ci.yml

name: CI

on:
  pull_request:
  push:
    branches:
      - main

jobs:
  style:
    name: Style
    runs-on: macos-26
    steps:
      - name: Check out repository
        uses: actions/checkout@v6

      - name: Run repository guardrails
        run: make guardrails

      - name: Test Xcode workspace generator
        run: make xcode-generator-test

      - name: Install Swift style tools
        run: ./Scripts/install_format_tools.sh install

      - name: Run Swift style lint
        run: make lint

      - name: Run conductor tests
        run: make conductor-selftest

      - name: Run release workflow tests
        run: make release-selftest

  build-and-test:
    name: Build and Test (app shard ${{ matrix.shard }})
    runs-on: macos-26
    strategy:
      fail-fast: false
      matrix:
        shard: [1, 2, 3, 4]
    steps:
      - name: Check out repository
        uses: actions/checkout@v6

      - name: Restore SwiftPM build cache
        uses: actions/cache@v6
        with:
          path: |
            .build
            Packages/RepoPromptAgentProviders/.build
          key: ${{ runner.os }}-${{ runner.arch }}-swiftpm-${{ hashFiles('Package.swift', 'Package.resolved', 'Packages/RepoPromptAgentProviders/Package.swift', 'Packages/RepoPromptAgentProviders/Package.resolved') }}
          restore-keys: |
            ${{ runner.os }}-${{ runner.arch }}-swiftpm-

      - name: Build app product
        run: swift build --product RepoPrompt

      - name: Build MCP product
        run: swift build --product repoprompt-mcp

      - name: Run app tests
        shell: bash
        run: |
          set -euo pipefail
          # A single long-lived XCTest process accumulates suspended app-lifecycle tasks
          # and can wedge Swift's cooperative executor late in the suite on hosted runners.
          # Preserve serial test semantics while bounding each process to one small group.
          # The runner auto-discovers the built .xctest bundle and invokes xcrun xctest
          # directly, using ledger-backed runtime-balanced shards, slow-first ordering,
          # and conservative batching only for fast stateless suites.
          # Retry only silent startup timeouts; assertion failures fail fast in the runner.
          python3 Scripts/ci_app_test_runner.py \
            --suite-timeout-seconds 180 \
            --silent-timeout-retries 1 \
            --silent-startup-seconds 60 \
            --ledger Scripts/Fixtures/test-suite-contract-ledger.tsv \
            --strict-ledger \
            --shard-count 4 \
            --shard-index "${{ matrix.shard }}" \
            --slow-first \
            --batch-fast-suites \
            --require-runtime-for-batching


  sentry-enabled-build:
    name: Sentry-enabled Build
    runs-on: macos-26
    steps:
      - name: Check out repository
        uses: actions/checkout@v6

      - name: Restore SwiftPM build cache
        uses: actions/cache@v6
        with:
          path: |
            .build
            Packages/RepoPromptAgentProviders/.build
          key: ${{ runner.os }}-${{ runner.arch }}-swiftpm-sentry-${{ hashFiles('Package.swift', 'Package.resolved', 'Packages/RepoPromptAgentProviders/Package.swift', 'Packages/RepoPromptAgentProviders/Package.resolved') }}
          restore-keys: |
            ${{ runner.os }}-${{ runner.arch }}-swiftpm-

      - name: Build app product with Sentry SDK linked
        env:
          REPOPROMPT_ENABLE_SENTRY: "1"
        run: swift build --product RepoPrompt

      - name: Test serialized Sentry privacy boundary
        env:
          REPOPROMPT_ENABLE_SENTRY: "1"
        run: swift test --filter SentryTelemetryPrivacyTests

  provider-tests:
    name: Provider Tests
    runs-on: macos-26
    steps:
      - name: Check out repository
        uses: actions/checkout@v6

      - name: Restore SwiftPM build cache
        uses: actions/cache@v6
        with:
          path: |
            .build
            Packages/RepoPromptAgentProviders/.build
          key: ${{ runner.os }}-${{ runner.arch }}-swiftpm-provider-${{ hashFiles('Package.swift', 'Package.resolved', 'Packages/RepoPromptAgentProviders/Package.swift', 'Packages/RepoPromptAgentProviders/Package.resolved') }}
          restore-keys: |
            ${{ runner.os }}-${{ runner.arch }}-swiftpm-

      - name: Run provider package tests
        working-directory: Packages/RepoPromptAgentProviders
        run: swift test

  secret-scan:
    name: Secret Scan
    runs-on: macos-26
    steps:
      - name: Check out repository
        uses: actions/checkout@v6
        with:
          fetch-depth: 0

      - name: Install gitleaks
        run: brew install gitleaks

      - name: Scan introduced commit range
        env:
          EVENT_NAME: ${{ github.event_name }}
          PR_BASE_SHA: ${{ github.event.pull_request.base.sha }}
          PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
          PUSH_BEFORE_SHA: ${{ github.event.before }}
          CURRENT_SHA: ${{ github.sha }}
        run: |
          set -euo pipefail
          if [[ "$EVENT_NAME" == "pull_request" ]]; then
            range="$PR_BASE_SHA..$PR_HEAD_SHA"
          elif [[ -n "$PUSH_BEFORE_SHA" && ! "$PUSH_BEFORE_SHA" =~ ^0+$ ]]; then
            range="$PUSH_BEFORE_SHA..$CURRENT_SHA"
          else
            range="$CURRENT_SHA"
          fi
          gitleaks git --redact --log-opts="$range" .

      - name: Scan checked-in source tree
        run: gitleaks dir --redact .