ci.yml

name: CI

on:
  push:
    branches: [main, master]
  pull_request:

permissions:
  contents: read

concurrency:
  group: ci-${{ github.workflow }}-${{ github.event_name }}-${{ github.event_name == 'pull_request' && github.ref || github.sha }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

jobs:
  changes:
    name: changes
    runs-on: ubuntu-24.04
    timeout-minutes: 5
    outputs:
      continuity: ${{ steps.classify.outputs.continuity }}
      cluster: ${{ steps.classify.outputs.cluster }}
      official_omp_gate0: ${{ steps.classify.outputs.official_omp_gate0 }}
      tooling: ${{ steps.classify.outputs.tooling }}
      android_debug: ${{ steps.classify.outputs.android_debug }}
    steps:
      - name: Check out source and base history
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
        with:
          fetch-depth: 0

      - name: Install Node.js
        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
        with:
          node-version: 24.13.1

      - name: Test path classification
        run: node --test scripts/ci-paths.test.mjs

      - name: Classify affected CI legs
        id: classify
        shell: bash
        env:
          EVENT_NAME: ${{ github.event_name }}
          BASE_SHA: ${{ github.event.pull_request.base.sha }}
          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
        run: |
          set -euo pipefail
          if [[ "$EVENT_NAME" != pull_request ]]; then
            node scripts/ci-paths.mjs --all >> "$GITHUB_OUTPUT"
            exit 0
          fi
          [[ "$BASE_SHA" =~ ^[0-9a-f]{40}$ ]]
          [[ "$HEAD_SHA" =~ ^[0-9a-f]{40}$ ]]
          git diff --name-only -z "$BASE_SHA...$HEAD_SHA" | node scripts/ci-paths.mjs >> "$GITHUB_OUTPUT"

  t4-api-generation:
    runs-on: ubuntu-24.04
    timeout-minutes: 10
    steps:
      - name: Check out exact source
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
        with:
          ref: ${{ github.event.pull_request.head.sha || github.sha }}

      - name: Install pinned pnpm
        uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4
        with:
          version: 11.10.0

      - name: Install pinned Node.js
        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
        with:
          node-version: 24.13.1

      - name: Install dependencies from the committed lockfile
        run: pnpm install --frozen-lockfile

      - name: Validate OpenAPI and deterministic generation
        run: |
          pnpm --filter @t4-code/t4-api-contract validate
          pnpm --filter @t4-code/t4-api-contract generate:ci
          pnpm --filter @t4-code/t4-api-contract check:generated
          pnpm --filter @t4-code/t4-api-client typecheck
          pnpm --filter @t4-code/client typecheck
          pnpm --filter @t4-code/client exec vp test run test/t4-api-v1-conformance.test.ts
      - name: Upload deterministic T4 API client
        if: ${{ always() }}
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        with:
          name: t4-api-generated-${{ github.run_id }}
          path: artifacts/t4-api/generated/schema.ts
          if-no-files-found: error



  core:
    runs-on: ubuntu-24.04
    timeout-minutes: 25
    steps:
      - name: Check out source
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4

      - name: Install pnpm
        uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4
        with:
          version: 11.10.0

      - name: Install Node.js
        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
        with:
          node-version: 24.13.1
          cache: pnpm

      - name: Install Bun for the T4 host packages
        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
        with:
          bun-version: 1.3.14

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Install browser for end-to-end tests
        run: pnpm exec playwright install --with-deps chromium

      - name: Check source and types
        run: pnpm check

      - name: Run tests
        run: pnpm test

      - name: Build all workspaces
        run: pnpm build

      - name: Run built-app end-to-end tests
        run: pnpm test:e2e

      - name: Check packaging contract
        run: pnpm test:packaging

  legacy-bridge-continuity:
    needs: changes
    if: ${{ github.event_name != 'pull_request' || needs.changes.outputs.continuity == 'true' }}
    runs-on: ubuntu-24.04
    timeout-minutes: 20
    steps:
      - name: Check out exact T4 source
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
        with:
          ref: ${{ github.event.pull_request.head.sha || github.sha }}

      - name: Install pnpm
        uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4
        with:
          version: 11.10.0

      - name: Install Node.js
        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
        with:
          node-version: 24.13.1
          cache: pnpm

      - name: Install Bun
        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
        with:
          bun-version: 1.3.14

      - name: Install continuity prerequisites
        run: sudo apt-get update && sudo apt-get install --yes expect

      - name: Install T4 dependencies
        run: pnpm install --frozen-lockfile

      - name: Resolve pinned OMP authority source
        id: authority
        shell: bash
        run: |
          set -euo pipefail
          source_repository="$(jq -er '.verifiedRuntime.sourceRepository' compat/omp-app-matrix.json)"
          test "$source_repository" = "https://github.com/wolfiesch/oh-my-pi"
          sha="$(jq -er '.inputs.operationsContinuity' provenance/omp-host-migration.json)"
          [[ "$sha" =~ ^[0-9a-f]{40}$ ]]
          echo "repository=wolfiesch/oh-my-pi" >> "$GITHUB_OUTPUT"
          echo "sha=$sha" >> "$GITHUB_OUTPUT"

      - name: Check out pinned OMP authority source
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
        with:
          repository: ${{ steps.authority.outputs.repository }}
          ref: ${{ steps.authority.outputs.sha }}
          path: .continuity/omp

      - name: Install OMP authority dependencies
        working-directory: .continuity/omp
        run: bun install --frozen-lockfile

      - name: Build OMP native addon
        working-directory: .continuity/omp
        run: bun run build:native

      - name: Run legacy bridge continuity gate
        env:
          T4_OMP_SOURCE_DIR: ${{ github.workspace }}/.continuity/omp
        run: pnpm test:legacy-bridge-continuity

      - name: Upload continuity evidence
        if: ${{ always() }}
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        with:
          name: legacy-bridge-continuity-${{ github.run_id }}
          path: artifacts/legacy-bridge-continuity/
          if-no-files-found: error
          retention-days: 14

  current-bridge-continuity:
    needs: changes
    if: ${{ github.event_name != 'pull_request' || needs.changes.outputs.continuity == 'true' }}
    runs-on: ubuntu-24.04
    timeout-minutes: 20
    steps:
      - name: Check out exact T4 source
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
        with:
          ref: ${{ github.event.pull_request.head.sha || github.sha }}

      - name: Install pnpm
        uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4
        with:
          version: 11.10.0

      - name: Install Node.js
        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
        with:
          node-version: 24.13.1
          cache: pnpm

      - name: Install Bun
        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
        with:
          bun-version: 1.3.14

      - name: Install T4 dependencies
        run: pnpm install --frozen-lockfile

      - name: Resolve current OMP authority source
        id: current-authority
        shell: bash
        run: |
          set -euo pipefail
          source_repository="$(jq -er '.verifiedRuntime.sourceRepository' compat/omp-app-matrix.json)"
          test "$source_repository" = "https://github.com/wolfiesch/oh-my-pi"
          sha="$(jq -er '.verifiedRuntime.sourceCommit' compat/omp-app-matrix.json)"
          [[ "$sha" =~ ^[0-9a-f]{40}$ ]]
          echo "repository=wolfiesch/oh-my-pi" >> "$GITHUB_OUTPUT"
          echo "sha=$sha" >> "$GITHUB_OUTPUT"

      - name: Check out current OMP authority source
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
        with:
          repository: ${{ steps.current-authority.outputs.repository }}
          ref: ${{ steps.current-authority.outputs.sha }}
          path: .current-continuity/omp

      - name: Install current OMP authority dependencies
        working-directory: .current-continuity/omp
        run: bun install --frozen-lockfile

      - name: Build current OMP native addon
        working-directory: .current-continuity/omp
        run: bun run build:native

      - name: Run current OMP authority source tests
        working-directory: .current-continuity/omp
        run: bun test packages/coding-agent/test/appserver-bridge.test.ts packages/coding-agent/test/appserver-session-lifecycle.test.ts

      - name: Run current bridge compatibility proof
        env:
          T4_CURRENT_OMP_SOURCE_DIR: ${{ github.workspace }}/.current-continuity/omp
        run: pnpm --filter @t4-code/host-service verify:current-omp-bridge

      - name: Upload current bridge evidence
        if: ${{ success() }}
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        with:
          name: current-omp-bridge-${{ github.run_id }}
          path: artifacts/current-omp-bridge/
          if-no-files-found: error
          retention-days: 14

  official-omp-gate0:
    needs: changes
    if: ${{ github.event_name != 'pull_request' || needs.changes.outputs.official_omp_gate0 == 'true' }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - platform: linux-x64
            runner: ubuntu-24.04
          - platform: linux-arm64
            runner: ubuntu-24.04-arm
          - platform: darwin-arm64
            runner: macos-15
    name: official-omp-gate0 (${{ matrix.platform }})
    runs-on: ${{ matrix.runner }}
    timeout-minutes: 10
    steps:
      - name: Check out exact T4 source
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
        with:
          ref: ${{ github.event.pull_request.head.sha || github.sha }}

      - name: Install pnpm
        uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4
        with:
          version: 11.10.0

      - name: Install Node.js
        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
        with:
          node-version: 24.13.1

      - name: Install Bun
        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
        with:
          bun-version: 1.3.14

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Prove the pinned unmodified official OMP runtime
        run: pnpm --filter @t4-code/host-service verify:official-omp-lifecycle

      - name: Prove the packaged T4 host against official OMP
        run: pnpm --filter @t4-code/host-daemon verify:official-omp-packaged

      - name: Upload official OMP Gate 0 evidence
        if: ${{ success() }}
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        with:
          name: official-omp-gate0-${{ matrix.platform }}-${{ github.run_id }}
          path: |
            artifacts/official-omp-gate0/${{ matrix.platform }}.json
            artifacts/official-omp-packaged-host/${{ matrix.platform }}.json
          if-no-files-found: error
          retention-days: 14

  cluster:
    needs: changes
    if: ${{ github.event_name != 'pull_request' || needs.changes.outputs.cluster == 'true' }}
    runs-on: ubuntu-24.04
    timeout-minutes: 25
    steps:
      - name: Check out source
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4

      - name: Install pnpm
        uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4
        with:
          version: 11.10.0

      - name: Install Node.js
        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
        with:
          node-version: 24.13.1
          cache: pnpm

      - name: Install Bun
        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
        with:
          bun-version: 1.3.14

      - name: Install Go
        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
        with:
          go-version: "1.25.5"
          cache-dependency-path: packages/cluster-operator/go.sum

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Install pinned Helm
        shell: bash
        run: |
          set -euo pipefail
          curl -fsSLo /tmp/helm.tar.gz https://get.helm.sh/helm-v3.19.0-linux-amd64.tar.gz
          echo "a7f81ce08007091b86d8bd696eb4d86b8d0f2e1b9f6c714be62f82f96a594496  /tmp/helm.tar.gz" | sha256sum -c -
          tar -xzf /tmp/helm.tar.gz -C /tmp
          sudo install -m 0755 /tmp/linux-amd64/helm /usr/local/bin/helm

      - name: Run cluster CI proof contracts
        run: pnpm test:cluster:ci

      - name: Run cluster server tests
        run: pnpm --filter @t4-code/cluster-server test

      - name: Run model gateway tests
        run: pnpm --filter @t4-code/model-gateway test

      - name: Run session runtime credential preflight tests
        run: bun test cluster/images/session-runtime/assert-omp-credentials-absent.test.ts

      - name: Typecheck cluster server
        run: pnpm --filter @t4-code/cluster-server typecheck

      - name: Typecheck model gateway
        run: pnpm --filter @t4-code/model-gateway typecheck

      - name: Run cluster protocol contracts
        run: |
          pnpm --filter @t4-code/host-wire exec bun test test/cluster-operator.test.ts
          pnpm --filter @t4-code/host-service exec bun test test/cluster-default-off.test.ts

      - name: Run operator tests
        working-directory: packages/cluster-operator
        env:
          GOFLAGS: -mod=readonly
        run: go test ./...

      - name: Lint cluster chart
        run: helm lint deploy/charts/t4-cluster

  tooling:
    needs: changes
    if: ${{ github.event_name != 'pull_request' || needs.changes.outputs.tooling == 'true' }}
    runs-on: ubuntu-24.04
    timeout-minutes: 25
    steps:
      - name: Check out source
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4

      - name: Install pnpm
        uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4
        with:
          version: 11.10.0

      - name: Install Node.js
        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
        with:
          node-version: 24.13.1
          cache: pnpm

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Run tooling regression tests
        run: pnpm test:tooling

  android-debug:
    needs: changes
    if: ${{ github.event_name != 'pull_request' || needs.changes.outputs.android_debug == 'true' }}
    runs-on: ubuntu-24.04
    timeout-minutes: 35
    steps:
      - name: Check out source
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4

      - name: Install pnpm
        uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4
        with:
          version: 11.10.0

      - name: Install Node.js
        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
        with:
          node-version: 24.13.1
          cache: pnpm

      - name: Install Java
        uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # v4
        with:
          distribution: temurin
          java-version: "21"
          cache: gradle

      - name: Install Android SDK
        uses: android-actions/setup-android@9fc6c4e9069bf8d3d10b2204b1fb8f6ef7065407 # v3

      - name: Install pinned Android platform and build tools
        run: sdkmanager --install "platforms;android-36" "build-tools;36.0.0"

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Build web application
        run: pnpm build:web

      - name: Verify unsigned Android debug application
        run: pnpm --filter @t4-code/mobile check:android:debug

  verify:
    name: verify
    if: ${{ always() }}
    needs: [changes, t4-api-generation, core, legacy-bridge-continuity, current-bridge-continuity, official-omp-gate0, cluster, tooling, android-debug]
    runs-on: ubuntu-24.04
    timeout-minutes: 5
    steps:
      - name: Require every selected CI leg
        shell: bash
        env:
          CHANGES_RESULT: ${{ needs.changes.result }}
          T4_API_GENERATION_RESULT: ${{ needs.t4-api-generation.result }}
          CORE_RESULT: ${{ needs.core.result }}
          CONTINUITY_RESULT: ${{ needs.legacy-bridge-continuity.result }}
          CURRENT_CONTINUITY_RESULT: ${{ needs.current-bridge-continuity.result }}
          OFFICIAL_OMP_GATE0_RESULT: ${{ needs.official-omp-gate0.result }}
          CLUSTER_RESULT: ${{ needs.cluster.result }}
          TOOLING_RESULT: ${{ needs.tooling.result }}
          ANDROID_RESULT: ${{ needs.android-debug.result }}
        run: |
          set -euo pipefail
          test "$CHANGES_RESULT" = success
          test "$T4_API_GENERATION_RESULT" = success
          test "$CORE_RESULT" = success
          for result in \
            "$CONTINUITY_RESULT" \
            "$CURRENT_CONTINUITY_RESULT" \
            "$OFFICIAL_OMP_GATE0_RESULT" \
            "$CLUSTER_RESULT" \
            "$TOOLING_RESULT" \
            "$ANDROID_RESULT"
          do
            case "$result" in
              success|skipped) ;;
              *) exit 1 ;;
            esac
          done