ci.yml

name: CI

# Gates for every PR targeting main and every merge group; the ruleset requires only "CI passed".
# The @agent specs need a real provider + auth, so they stay out of CI. See .github/SPEC.md → CI.
on:
  pull_request:
    branches: [main]
  merge_group:
    types: [checks_requested]

# Supersede in-flight runs when a PR is updated.
concurrency:
  group: ci-${{ github.ref }}
  cancel-in-progress: true

jobs:
  changes:
    name: Classify changes
    timeout-minutes: 5
    runs-on: ubuntu-latest
    outputs:
      app: ${{ steps.classify.outputs.app }}
      artifacts: ${{ steps.classify.outputs.artifacts }}
    steps:
      - uses: actions/checkout@v5
      - id: classify
        env:
          BASE: ${{ github.event.pull_request.base.sha || github.event.merge_group.base_ref }}
          OUTSIDE_APP: ^(apps/website/|packages/website-analytics/|\.github/workflows/site(-preview|-preview-cleanup)?\.yml$|\.github/(readme-assets/|pr-assets/|ISSUE_TEMPLATE/|PULL_REQUEST_TEMPLATE\.md$|CODEOWNERS$|SPEC\.md$)|(README|CONTRIBUTING|CODE_OF_CONDUCT)\.md$|LICENSE$)
          ARTIFACT_PATHS: ^(apps/cli/|apps/desktop/|packages/artifact-tests/|packages/shared/(assets/|scripts/generate-icons\.ts$|src/(version|windowsIdentity)\.ts$)|packages/server/src/(buildSupport|agent/extensions)\.ts$|e2e/(run-binary|run-desktop|artifactPlaywright)\.ts$|playwright\.(binary|desktop)\.config\.ts$|\.github/(workflows|actions|scripts)/|patches/|(package\.json|bun\.lock|turbo\.json)$)
        run: |
          if git fetch --no-tags --depth=1 origin "$BASE" && files=$(git diff --name-only --no-renames FETCH_HEAD HEAD); then
            if grep -qvE "$OUTSIDE_APP" <<< "$files"; then app=true; else app=false; fi
            if [ "$app" = true ] && { [ "$GITHUB_EVENT_NAME" = merge_group ] || grep -qE "$ARTIFACT_PATHS" <<< "$files"; }; then
              artifacts=true
            else
              artifacts=false
            fi
          else
            echo "::warning::Could not diff against $BASE; running every job"
            app=true
            artifacts=true
          fi
          { echo "app=$app"; echo "artifacts=$artifacts"; } | tee -a "$GITHUB_OUTPUT"

  lint:
    name: Lint & Typecheck
    timeout-minutes: 15
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5
      - uses: oven-sh/setup-bun@v2
        with:
          bun-version-file: package.json
      - name: Cache bun install
        uses: actions/cache@v5
        with:
          path: ~/.bun/install/cache
          key: ${{ runner.os }}-bun-${{ hashFiles('bun.lock') }}
          restore-keys: ${{ runner.os }}-bun-
      - run: bun install --frozen-lockfile
      - run: bun run check:deps
      - run: bun run check:boundaries
      # Canary for the compiled-binary seam: fails when a pi bump introduces a new bundler-opaque
      # dynamic import that registerBundledRuntime doesn't statically register (see the script header).
      - run: bun run check:seams
      - run: bun run check:spec-surface
      - run: bun run check:i18n
      - run: bun run check:compiler
      - run: bun run lint
      - run: bun run typecheck

  test:
    name: Unit Tests
    timeout-minutes: 15
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5
      - uses: oven-sh/setup-bun@v2
        with:
          bun-version-file: package.json
      - name: Cache bun install
        uses: actions/cache@v5
        with:
          path: ~/.bun/install/cache
          key: ${{ runner.os }}-bun-${{ hashFiles('bun.lock') }}
          restore-keys: ${{ runner.os }}-bun-
      - run: bun install --frozen-lockfile
      - run: bun run test

  pi-packages:
    name: Pi package parity (vanilla pi under Node)
    timeout-minutes: 10
    needs: changes
    if: needs.changes.outputs.app == 'true'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5
      - uses: oven-sh/setup-bun@v2
        with:
          bun-version-file: package.json
      # Vanilla pi is an npm CLI on Node; the gate loads the packed packages under Node on purpose.
      - uses: actions/setup-node@v4
        with:
          node-version: 22
      - name: Cache bun install
        uses: actions/cache@v5
        with:
          path: ~/.bun/install/cache
          key: ${{ runner.os }}-bun-${{ hashFiles('bun.lock') }}
          restore-keys: ${{ runner.os }}-bun-
      - run: bun install --frozen-lockfile
      - run: bun run check:pi-packages

  e2e-shard:
    name: E2E (no-agent) shard ${{ matrix.shard }}/2
    timeout-minutes: 30
    needs: changes
    if: needs.changes.outputs.app == 'true'
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        shard: [1, 2]
    env:
      THINKRAIL_E2E_JOB_SHARD: ${{ matrix.shard }}/2
    steps:
      - uses: actions/checkout@v5
      - uses: oven-sh/setup-bun@v2
        with:
          bun-version-file: package.json
      - name: Cache bun install
        uses: actions/cache@v5
        with:
          path: ~/.bun/install/cache
          key: ${{ runner.os }}-bun-${{ hashFiles('bun.lock') }}
          restore-keys: ${{ runner.os }}-bun-
      - run: bun install --frozen-lockfile
      - name: Start Playwright Chromium download
        run: .github/scripts/install-playwright.sh start
      - run: bun run build:web
      - name: Install Playwright Chromium
        timeout-minutes: 5
        run: .github/scripts/install-playwright.sh wait
      # `bun run e2e` boots the host on an isolated port + state dir, runs this job's slice of the
      # @agent-free suite headless, then tears it all down. It reuses the web build above.
      - run: bun run e2e
        env:
          THINKRAIL_E2E_SKIP_BUILD: "1"
      - name: Upload Playwright report
        if: ${{ failure() }}
        uses: actions/upload-artifact@v5
        with:
          name: playwright-report-${{ matrix.shard }}
          path: playwright-report/
          retention-days: 7

  binary-shard:
    name: Binary smoke & e2e shard ${{ matrix.shard }}/4
    timeout-minutes: 30
    needs: changes
    if: needs.changes.outputs.artifacts == 'true'
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        shard: [1, 2, 3, 4]
    steps:
      - uses: actions/checkout@v5
      - uses: oven-sh/setup-bun@v2
        with:
          bun-version-file: package.json
      - name: Cache bun install
        uses: actions/cache@v5
        with:
          path: ~/.bun/install/cache
          key: ${{ runner.os }}-bun-${{ hashFiles('bun.lock') }}
          restore-keys: ${{ runner.os }}-bun-
      - run: bun install --frozen-lockfile
      - name: Start Playwright Chromium download
        run: .github/scripts/install-playwright.sh start
      # Build the single-file binary for the runner's platform, then boot the artifact and assert it
      # serves the staged UI + skills, completes a real OAuth login up to its auth URL, and shuts down
      # cleanly — regressions in the extension/asset/provider-flow bundling only exist inside the
      # compiled binary, so from-source suites can't catch them.
      - run: bun run build:binary
      - run: bun run smoke:binary
        if: ${{ matrix.shard == 1 }}
      - name: Install Playwright Chromium
        timeout-minutes: 5
        run: .github/scripts/install-playwright.sh wait
      # This shard of the no-agent e2e suite against the artifact (grep-inverts @dev-seam too — the fake
      # login providers only exist in the dev boot): the broad net for works-from-source/broken-in-the-binary.
      - run: bun run e2e:binary --shard=${{ matrix.shard }}/4
      - name: Upload Playwright report
        if: ${{ failure() }}
        uses: actions/upload-artifact@v5
        with:
          name: playwright-report-binary-${{ matrix.shard }}
          path: playwright-report-binary/
          retention-days: 7

  binary-windows:
    name: Binary smoke (windows)
    timeout-minutes: 20
    needs: changes
    if: needs.changes.outputs.app == 'true'
    runs-on: windows-latest
    steps:
      - uses: actions/checkout@v5
      - uses: oven-sh/setup-bun@v2
        with:
          bun-version-file: package.json
          no-cache: true
      - run: bun install --frozen-lockfile
      - run: bun test packages/spec-graph
      - run: bun test packages/pi-background-commands
      - run: bun test packages/server/src/subprocess
      - run: bun run test:windows-paths
      - run: bun test apps/desktop/src/windowsFrame.test.ts apps/desktop/src/windowChrome.test.ts apps/desktop/src/windowsWindowIcon.test.ts apps/desktop/src/windowsTaskbarIdentity.test.ts
      - run: bun run build:binary
      - run: bun run smoke:binary

  desktop-windows:
    name: Desktop smoke (windows)
    timeout-minutes: 30
    needs: changes
    if: needs.changes.outputs.artifacts == 'true'
    runs-on: windows-latest
    steps:
      - uses: actions/checkout@v5
      - uses: oven-sh/setup-bun@v2
        with:
          bun-version-file: package.json
          no-cache: true
      - run: bun install --frozen-lockfile
      - run: bun run desktop:build
      - run: bun run smoke:desktop

  desktop-shard:
    name: Desktop smoke & e2e shard ${{ matrix.shard }}/4
    timeout-minutes: 30
    needs: changes
    if: needs.changes.outputs.artifacts == 'true'
    runs-on: ubuntu-24.04
    strategy:
      fail-fast: false
      matrix:
        shard: [1, 2, 3, 4]
    steps:
      - uses: actions/checkout@v5
      - uses: oven-sh/setup-bun@v2
        with:
          bun-version-file: package.json
      - name: Cache bun install
        uses: actions/cache@v5
        with:
          path: ~/.bun/install/cache
          key: ${{ runner.os }}-bun-${{ hashFiles('bun.lock') }}
          restore-keys: ${{ runner.os }}-bun-
      - run: bun install --frozen-lockfile
      - name: Start Playwright Chromium download
        run: .github/scripts/install-playwright.sh start
      - name: Install desktop runtime packages
        uses: ./.github/actions/desktop-apt
        timeout-minutes: 10
      - name: Start virtual display
        run: |
          for attempt in 1 2 3; do
            Xvfb :99 -screen 0 1280x1024x24 -nolisten tcp > "$RUNNER_TEMP/xvfb.log" 2>&1 &
            xvfb_pid=$!
            for _ in $(seq 100); do
              if xdpyinfo -display :99 > /dev/null 2>&1; then
                echo "DISPLAY=:99" >> "$GITHUB_ENV"
                exit 0
              fi
              sleep 0.1
            done
            kill -9 "$xvfb_pid" 2> /dev/null || true
            wait "$xvfb_pid" 2> /dev/null || true
            rm -f /tmp/.X99-lock /tmp/.X11-unix/X99
            echo "::warning::Xvfb did not accept a client on attempt $attempt; restarting"
          done
          cat "$RUNNER_TEMP/xvfb.log"
          exit 1
      - run: bun run desktop:build
      - name: Smoke native desktop window and packaged runtime
        if: ${{ matrix.shard == 1 }}
        run: env LIBGL_ALWAYS_SOFTWARE=1 WEBKIT_DISABLE_COMPOSITING_MODE=1 bun run smoke:desktop
      - name: Install Playwright Chromium
        timeout-minutes: 5
        run: .github/scripts/install-playwright.sh wait
      - name: Run no-agent e2e against the embedded desktop host
        run: env LIBGL_ALWAYS_SOFTWARE=1 WEBKIT_DISABLE_COMPOSITING_MODE=1 bun run e2e:desktop --shard=${{ matrix.shard }}/4
      - name: Upload Playwright report
        if: ${{ failure() }}
        uses: actions/upload-artifact@v5
        with:
          name: playwright-report-desktop-${{ matrix.shard }}
          path: playwright-report-desktop/
          retention-days: 7

  # The one required check in the main ruleset.
  ci-passed:
    name: CI passed
    timeout-minutes: 5
    needs: [changes, lint, test, pi-packages, e2e-shard, binary-shard, binary-windows, desktop-shard, desktop-windows]
    if: ${{ !cancelled() }}
    runs-on: ubuntu-latest
    steps:
      - env:
          NEEDS: ${{ toJSON(needs) }}
          APP: ${{ needs.changes.outputs.app }}
          ARTIFACTS: ${{ needs.changes.outputs.artifacts }}
        run: |
          jq -r 'to_entries[] | "\(.key): \(.value.result)"' <<< "$NEEDS"
          jq -e --arg app "$APP" --arg artifacts "$ARTIFACTS" '
            {"pi-packages": $app, "e2e-shard": $app, "binary-windows": $app,
             "binary-shard": $artifacts, "desktop-shard": $artifacts, "desktop-windows": $artifacts} as $runs
            | to_entries | all(
                .value.result == "success"
                or (.value.result == "skipped" and ($runs[.key] // "true") == "false"))' <<< "$NEEDS"