$SOCKET_PATH" ]; then
                break
              fi
              sleep 0.2
            done
            if [ ! -S "$SOCKET_PATH" ]; then
              echo "Podman API socket did not become ready at ${SOCKET_PATH}" >&2
              kill "$SERVICE_PID" 2>/dev/null || true
              exit 1
            fi
          fi
          chmod go+rw "$SOCKET_PATH" 2>/dev/null || true
          npx vitest run --project integration --project integration-podman --shard=${{ matrix.shard }}/4
        env:
          PATCHLAB_CONTAINER_RUNTIME: podman
          PATCHLAB_HOME: ${{ runner.temp }}/patchlab-integration-home
      - name: Verify integration cleanup
        if: always()
        run: npm run verify:integration-cleanup
        env:
          PATCHLAB_CONTAINER_RUNTIME: podman
          PATCHLAB_HOME: ${{ runner.temp }}/patchlab-integration-home

  test-macos-platform:
    runs-on: macos-latest
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: 24
          cache: npm
      - run: npm ci
      - run: npm run build
      - run: npx vitest run --project unit --project macos