ci.yml

name: CI

on:
  push:
    branches:
      - main
      - master
      - "jmcte/**"
  pull_request:
  workflow_dispatch:

permissions:
  contents: read

env:
  SHELL: /bin/bash

concurrency:
  group: ci-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  reusable_contract_changes:
    name: reusable workflow smoke scope
    if: github.event_name == 'pull_request'
    runs-on: ubuntu-24.04
    outputs:
      changed: ${{ steps.filter.outputs.changed }}
    steps:
      - uses: actions/checkout@v7
      - uses: dorny/paths-filter@7b450fff21473bca461d4b92ce414b9d0420d706 # v4
        id: filter
        with:
          filters: |
            changed:
              - '.github/workflows/rg-ci.yml'
              - '.github/workflows/rg-security.yml'
              - '.github/workflows/rg-release.yml'
              - '.github/workflows/reusable-workflow-smoke.yml'
              - 'test/reusable-workflow-contract.test.ts'
              - 'test/fixtures/reusable-workflow.Dockerfile'

  reusable_ci_smoke:
    name: reusable rg-ci caller smoke
    needs: reusable_contract_changes
    if: needs.reusable_contract_changes.outputs.changed == 'true'
    uses: ./.github/workflows/rg-ci.yml
    with:
      runner-class: hosted

  reusable_security_smoke:
    name: reusable rg-security caller smoke
    needs: reusable_contract_changes
    if: needs.reusable_contract_changes.outputs.changed == 'true'
    permissions:
      contents: read
      actions: read
      pull-requests: read
      security-events: write
    uses: ./.github/workflows/rg-security.yml
    with:
      enable-dependency-review: false
      enforce-osv: false

  reusable_release_smoke:
    name: reusable rg-release caller smoke
    needs: reusable_contract_changes
    if: needs.reusable_contract_changes.outputs.changed == 'true'
    permissions:
      contents: read
      packages: write
      id-token: write
      attestations: write
    uses: ./.github/workflows/rg-release.yml
    with:
      image-ref: local/reusable-workflow-smoke:${{ github.sha }}
      dockerfile: test/fixtures/reusable-workflow.Dockerfile
      platforms: linux/amd64
      publish: false

  test_self_hosted_trusted:
    name: test
    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
    runs-on:
      - self-hosted
      - linux
      - shell-only
      - public
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@v7
      - uses: ./actions/setup-shell-safe-node
        with:
          node-version: 24.14.1
      - uses: pnpm/action-setup@v6
        with:
          version: 10.32.1
      - run: pnpm install --frozen-lockfile
      - run: pnpm lint
      - run: pnpm test:coverage
      - run: pnpm build
      - name: Upload coverage report
        if: always()
        uses: actions/upload-artifact@v7
        with:
          name: coverage-report
          path: coverage/**
          if-no-files-found: error

  shell_safe_contract_trusted:
    name: shell-safe contract
    if: >-
      vars.SHELL_SAFE_CONTRACT_ENABLED == 'true' &&
      (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository)
    runs-on:
      - self-hosted
      - synology
      - shell-only
      - public
    env:
      RUNNER_TEMP: /tmp/github-runner-temp
      RUNNER_TOOL_CACHE: /opt/hostedtoolcache
      AGENT_TOOLSDIRECTORY: /opt/hostedtoolcache
      TF_PLUGIN_CACHE_DIR: /tmp/github-runner-temp/terraform-plugin-cache
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@v7
      - name: Prepare shell-safe cache directories
        run: |
          mkdir -p \
            "$RUNNER_TEMP" \
            "$RUNNER_TOOL_CACHE" \
            "$TF_PLUGIN_CACHE_DIR" \
            .tmp/ci-shell-safe/npm \
            .tmp/ci-shell-safe/pip \
            .tmp/ci-shell-safe/terraform
      - uses: actions/cache@v6
        with:
          path: |
            .tmp/ci-shell-safe/npm
            .tmp/ci-shell-safe/pip
            ${{ env.TF_PLUGIN_CACHE_DIR }}
          key: ${{ runner.os }}-shell-safe-contract-${{ hashFiles('docker/Dockerfile', '.github/workflows/ci.yml') }}
      - name: Verify built-in shell-safe toolchain
        run: |
          bash --version | head -n 1
          git --version
          tar --version | head -n 1
          zstd --version | head -n 1
          node --version
          npm --version
          python3.12 --version
          python --version
          terraform version
      - name: Verify cache-aware commands
        env:
          npm_config_cache: ${{ github.workspace }}/.tmp/ci-shell-safe/npm
          PIP_CACHE_DIR: ${{ github.workspace }}/.tmp/ci-shell-safe/pip
        run: |
          python3.12 -m venv .venv-contract
          source .venv-contract/bin/activate
          python -m pip install --upgrade pip setuptools wheel
          python -m pip cache dir
          npm config get cache
          cat > .tmp/ci-shell-safe/terraform/main.tf <<'EOF'
          terraform {
            required_version = "= 1.6.6"
          }
          EOF
          terraform -chdir=.tmp/ci-shell-safe/terraform init -backend=false

  linux_docker_contract_trusted:
    name: linux docker contract
    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
    runs-on:
      - self-hosted
      - linux
      - shell-only
      - public
    timeout-minutes: 20
    steps:
      - uses: actions/checkout@v7
      - uses: ./actions/setup-shell-safe-node
        with:
          node-version: 24.14.1
      - uses: pnpm/action-setup@v6
        with:
          version: 10.32.1
      - run: pnpm install --frozen-lockfile
      - name: Render Linux Docker runner manifests
        run: |
          cp .env.example /tmp/linux-docker.env
          pnpm validate-linux-docker-config -- --config config/linux-docker-runners.yaml --env /tmp/linux-docker.env
          pnpm render-linux-docker-compose -- --config config/linux-docker-runners.yaml --env /tmp/linux-docker.env
          pnpm render-linux-docker-project-manifest -- --config config/linux-docker-runners.yaml --env /tmp/linux-docker.env

  windows_contract_trusted:
    name: windows template contract
    runs-on: ubuntu-latest
    timeout-minutes: 20
    steps:
      - uses: actions/checkout@v7
      - uses: actions/setup-node@v7
        with:
          node-version: "24"
      - uses: pnpm/action-setup@v6
        with:
          version: 10.32.1
      - run: pnpm install --frozen-lockfile
      - name: Render Windows Docker runner manifests
        shell: pwsh
        run: |
          $windowsEnv = Join-Path $env:RUNNER_TEMP "windows-docker.env"
          Copy-Item .env.example $windowsEnv
          pnpm validate-windows-config -- --config config/windows-runners.yaml --env $windowsEnv
          pnpm render-windows-compose -- --config config/windows-runners.yaml --env $windowsEnv
          pnpm render-windows-project-manifest -- --config config/windows-runners.yaml --env $windowsEnv
      - name: Validate Windows entrypoint syntax
        shell: pwsh
        run: |
          $parseErrors = $null
          $null = [System.Management.Automation.PSParser]::Tokenize((Get-Content docker/runner-entrypoint.ps1 -Raw), [ref]$parseErrors)
          if ($parseErrors) { throw ($parseErrors | Out-String) }

  lume_macos_contract_trusted:
    name: lume macos contract
    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
    runs-on: ubuntu-latest
    timeout-minutes: 20
    steps:
      - uses: actions/checkout@v7
      - uses: actions/setup-node@v7
        with:
          node-version: "24"
      - uses: pnpm/action-setup@v6
        with:
          version: 10.32.1
      - run: pnpm install --frozen-lockfile
      - run: pnpm lint
      - run: pnpm test
      - run: pnpm build
      - name: Render Lume runner manifest
        run: |
          cp .env.example /tmp/lume.env
          pnpm validate-lume-config -- --config config/lume-runners.yaml --env /tmp/lume.env
          pnpm render-lume-runner-manifest -- --config config/lume-runners.yaml --env /tmp/lume.env --slot 1
      - name: Exercise Lume project lifecycle
        run: |
          pnpm install-lume-project -- --lume-config config/lume-runners.yaml --env /tmp/lume.env --format json --status-output /tmp/lume-project-result.json --dry-run
          pnpm teardown-lume-project -- --lume-config config/lume-runners.yaml --env /tmp/lume.env --format json --status-output /tmp/lume-project-result.json --dry-run
      - name: Validate Lume shell scripts
        run: |
          bash -n scripts/lib/github-runner-common.sh
          bash -n scripts/guest/macos-runner-bootstrap.sh
          bash -n scripts/lume/lib.sh
          bash -n scripts/lume/create-base-vm.sh
          bash -n scripts/lume/create-slot.sh
          bash -n scripts/lume/destroy-slot.sh
          bash -n scripts/lume/run-slot.sh
          bash -n scripts/lume/reconcile-pool.sh
          bash -n scripts/lume/status.sh

  test_public_fork_pr:
    name: test
    if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name != github.repository
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@v7
      - uses: actions/setup-node@v7
        with:
          node-version: "24"
      - uses: pnpm/action-setup@v6
        with:
          version: 10.32.1
      - run: pnpm install --frozen-lockfile
      - run: pnpm lint
      - run: pnpm test
      - run: pnpm build