ci-gates.yml

# Baseline CI — seeded once by socket-wheelhouse (template/presets/), then
# repo-owned: edit freely. Runs check + test via the LOCAL composite actions
# under .github/actions/fleet/ (cascade-updated), referenced by ./ path — no
# cross-repo reusable workflow, no first-party `uses:@sha`. Add repo-specific
# jobs anywhere under `jobs:`.
name: "ci: gates"
run-name: "ci: gates"

on:
  push:
    branches: [main]
    tags: ['*']
  pull_request:
    branches: [main]
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

# Fleet no-phone-home posture: CI runners don't source the shell-rc that dev
# machines get from setup-security-tools, so set every FLEET_ENV knob
# workflow-level or the telemetry-env-is-disabled +
# package-manager-auto-update-is-disabled gates (under `check --all`) fail.
# Lockstep source: .claude/hooks/fleet/_shared/fleet-env.mts (FLEET_ENV) —
# the telemetry-env-is-disabled check asserts each knob at CI runtime.
env:
  # Markdown conformance gate (markdownlint-cli2 + the socket-* GFM rules)
  # runs inside `pnpm run lint` when set. Flipped on 2026-07-12 after the
  # fleet-wide burn-down took every member to zero findings.
  LINT_MARKDOWN: '1'

jobs:
  # First step of every job is an inline git-fetch bootstrap (no third-party
  # actions/checkout) — a job's FIRST step can't call the local
  # `./.github/actions/fleet/checkout` composite, since nothing is checked out
  # yet for GitHub to resolve `./.github/actions/*` from. It shallow-fetches the
  # workspace so those composites resolve; setup-and-install then re-runs the
  # checkout composite — full history (fetch-depth 0) in the check job, since
  # the commit-history checks it runs (AI-attribution, release-boundary) read
  # the default branch's history and refuse a shallow clone rather than
  # false-green; the test matrix stays at the default depth (25 — covers CI's
  # other git operations) and runs the zizmor Actions audit (its own
  # `strategy.job-total < 2` skip runs it in the non-matrix check job, skips it
  # in the test matrix).
  check:
    name: 🔎 Check
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - name: Bootstrap checkout
        shell: bash
        env:
          # Route context through env (no ${{ }} in the shell body —
          # zizmor expression-injection). Token authorizes the fetch inline and
          # is never persisted to .git/config.
          GITHUB_TOKEN: ${{ github.token }}
          SERVER_URL: ${{ github.server_url }}
          REPOSITORY: ${{ github.repository }}
          TRIGGER_REF: ${{ github.sha }}
        run: |
          set -euo pipefail
          git init -q
          git config --local advice.detachedHead false
          git remote remove origin 2>/dev/null || true
          git remote add origin "${SERVER_URL}/${REPOSITORY}"
          FETCH_ARGS=(--no-tags --prune --depth 1 origin "${TRIGGER_REF}")
          if [ -n "${GITHUB_TOKEN}" ]; then
            AUTH_B64="$(printf 'x-access-token:%s' "${GITHUB_TOKEN}" | base64 | tr -d '\n')"
            git -c "http.${SERVER_URL}/.extraheader=AUTHORIZATION: basic ${AUTH_B64}" fetch "${FETCH_ARGS[@]}"
          else
            git fetch "${FETCH_ARGS[@]}"
          fi
          git checkout -q --detach FETCH_HEAD
      - uses: ./.github/actions/fleet/setup-and-install
        with:
          # Full history: the commit-history checks (AI-attribution,
          # release-boundary) read the default branch's history and refuse a
          # shallow clone rather than false-green.
          checkout-fetch-depth: '0'
          socket-api-token: ${{ secrets.SOCKET_API_TOKEN_FOR_CLI_AND_SFW }}
          # Thin-distribution CI auth: mint a contents:read-only token so the
          # bootstrap fetch (fired by `prepare` during install) can download the
          # fleet release bundle from the private wheelhouse. Both secrets are
          # empty on a non-thin member, so the mint is skipped.
          payload-token-client-id: ${{ secrets.SOCKET_RELEASE_CLIENT_ID || vars.SOCKET_RELEASE_CLIENT_ID }}
          payload-token-private-key: ${{ secrets.SOCKET_RELEASE_APP_PRIVATE_KEY }}
      - name: Check
        uses: ./.github/actions/fleet/run-script
        with:
          main-script: pnpm run check --all

  test:
    name: 🧪 Test
    strategy:
      fail-fast: false
      max-parallel: 4
      matrix:
        # JS/TS tests only need a fast Linux run; cross-platform behavior is
        # covered by unit tests, not the CI matrix.
        os: [ubuntu-latest]
    runs-on: ${{ matrix.os }}
    timeout-minutes: 15
    steps:
      - name: Bootstrap checkout
        shell: bash
        env:
          # Route context through env (no ${{ }} in the shell body —
          # zizmor expression-injection). Token authorizes the fetch inline and
          # is never persisted to .git/config.
          GITHUB_TOKEN: ${{ github.token }}
          SERVER_URL: ${{ github.server_url }}
          REPOSITORY: ${{ github.repository }}
          TRIGGER_REF: ${{ github.sha }}
        run: |
          set -euo pipefail
          git init -q
          git config --local advice.detachedHead false
          git remote remove origin 2>/dev/null || true
          git remote add origin "${SERVER_URL}/${REPOSITORY}"
          FETCH_ARGS=(--no-tags --prune --depth 1 origin "${TRIGGER_REF}")
          if [ -n "${GITHUB_TOKEN}" ]; then
            AUTH_B64="$(printf 'x-access-token:%s' "${GITHUB_TOKEN}" | base64 | tr -d '\n')"
            git -c "http.${SERVER_URL}/.extraheader=AUTHORIZATION: basic ${AUTH_B64}" fetch "${FETCH_ARGS[@]}"
          else
            git fetch "${FETCH_ARGS[@]}"
          fi
          git checkout -q --detach FETCH_HEAD
      - uses: ./.github/actions/fleet/setup-and-install
        with:
          socket-api-token: ${{ secrets.SOCKET_API_TOKEN_FOR_CLI_AND_SFW }}
          # Thin-distribution CI auth: mint a contents:read-only token so the
          # bootstrap fetch (fired by `prepare` during install) can download the
          # fleet release bundle from the private wheelhouse. Both secrets are
          # empty on a non-thin member, so the mint is skipped.
          payload-token-client-id: ${{ secrets.SOCKET_RELEASE_CLIENT_ID || vars.SOCKET_RELEASE_CLIENT_ID }}
          payload-token-private-key: ${{ secrets.SOCKET_RELEASE_APP_PRIVATE_KEY }}
      - name: Test
        uses: ./.github/actions/fleet/run-script
        env:
          # Authenticate build-time GitHub API reads (release listings,
          # prebuilt-artifact downloads). Unauthenticated calls share the
          # hosted runner's IP-scoped rate limit and 403 under load.
          GH_TOKEN: ${{ github.token }}
        with:
          setup-script: pnpm run build
          main-script: pnpm test --ci

      # odai presents as llama-server, so llama.cpp's own server suite is the
      # conformance corpus. The setup step checks out the pinned submodule and
      # warms the pinned python packages; uv itself arrives SRI-verified in the
      # fleet bootstrap. The runner classifies every result against
      # .config/repo/llama-cpp-server.allowlist and fails on an unexpected
      # failure, a stale entry, or a run that measured nothing.
      - uses: ./.github/actions/fleet/run-script
        with:
          setup-script: pnpm run setup:e2e --conformance
          main-script: pnpm run test:conformance