ci.yml

name: ci

on:
  push:
    branches: [main, npm-kit]
  pull_request:
  workflow_dispatch:

jobs:
  minimum-runtime:
    name: minimum runtime (Node 22.13.0)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - uses: actions/setup-node@v7
        with:
          node-version: '22.13.0'
      - run: node bin/agentic-kit.mjs --help --all
      - run: node --test tests/kit/node-runtime.test.mjs tests/kit/sqlite.test.mjs tests/kit/usage-audit-211.test.mjs

  test:
    name: test (${{ matrix.os }}, node ${{ matrix.node }})
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, macos-latest, windows-latest]
        node: [22, 24, 26]
    steps:
      - uses: actions/checkout@v7
      - uses: pnpm/action-setup@v6   # version comes from package.json packageManager
      - uses: actions/setup-node@v7
        with:
          node-version: ${{ matrix.node }}

      # Zero runtime dependencies — no install step by design.
      - name: Unit + statusline tests
        run: pnpm test

      # Explicit guard: every dispatchable command must ship a --help/Examples
      # surface. Fails the build if a new command lands without one.
      - name: Dispatch surface (help/Examples for every command)
        run: pnpm run test:surface

      - name: CLI smoke (sandboxed HOME)
        shell: bash
        env:
          # Isolate every home-relative write (kit.json, CLAUDE.md, settings).
          HOME: ${{ runner.temp }}/kit-home
          USERPROFILE: ${{ runner.temp }}\kit-home
          XDG_CONFIG_HOME: ${{ runner.temp }}/kit-home/.config
          APPDATA: ${{ runner.temp }}\kit-home\AppData\Roaming
        run: |
          mkdir -p "$HOME"
          # The smoke test proves local CLI behavior, not npm reachability.
          # Seed a fresh empty drift cache so an offline Windows runner does
          # not pay four sequential 20s `npm view` timeouts inside status.
          node -e 'const fs=require("node:fs"),p=require("node:path"),base=process.platform==="win32"?process.env.APPDATA:process.env.XDG_CONFIG_HOME,dir=p.join(base,"agentic-kit"),last=Date.now();fs.mkdirSync(dir,{recursive:true});fs.writeFileSync(p.join(dir,"kit.json"),JSON.stringify({versionCheck:{last,seen:{},self:{last,best:null}}}))'
          node bin/agentic-kit.mjs --version
          node bin/agentic-kit.mjs --help --all > /dev/null
          # status must emit valid JSON and exit deterministically even on a
          # machine with no ruflo installed (rows degrade to warn/fail).
          node bin/agentic-kit.mjs status --json > status.json || true
          node -e "const s=require('./status.json'); if(!Array.isArray(s.rows)||!s.overall) throw new Error('bad status JSON'); console.log('status rows:', s.rows.length, 'overall:', s.overall)"
          # managed-block engine round-trip against the sandbox HOME
          node bin/agentic-kit.mjs x reference sync
          node -e "const fs=require('fs'),os=require('os'),p=require('path').join(os.homedir(),'.claude','CLAUDE.md'); const t=fs.readFileSync(p,'utf8'); for (const s of ['ruflo-preamble','ruflo-reference']) if(!t.includes('<!-- BEGIN '+s+' -->')) throw new Error('missing block '+s); console.log('blocks OK')"
          node bin/agentic-kit.mjs uninstall --dry-run

  # Static quality gates. Platform-independent → single OS. This is the only job
  # that installs devDependencies (the published package stays zero-runtime-dep).
  quality:
    name: quality (typecheck, lint, build, audit)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - uses: pnpm/action-setup@v6
      - uses: actions/setup-node@v7
        with:
          node-version: 22
          cache: pnpm

      - name: Install devDependencies
        run: pnpm install --frozen-lockfile

      - name: Typecheck (tsc --checkJs)
        run: pnpm run typecheck
      - name: Lint (eslint)
        run: pnpm run lint
      # Hard complexity ceiling earned by the 2026-08 complexity program
      # (ADR-0037): no function over CC 50, enforced as an error. The
      # advisory warn-25 tier lives in eslint.config.mjs.
      - name: Complexity ceiling (CC ≤ 50, error)
        run: pnpm run lint:cc
      - name: Markdown lint
        run: pnpm run lint:md
      - name: Build (packaging + load validation)
        run: pnpm run build
      - name: Dependency audit
        run: pnpm run audit

  # Rendering verification: the route suites prove the server returns correct
  # JSON; only this proves the page RENDERS it (no `undefined`/`NaN`/
  # `[object Object]` in visible text). Drives the SYSTEM Chrome — ubuntu
  # runners ship it, nothing is downloaded.
  ui:
    name: ui (dashboard rendering, system Chrome)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - uses: pnpm/action-setup@v6
      - uses: actions/setup-node@v7
        with:
          node-version: 22
          cache: pnpm
      - name: Install devDependencies
        run: pnpm install --frozen-lockfile
      - name: Dashboard UI (Playwright, fixture corpus)
        run: pnpm run test:ui

  # Internal/relative links only (fast, deterministic). External links run in
  # nightly — network + rate-limits make them flaky per-PR.
  links:
    name: links (internal)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - name: Check internal links (offline)
        uses: lycheeverse/lychee-action@v2
        with:
          args: "--offline --include-fragments --config lychee.toml README.md CLAUDE.md AGENTS.md MAINTAINER.md 'docker/*.md' 'claude/**/*.md' 'src/templates/**/*.md' 'docs/**/*.md'"
          fail: true