ci.yml

name: CI

on:
  push:
    branches: [main, develop, port, feat/pranit]
  pull_request:
    branches: [main, develop, port, feat/pranit]

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

env:
  NODE_VERSION: '22'
  BUN_VERSION: 'latest'
  CARGO_TERM_COLOR: always
  CENTRAL_LICENSE_KEY: '38A7449F-8FCA-45E9-8FA4-E2C656E0F3AE'

jobs:
  # ============================================
  # Frontend - Agent (TypeScript/React)
  # ============================================
  typecheck:
    name: TypeScript (Agent)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
      - uses: oven-sh/setup-bun@v2
        with:
          bun-version: ${{ env.BUN_VERSION }}
      - uses: actions/setup-node@v6
        with:
          node-version: ${{ env.NODE_VERSION }}
      - run: bun install --frozen-lockfile
      - run: bun run typecheck

  lint:
    name: ESLint (All Frontend)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
      - uses: oven-sh/setup-bun@v2
        with:
          bun-version: ${{ env.BUN_VERSION }}
      - uses: actions/setup-node@v6
        with:
          node-version: ${{ env.NODE_VERSION }}
      - run: bun install --frozen-lockfile
      - run: bun run lint

  # Vitest tests for all frontend apps (agent, editor, common)
  vitest:
    name: Vitest (All Frontend)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
      - uses: oven-sh/setup-bun@v2
        with:
          bun-version: ${{ env.BUN_VERSION }}
      - uses: actions/setup-node@v6
        with:
          node-version: ${{ env.NODE_VERSION }}
      - run: bun install --frozen-lockfile
      - run: bun run test

  build:
    name: Build (Agent)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
      - uses: oven-sh/setup-bun@v2
        with:
          bun-version: ${{ env.BUN_VERSION }}
      - uses: actions/setup-node@v6
        with:
          node-version: ${{ env.NODE_VERSION }}
      - run: bun install --frozen-lockfile
      - run: bun run build:frontend
        env:
          NODE_OPTIONS: '--max-old-space-size=4096'

      # Only upload artifacts on main branch to save storage
      # continue-on-error prevents storage quota issues from failing the build
      - name: Upload build
        if: github.ref == 'refs/heads/main' && github.event_name == 'push'
        continue-on-error: true
        uses: actions/upload-artifact@v7
        with:
          name: dist-agent-${{ github.sha }}
          path: dist/
          retention-days: 3

  # ============================================
  # Frontend - Common (Shared Types/Utils)
  # ============================================
  common-typecheck:
    name: TypeScript (Common)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
      - uses: oven-sh/setup-bun@v2
        with:
          bun-version: ${{ env.BUN_VERSION }}
      - uses: actions/setup-node@v6
        with:
          node-version: ${{ env.NODE_VERSION }}
      - run: bun install --frozen-lockfile
      - run: bun run common:typecheck

  # ============================================
  # Frontend - Shared Schemas (Zod Schemas)
  # ============================================
  schemas-typecheck:
    name: TypeScript (Schemas)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
      - uses: oven-sh/setup-bun@v2
        with:
          bun-version: ${{ env.BUN_VERSION }}
      - uses: actions/setup-node@v6
        with:
          node-version: ${{ env.NODE_VERSION }}
      - run: bun install --frozen-lockfile
      - run: bun run schemas:typecheck

  # ============================================
  # Agent Bridge (TypeScript/Bun Sidecar)
  # ============================================
  bridge-typecheck:
    name: TypeScript (Bridge)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
      - uses: oven-sh/setup-bun@v2
        with:
          bun-version: ${{ env.BUN_VERSION }}
      - uses: actions/setup-node@v6
        with:
          node-version: ${{ env.NODE_VERSION }}
      - run: bun install --frozen-lockfile
      - run: bun run bridge:typecheck

  bridge-test:
    name: Test (Bridge)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
      - uses: oven-sh/setup-bun@v2
        with:
          bun-version: ${{ env.BUN_VERSION }}
      - uses: actions/setup-node@v6
        with:
          node-version: ${{ env.NODE_VERSION }}
      - run: bun install --frozen-lockfile
      - run: bun run bridge:test

  # ============================================
  # Backend - Rust/Tauri
  # ============================================
  rust-fmt:
    name: Rust Format
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
      - uses: dtolnay/rust-toolchain@stable
        with:
          components: rustfmt
      - run: cargo fmt --all -- --check

  rust-clippy:
    name: Rust Clippy
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
      - name: Install Linux dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y build-essential lld libgtk-3-dev libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev patchelf
          echo "PKG_CONFIG_PATH=/usr/lib/x86_64-linux-gnu/pkgconfig" >> $GITHUB_ENV
      - name: Create placeholder binaries for CI
        run: |
          mkdir -p src-tauri/binaries
          touch src-tauri/binaries/agent-bridge-x86_64-unknown-linux-gnu
          touch src-tauri/binaries/claude-x86_64-unknown-linux-gnu
          chmod +x src-tauri/binaries/*
      - uses: dtolnay/rust-toolchain@stable
        with:
          components: clippy
      - uses: Swatinem/rust-cache@v2
      - run: cargo clippy --all-targets --all-features -- -D warnings

  rust-test:
    name: Rust Test
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
      - name: Install Linux dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y build-essential lld libgtk-3-dev libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev patchelf
          echo "PKG_CONFIG_PATH=/usr/lib/x86_64-linux-gnu/pkgconfig" >> $GITHUB_ENV
      - name: Create placeholder binaries for CI
        run: |
          mkdir -p src-tauri/binaries
          touch src-tauri/binaries/agent-bridge-x86_64-unknown-linux-gnu
          touch src-tauri/binaries/claude-x86_64-unknown-linux-gnu
          chmod +x src-tauri/binaries/*
      - uses: dtolnay/rust-toolchain@stable
      - uses: Swatinem/rust-cache@v2
      - run: cargo test --all-features

  rust-deny:
    name: Cargo Deny
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
      - name: Install Linux dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y build-essential lld libgtk-3-dev libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev patchelf
          echo "PKG_CONFIG_PATH=/usr/lib/x86_64-linux-gnu/pkgconfig" >> $GITHUB_ENV
      - name: Create placeholder binaries for CI
        run: |
          mkdir -p src-tauri/binaries
          touch src-tauri/binaries/agent-bridge-x86_64-unknown-linux-gnu
          touch src-tauri/binaries/claude-x86_64-unknown-linux-gnu
          chmod +x src-tauri/binaries/*
      - uses: dtolnay/rust-toolchain@stable
      - name: Install cargo-deny
        run: cargo install cargo-deny --locked
      - name: Run cargo-deny
        run: cargo deny check

  rust-machete:
    name: Unused Dependencies
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
      - name: Install Linux dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y build-essential lld libgtk-3-dev libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev patchelf
          echo "PKG_CONFIG_PATH=/usr/lib/x86_64-linux-gnu/pkgconfig" >> $GITHUB_ENV
      - name: Create placeholder binaries for CI
        run: |
          mkdir -p src-tauri/binaries
          touch src-tauri/binaries/agent-bridge-x86_64-unknown-linux-gnu
          touch src-tauri/binaries/claude-x86_64-unknown-linux-gnu
          chmod +x src-tauri/binaries/*
      - uses: dtolnay/rust-toolchain@stable
      - uses: Swatinem/rust-cache@v2
      - uses: bnjbvr/cargo-machete@main

  rust-doc:
    name: Documentation
    runs-on: ubuntu-latest
    env:
      RUSTDOCFLAGS: '-D warnings'
    steps:
      - uses: actions/checkout@v6
      - name: Install Linux dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y build-essential lld libgtk-3-dev libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev patchelf
          echo "PKG_CONFIG_PATH=/usr/lib/x86_64-linux-gnu/pkgconfig" >> $GITHUB_ENV
      - name: Create placeholder binaries for CI
        run: |
          mkdir -p src-tauri/binaries
          touch src-tauri/binaries/agent-bridge-x86_64-unknown-linux-gnu
          touch src-tauri/binaries/claude-x86_64-unknown-linux-gnu
          chmod +x src-tauri/binaries/*
      - uses: dtolnay/rust-toolchain@stable
      - uses: Swatinem/rust-cache@v2
      - run: cargo doc --no-deps --all-features

  rust-msrv:
    name: MSRV Check (1.88)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
      - name: Install Linux dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y build-essential lld libgtk-3-dev libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev patchelf
          echo "PKG_CONFIG_PATH=/usr/lib/x86_64-linux-gnu/pkgconfig" >> $GITHUB_ENV
      - name: Create placeholder binaries for CI
        run: |
          mkdir -p src-tauri/binaries
          touch src-tauri/binaries/agent-bridge-x86_64-unknown-linux-gnu
          touch src-tauri/binaries/claude-x86_64-unknown-linux-gnu
          chmod +x src-tauri/binaries/*
      - uses: dtolnay/rust-toolchain@1.88.0
      - uses: Swatinem/rust-cache@v2
        with:
          cache-on-failure: false
      - run: cargo check --all-features

  # ============================================
  # macOS DMG Build (Apple Silicon)
  # TEMPORARILY DISABLED - Uncomment when ready for release
  #
  # INSTALLATION INSTRUCTIONS (after downloading DMG):
  # The app is not notarized with Apple, so macOS will block it by default.
  # To install and run:
  #
  #   1. Mount the DMG:
  #      open ~/Downloads/Orbit*.dmg
  #
  #   2. Copy to Applications:
  #      cp -R "/Volumes/Orbit/Orbit.app" /Applications/
  #
  #   3. Remove quarantine attribute (bypasses Gatekeeper):
  #      xattr -cr /Applications/Orbit.app
  #
  #   4. Launch:
  #      open /Applications/Orbit.app
  #
  # One-liner:
  #   cp -R "/Volumes/Orbit/Orbit.app" /Applications/ && xattr -cr /Applications/Orbit.app && open /Applications/Orbit.app
  #
  # ============================================
  # build-macos:
  #   name: Build macOS DMG
  #   runs-on: macos-15
  #   steps:
  #     - uses: actions/checkout@v6
  #
  #     # Select Xcode 16.4 for macOS SDK 15.5 (16.3 = SDK 15.4)
  #     - name: Select Xcode 16.4
  #       run: |
  #         sudo xcode-select -s /Applications/Xcode_16.4.app/Contents/Developer
  #         xcodebuild -version
  #         xcrun --show-sdk-path
  #         xcrun --show-sdk-version
  #
  #     # Setup Bun for package management and agent-bridge sidecar
  #     - uses: oven-sh/setup-bun@v2
  #       with:
  #         bun-version: ${{ env.BUN_VERSION }}
  #     - uses: actions/setup-node@v6
  #       with:
  #         node-version: ${{ env.NODE_VERSION }}
  #     - run: bun install --frozen-lockfile
  #
  #     # Setup Rust
  #     - uses: dtolnay/rust-toolchain@stable
  #       with:
  #         targets: aarch64-apple-darwin
  #     - uses: Swatinem/rust-cache@v2
  #       with:
  #         cache-on-failure: false
  #
  #     # Build agent-bridge sidecar (Bun standalone binary)
  #     # Note: bun install already resolved workspace dependencies (@orbit/shared-schemas)
  #     - name: Build agent-bridge sidecar
  #       run: |
  #         cd agent-bridge
  #         bun build ./src/index.ts --compile --target=bun-darwin-arm64 --outfile=../src-tauri/binaries/agent-bridge-aarch64-apple-darwin
  #         chmod +x ../src-tauri/binaries/agent-bridge-aarch64-apple-darwin
  #
  #     # Install Claude Code CLI and copy the binary
  #     - name: Install Claude Code CLI
  #       run: |
  #         curl -fsSL https://claude.ai/install.sh | bash
  #         # Copy from the installed location
  #         cp "$HOME/.local/bin/claude" src-tauri/binaries/claude-aarch64-apple-darwin
  #         chmod +x src-tauri/binaries/claude-aarch64-apple-darwin
  #         ls -la src-tauri/binaries/
  #
  #     # Import Apple certificate into CI keychain for code signing
  #     - name: Import Apple certificate
  #       env:
  #         APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
  #         APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
  #       run: |
  #         CERTIFICATE_PATH=$RUNNER_TEMP/certificate.p12
  #         KEYCHAIN_PATH=$RUNNER_TEMP/app-signing.keychain-db
  #         KEYCHAIN_PASSWORD=$(openssl rand -base64 32)
  #
  #         # Decode certificate
  #         echo -n "$APPLE_CERTIFICATE" | base64 --decode -o $CERTIFICATE_PATH
  #
  #         # Create temporary keychain
  #         security create-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
  #         security set-keychain-settings -lut 21600 $KEYCHAIN_PATH
  #         security unlock-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
  #
  #         # Import certificate
  #         security import $CERTIFICATE_PATH -P "$APPLE_CERTIFICATE_PASSWORD" -A -t cert -f pkcs12 -k $KEYCHAIN_PATH
  #         security set-key-partition-list -S apple-tool:,apple: -k "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
  #         security list-keychain -d user -s $KEYCHAIN_PATH
  #
  #         # Verify
  #         security find-identity -v -p codesigning $KEYCHAIN_PATH
  #
  #     # Build Tauri app (includes frontend build via beforeBuildCommand)
  #     # Tauri reads APPLE_* env vars for signing and notarization automatically
  #     - name: Build Tauri macOS app
  #       run: bunx tauri build --target aarch64-apple-darwin
  #       env:
  #         APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
  #         APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
  #         APPLE_SIGNING_IDENTITY: ${{ secrets.APPLE_SIGNING_IDENTITY }}
  #         APPLE_ID: ${{ secrets.APPLE_ID }}
  #         APPLE_PASSWORD: ${{ secrets.APPLE_PASSWORD }}
  #         APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
  #         TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
  #         TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
  #
  #     # Upload DMG artifact
  #     # Note: tauri build outputs to ./target/ (project root), not ./src-tauri/target/
  #     - name: Upload DMG
  #       uses: actions/upload-artifact@v7
  #       with:
  #         name: Orbit-macOS-arm64-${{ github.sha }}
  #         path: target/aarch64-apple-darwin/release/bundle/dmg/*.dmg
  #         retention-days: 7
  #
  #     # Clean up keychain (always runs, even on failure)
  #     - name: Clean up keychain
  #       if: always()
  #       run: security delete-keychain $RUNNER_TEMP/app-signing.keychain-db 2>/dev/null || true

  # ============================================
  # QUALITY GATE - Required status check
  # ============================================
  ci-passed:
    name: CI Passed
    runs-on: ubuntu-latest
    needs:
      [
        typecheck,
        lint,
        vitest,
        build,
        common-typecheck,
        schemas-typecheck,
        bridge-typecheck,
        bridge-test,
        rust-fmt,
        rust-clippy,
        rust-test,
        rust-deny,
        rust-machete,
        rust-doc,
        rust-msrv,
      ]
    if: always()
    steps:
      - name: Check results
        run: |
          # Agent frontend checks
          agent="${{ needs.typecheck.result }} ${{ needs.lint.result }} ${{ needs.build.result }}"
          # Common/Schemas checks
          shared="${{ needs.common-typecheck.result }} ${{ needs.schemas-typecheck.result }}"
          # Bridge checks
          bridge="${{ needs.bridge-typecheck.result }}"
          # Rust checks (required)
          rust="${{ needs.rust-fmt.result }} ${{ needs.rust-clippy.result }} ${{ needs.rust-test.result }}"
          rust+=" ${{ needs.rust-deny.result }} ${{ needs.rust-doc.result }} ${{ needs.rust-msrv.result }}"
          # Test checks (allow skipped - bridge tests skip in CI without API key)
          vitest_result="${{ needs.vitest.result }}"
          bridge_test_result="${{ needs.bridge-test.result }}"
          machete_result="${{ needs.rust-machete.result }}"

          for result in $agent $shared $bridge $rust; do
            if [[ "$result" != "success" ]]; then
              echo "[FAIL] CI failed"
              exit 1
            fi
          done

          if [[ "$vitest_result" != "success" && "$vitest_result" != "skipped" ]]; then
            echo "[FAIL] Vitest frontend tests failed"
            exit 1
          fi

          if [[ "$bridge_test_result" != "success" && "$bridge_test_result" != "skipped" ]]; then
            echo "[FAIL] Bridge tests failed"
            exit 1
          fi

          # Warn but don't fail on unused deps
          if [[ "$machete_result" != "success" ]]; then
            echo "[WARN] Unused dependencies detected (non-blocking)"
          fi

          echo "[OK] All checks passed"