ci.yml

name: CI

on:
  pull_request:
    branches:
      - main
    # Never create a run for a release-please PR. GITHUB_TOKEN-opened PRs land in
    # action_required and never start; excluding the exact release-output set means
    # no run is created at all. push/tag/release triggers are unaffected.
    paths-ignore:
      - .release-please-manifest.json
      - CHANGELOG.md

jobs:
  check:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6

      - uses: actions/setup-go@v6
        with:
          go-version-file: go.mod

      - name: Format check
        run: |
          output=$(gofmt -l .)
          if [ -n "$output" ]; then
            echo "Files not formatted:"
            echo "$output"
            exit 1
          fi

      - name: Vet
        run: go vet ./...

  test:
    name: ${{ matrix.name }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: ubuntu-latest
            name: test (ubuntu-latest)
          - os: macos-latest
            name: test (macos-latest)
          - os: windows-latest
            name: test (windows-core)
            shard: core
          - os: windows-latest
            name: test (windows-git)
            shard: git
    runs-on: ${{ matrix.os }}
    # Sized for each Windows shard, which still sets the floor: git.exe plus
    # Defender tax makes git-backed packages ~10x their Linux time (see the
    # Defender note below). A single Windows `./...` job compiled every binary
    # and then ran those packages sequentially, so total wall could exceed
    # timeout-minutes with no package hitting go test -timeout - an
    # evidence-free cancellation. Splitting git-heavy packages from the rest
    # drops each shard's wall below this cap so a real hang dumps goroutines.
    # 40 is a runaway guard, not a target - Linux and macOS finish far inside
    # it, and it still keeps a wedged runner well short of the six-hour default.
    timeout-minutes: 40
    steps:
      - uses: actions/checkout@v6

      - uses: actions/setup-go@v6
        with:
          go-version-file: go.mod

      # The Windows suite is process-spawn bound, not compute bound: the
      # git-backed packages run thousands of git.exe invocations, and Defender
      # real-time scanning taxes every spawn and every file the temp repos
      # create. That tax is why the same packages cost ~10x their Linux time
      # (internal/git 5.7s -> 53s, internal/branchsync 31s -> 415s) and why the
      # job repeatedly overran timeout-minutes and was cancelled. Excluding the
      # ephemeral trees this job creates itself is the cheapest structural fix;
      # the runner is disposable and no other workload shares it. Best effort on
      # purpose - a runner image without the Defender cmdlets must not fail CI.
      - name: Exclude CI build and test trees from Defender scanning
        if: runner.os == 'Windows'
        shell: pwsh
        run: |
          try {
            $paths = @(
              $env:GITHUB_WORKSPACE,
              $env:RUNNER_TEMP,
              $env:TEMP,
              (go env GOCACHE),
              (go env GOMODCACHE),
              (go env GOROOT)
            ) | Where-Object { $_ } | Sort-Object -Unique
            Add-MpPreference -ExclusionPath $paths -ErrorAction Stop
            Add-MpPreference -ExclusionProcess 'go.exe', 'git.exe' -ErrorAction Stop
            Write-Host "Defender exclusions added for: $($paths -join ', ')"
          } catch {
            Write-Host "::warning::Defender exclusions unavailable, Windows tests run untuned: $_"
          }

      - name: Test on Unix
        if: runner.os != 'Windows'
        run: go test -race ./...

      # Git-heavy packages are the Windows wall floor. Keep this list in lockstep
      # with NM_CI_WINDOWS_GIT_EXCLUDE on the core shard; the workflow tests
      # resolve both through `go list` and fail if they drift.
      - name: Test on Windows (git-heavy)
        if: runner.os == 'Windows' && matrix.shard == 'git'
        run: go test -v -timeout=15m ./internal/git ./internal/branchsync ./internal/gate ./internal/evidence ./internal/pipeline/steps ./internal/daemon ./internal/eval

      - name: Test on Windows (core)
        if: runner.os == 'Windows' && matrix.shard == 'core'
        shell: pwsh
        env:
          NM_CI_WINDOWS_GIT_EXCLUDE: '/internal/(git|branchsync|gate|evidence|pipeline/steps|daemon|eval)$'
        run: |
          $pkgs = go list ./... | Where-Object { $_ -notmatch $env:NM_CI_WINDOWS_GIT_EXCLUDE }
          go test -v -timeout=15m @pkgs

      - name: Build
        run: go build ./cmd/no-mistakes

  e2e:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6

      - uses: actions/setup-go@v6
        with:
          go-version-file: go.mod

      # The e2e suite drives the real no-mistakes binary against a fake
      # agent through `git push -> daemon -> pipeline -> push to upstream`
      # for claude, codex, grok, and opencode. It builds the binary itself, so
      # no separate build step is needed. Linux-only for now: opencode's
      # ephemeral HTTP server picks up unused ports via :0, which is
      # fine on Linux runners but flakes on Windows agent harnesses.
      - name: End-to-end suite
        run: make e2e