native.yml

name: native-check

on:
  workflow_dispatch:
    inputs:
      upload-artifacts:
        description: Retain the three native installers for packaging
        type: boolean
        default: true
  workflow_call:
    inputs:
      ref:
        type: string
        required: true
      upload-artifacts:
        type: boolean
        default: false

permissions:
  contents: read

concurrency:
  group: native-check-${{ github.workflow }}-${{ github.run_id }}
  cancel-in-progress: true

jobs:
  platform:
    strategy:
      fail-fast: false
      max-parallel: 3
      matrix:
        include:
          - platform: linux-amd64
            runner: blacksmith-2vcpu-ubuntu-2204
            github-runner: ubuntu-22.04
          - platform: darwin-arm64
            runner: macos-15
            github-runner: macos-15
          - platform: windows-amd64
            runner: blacksmith-2vcpu-windows-2025
            github-runner: windows-2025
    name: platform (${{ matrix.platform }})
    runs-on: ${{ vars.OAC_USE_GITHUB_RUNNERS == 'true' && matrix.github-runner || matrix.runner }}
    timeout-minutes: 30
    defaults:
      run:
        shell: bash
    steps:
      - uses: actions/checkout@v7
        with:
          ref: ${{ inputs.ref || github.sha }}
      - uses: actions/setup-go@v7
        with:
          go-version-file: go.mod
      - uses: ./.github/actions/node
        with:
          node-version: '22.22.0'
          lockfiles: |
            packages/claude-sdk-adapter/pnpm-lock.yaml
            packages/mcode-harness/package-lock.json
      - name: Build the native daemon and test bundle boundaries
        id: build
        run: |
          go build -ldflags "-X github.com/MiniMax-AI/OpenAgentCore/apps/daemon/internal/cli.Version=$(git rev-parse HEAD)" -o "$RUNNER_TEMP/oac-daemon${{ runner.os == 'Windows' && '.exe' || '' }}" ./apps/daemon/cmd/oac-daemon
          node --test scripts/build-native-installer.test.mjs
      - name: Verify native download bootstrap and recovery
        run: go test ./services/core/internal/nativeinstaller -count=1 -timeout=3m
      - name: Native filesystem, authentication and process lifecycle
        id: filesystem
        run: >-
          go test -race -count=1
          ./internal/runtimefs
          ./apps/daemon/internal/auth
          ./apps/daemon/internal/paths
          ./apps/daemon/internal/daemonize
          ./apps/daemon/internal/agent/clirunner
      - name: Native Harness ownership and environment identity
        id: harness
        run: >-
          go test -race -count=1
          ./apps/daemon/internal/agent/codex
          ./apps/daemon/internal/agent/claudesdk
          ./apps/daemon/internal/agent/mcode
          -run 'TestJSONRPCClientOwnsToolDescendants|TestSelfHostedToolEnvironment'
      - name: Native capability snapshots, files and installation
        id: files
        run: >-
          go test -race -count=1
          ./apps/daemon/internal/localworkspace
          ./apps/daemon/internal/cli
          -run 'TestNative|TestRuntimeInit|TestRuntimePreparationRejects|TestPreparationFreezesLocalContentsAcrossReconnect|TestSnapshotMarker'
      - name: Windows npm and npx stdio launchers without network
        if: runner.os == 'Windows'
        run: >-
          go test -race -count=1 -timeout=2m
          ./apps/daemon/internal/localworkspace
          ./apps/daemon/internal/cli
          -run 'TestWindowsPackageManager|TestWindowsRuntimeMCP'
      - name: Build pinned native components
        run: |
          pnpm --dir packages/claude-sdk-adapter install --frozen-lockfile
          pnpm --dir packages/claude-sdk-adapter build --outDir "$RUNNER_TEMP/claude-compiled"
          pnpm --dir packages/claude-sdk-adapter --config.extend-node-path=false --filter @oac/claude-sdk-adapter deploy --prod "$RUNNER_TEMP/claude-runtime"
          rm -rf "$RUNNER_TEMP/claude-runtime/dist"
          mv "$RUNNER_TEMP/claude-compiled" "$RUNNER_TEMP/claude-runtime/dist"
          # Reify the dedicated frozen export lock without pnpm's symlink layout.
          # Flattening isolated package links changes Node dependency resolution.
          rm -rf "$RUNNER_TEMP/claude-runtime/node_modules"
          pnpm --dir "$RUNNER_TEMP/claude-runtime" install --prod --frozen-lockfile --config.node-linker=hoisted --ignore-scripts
          npm install --prefix "$RUNNER_TEMP/native-tools" --no-save @openai/codex@0.153.4
      - name: Restore or build the pinned MiniMax companion on Unix
        if: runner.os != 'Windows'
        uses: ./.github/actions/mcode-companion
      - name: Package and exercise CLI-only installation, additions and reuse
        id: package
        run: |
          if [[ "$RUNNER_OS" == Windows ]]; then
            export CLAUDE_CODE_GIT_BASH_PATH='C:\Program Files\Git\bin\bash.exe'
          fi
          node scripts/build-native-installer-ci.mjs
      - name: Bootstrap, authenticate, install and connect natively
        id: onboarding
        run: node scripts/native-onboarding-smoke.mjs
      - name: Verify native Harness protocols without model requests
        id: protocol
        run: |
          if [[ "$RUNNER_OS" == Windows ]]; then
            export CLAUDE_CODE_GIT_BASH_PATH='C:\Program Files\Git\bin\bash.exe'
          fi
          node scripts/native-harness-smoke.mjs --codex-binary "$RUNNER_TEMP/native-installer/components/codex/bin/codex${{ runner.os == 'Windows' && '.exe' || '' }}" --claude-runtime "$RUNNER_TEMP/native-installer/components/claude"
      - name: Archive the native distribution
        run: |
          cd "$RUNNER_TEMP"
          tar -C native-installer -czf "oac-native-installer-${{ runner.os }}-${{ runner.arch }}.tar.gz" .
      - uses: actions/upload-artifact@v6
        if: inputs.upload-artifacts
        with:
          name: oac-native-installer-${{ runner.os }}-${{ runner.arch }}
          path: ${{ runner.temp }}/oac-native-installer-*.tar.gz
          if-no-files-found: error
          retention-days: 7
          compression-level: 0
      - name: Record failed native check phases
        if: failure()
        env:
          PHASES: ${{ toJSON(steps) }}
          PLATFORM: ${{ matrix.platform }}
        run: |
          node --input-type=module <<'JS'
          import { mkdirSync, writeFileSync } from 'node:fs';
          import { join } from 'node:path';
          const dir = join(process.env.RUNNER_TEMP, 'native-ci-diagnostics');
          mkdirSync(dir, { recursive: true });
          const phases = Object.fromEntries(Object.entries(JSON.parse(process.env.PHASES))
            .map(([name, step]) => [name, step.outcome]));
          writeFileSync(join(dir, 'phases.json'), JSON.stringify({ platform: process.env.PLATFORM, phases }, null, 2));
          JS
      - name: Retain native failure diagnostics
        if: failure()
        uses: actions/upload-artifact@v6
        with:
          name: native-diagnostics-${{ matrix.platform }}-${{ github.run_attempt }}
          path: ${{ runner.temp }}/native-ci-diagnostics/
          retention-days: 7
          if-no-files-found: ignore