ci.yml

name: CI

on:
  pull_request:
  push:
    branches:
      - main

concurrency:
  group: ci-${{ github.event.pull_request.number || github.sha }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

jobs:
  check:
    name: Check
    runs-on: blacksmith-8vcpu-ubuntu-2404
    timeout-minutes: 10
    steps:
      - name: Checkout
        uses: actions/checkout@v6
        with:
          sparse-checkout: |
            /*
            !/.repos/
          sparse-checkout-cone-mode: false

      - name: Reject repository-owned PR assets
        run: |
          files="$(git ls-files .github/pr-assets)"
          if test -n "$files"; then
            printf 'PR evidence must be uploaded to GitHub, not committed:\n%s\n' "$files" >&2
            exit 1
          fi

      - name: Setup Vite+
        uses: voidzero-dev/setup-vp@v1
        with:
          node-version-file: package.json
          cache: true
          run-install: true

      - name: Ensure Electron runtime is installed
        run: vp run --filter @t3tools/desktop ensure:electron

      - name: Check
        run: vp check

      - name: Typecheck
        run: vpr typecheck

      - name: Build desktop pipeline
        run: vp run build:desktop

      - name: Verify preload bundle output
        run: |
          test -f apps/desktop/dist-electron/preload.cjs
          grep -nE "desktopBridge|getLocalEnvironmentBootstrap|PICK_FOLDER_CHANNEL|wsUrl" apps/desktop/dist-electron/preload.cjs
          grep -n "__clerk_internal_electron_passkeys" apps/desktop/dist-electron/preload.cjs

  # Everything except `t3` (apps/server). `--parallel` drops the package
  # dependency ordering that `vp run` applies by default: these `test` tasks
  # declare no `dependsOn` and resolve workspace deps from source, so ordering
  # only bought us idle runners between dependency layers. The concurrency
  # limit stays at the default 4 so peak load per runner is unchanged.
  test:
    name: Test
    runs-on: blacksmith-8vcpu-ubuntu-2404
    timeout-minutes: 10
    steps:
      - name: Checkout
        uses: actions/checkout@v6
        with:
          sparse-checkout: |
            /*
            !/.repos/
          sparse-checkout-cone-mode: false

      - name: Setup Vite+
        uses: voidzero-dev/setup-vp@v1
        with:
          node-version-file: package.json
          cache: true
          run-install: true

      - name: Ensure Electron runtime is installed
        run: vp run --filter @t3tools/desktop ensure:electron

      - name: Test
        run: vp run --parallel --concurrency-limit 4 --filter '!t3' --filter '!@t3tools/monorepo' test

  # apps/server sets `fileParallelism: false`, so its 239 files run strictly
  # one at a time. Sharding spreads them over separate runners instead of
  # separate workers, so no two server test files ever share a machine and the
  # isolation that flag buys is preserved exactly.
  test_server:
    name: Test Server ${{ matrix.shard }}
    runs-on: blacksmith-8vcpu-ubuntu-2404
    timeout-minutes: 10
    strategy:
      fail-fast: false
      matrix:
        shard: [1, 2, 3]
    steps:
      - name: Checkout
        uses: actions/checkout@v6
        with:
          sparse-checkout: |
            /*
            !/.repos/
          sparse-checkout-cone-mode: false

      - name: Setup Vite+
        uses: voidzero-dev/setup-vp@v1
        with:
          node-version-file: package.json
          cache: true
          run-install: true

      # No Electron setup here: `t3` (apps/server) has no Electron dependency
      # and none of its tests touch the runtime. Only the non-server `test`
      # job, which covers @t3tools/desktop, needs the download.
      - name: Test
        env:
          T3CODE_TRANSFER_BUDGET_REPORT_PATH: ${{ runner.temp }}/t3code-transfer-budget.md
          T3CODE_TRANSFER_BUDGET_RESULT_PATH: ${{ runner.temp }}/thread-transfer-result.json
        run: vp run --filter t3 test --shard ${{ matrix.shard }}/${{ strategy.job-total }}

      # src/server.test.ts writes the budget report, so exactly one shard
      # produces these files. Gating the upload on their presence keeps a
      # single `thread-transfer-results` artifact per run, which is the name
      # thread-transfer-report.yml resolves.
      - name: Detect transfer budget report
        id: transfer_budget
        if: always()
        run: |
          if test -f "${{ runner.temp }}/thread-transfer-result.json"; then
            echo "present=true" >> "$GITHUB_OUTPUT"
          else
            echo "present=false" >> "$GITHUB_OUTPUT"
          fi

      - name: Publish transfer budget report
        if: always() && steps.transfer_budget.outputs.present == 'true'
        run: |
          if test -f "${{ runner.temp }}/t3code-transfer-budget.md"; then
            tee -a "$GITHUB_STEP_SUMMARY" < "${{ runner.temp }}/t3code-transfer-budget.md"
          else
            echo "Transfer budget report was not produced." >> "$GITHUB_STEP_SUMMARY"
          fi

      - name: Upload thread transfer result
        if: always() && steps.transfer_budget.outputs.present == 'true'
        uses: actions/upload-artifact@v7
        with:
          name: thread-transfer-results
          path: ${{ runner.temp }}/thread-transfer-result.json
          if-no-files-found: ignore
          retention-days: 30

  # Split out of Check and Test: both paid ~7-9s to install a Rust toolchain
  # for checks that take under 3s, on the critical path of every PR.
  rust:
    name: Rust
    runs-on: blacksmith-4vcpu-ubuntu-2404
    timeout-minutes: 10
    steps:
      - name: Checkout
        uses: actions/checkout@v6
        with:
          sparse-checkout: |
            /*
            !/.repos/
          sparse-checkout-cone-mode: false

      - name: Setup Rust
        uses: dtolnay/rust-toolchain@stable
        with:
          components: rustfmt

      - name: Check resource monitor formatting
        run: cargo fmt --manifest-path native/resource-monitor/Cargo.toml -- --check

      - name: Test resource monitor
        run: cargo test --locked --manifest-path native/resource-monitor/Cargo.toml

  # The static analysis below needs a macOS runner, which bills ~6.7x a Linux
  # minute, so gate it on the native sources it actually lints instead of paying
  # for it on every push. Detection is API-only (no checkout) and fails open: if
  # the diff cannot be resolved, the lint runs.
  mobile_native_changes:
    name: Mobile Native Changes
    runs-on: blacksmith-2vcpu-ubuntu-2404
    timeout-minutes: 5
    permissions:
      contents: read
      pull-requests: read
    outputs:
      changed: ${{ steps.detect.outputs.changed }}
    steps:
      - name: Detect mobile native changes
        id: detect
        env:
          GH_TOKEN: ${{ github.token }}
          PR_NUMBER: ${{ github.event.pull_request.number }}
          BEFORE_SHA: ${{ github.event.before }}
        run: |
          set -uo pipefail

          fail_open() {
            echo "$* Running native static analysis."
            echo "changed=true" >> "$GITHUB_OUTPUT"
            exit 0
          }

          count_rows() {
            printf '%s\n' "$1" | grep -c . || true
          }

          # One row per changed file, holding the new path and, for a rename,
          # the path it replaced: renaming a matched file out of the matched
          # paths removes a lint input just like editing it.
          row='[.filename, (.previous_filename // empty)] | @tsv'

          if [[ -n "${PR_NUMBER}" ]]; then
            # The PR files endpoint stops at 3000 files and pagination cannot
            # extend it, so cross-check against the count the PR itself reports.
            expected=$(gh api "repos/${GITHUB_REPOSITORY}/pulls/${PR_NUMBER}" --jq '.changed_files') \
              || fail_open "Could not read the pull request."
            rows=$(gh api "repos/${GITHUB_REPOSITORY}/pulls/${PR_NUMBER}/files" --paginate --jq ".[] | ${row}") \
              || fail_open "Could not resolve changed files."

            listed=$(count_rows "$rows")
            if [[ "$listed" -lt "$expected" ]]; then
              fail_open "GitHub listed only ${listed} of ${expected} changed files."
            fi
          else
            rows=$(gh api "repos/${GITHUB_REPOSITORY}/compare/${BEFORE_SHA}...${GITHUB_SHA}" --jq ".files[]? | ${row}") \
              || fail_open "Could not resolve changed files."

            # The compare endpoint reports at most 300 files and pagination does
            # not extend that list, so a full list may be hiding native changes.
            listed=$(count_rows "$rows")
            if [[ "$listed" -ge 300 ]]; then
              fail_open "GitHub listed ${listed} changed files, the compare endpoint maximum."
            fi
          fi

          paths=$(tr '\t' '\n' <<< "$rows")

          # Sources scripts/mobile-native-static-check.ts lints, plus the tool
          # and rule configuration that decides how it lints them, plus the
          # root package.json that defines the lint:mobile command.
          pattern='^apps/mobile/.*\.(swift|kt|kts)$|^apps/mobile/(\.swiftlint\.yml|detekt\.yml|\.editorconfig|Brewfile)$|^scripts/mobile-native-static-check\.ts$|^package\.json$|^\.github/workflows/ci\.yml$'

          if grep -qE "$pattern" <<< "$paths"; then
            echo "Native sources or lint configuration changed:"
            grep -E "$pattern" <<< "$paths"
            echo "changed=true" >> "$GITHUB_OUTPUT"
          else
            echo "No mobile native sources or lint configuration changed."
            echo "changed=false" >> "$GITHUB_OUTPUT"
          fi

  mobile_native_static_analysis:
    name: Mobile Native Static Analysis
    needs: mobile_native_changes
    # Skip only on an explicit "no": a gate job that failed or errored leaves the
    # output empty, and that must run the lint rather than silently skip it.
    if: ${{ !cancelled() && needs.mobile_native_changes.outputs.changed != 'false' }}
    runs-on: blacksmith-6vcpu-macos-26
    timeout-minutes: 10
    steps:
      - name: Checkout
        uses: actions/checkout@v6
        with:
          sparse-checkout: |
            /*
            !/.repos/
          sparse-checkout-cone-mode: false

      - name: Setup Vite+
        uses: voidzero-dev/setup-vp@v1
        with:
          node-version-file: package.json
          cache: true
          run-install: |
            args:
              - --filter=@t3tools/scripts...

      - name: Install mobile native static analysis tools
        run: brew bundle install --file apps/mobile/Brewfile

      - name: Lint mobile native sources
        run: vp run lint:mobile

  release_smoke:
    name: Release Smoke
    runs-on: blacksmith-8vcpu-ubuntu-2404
    timeout-minutes: 10
    steps:
      - name: Checkout
        uses: actions/checkout@v6
        with:
          sparse-checkout: |
            /*
            !/.repos/
          sparse-checkout-cone-mode: false

      - name: Setup Vite+
        uses: voidzero-dev/setup-vp@v1
        with:
          node-version-file: package.json
          cache: true
          run-install: |
            args:
              - --filter=@t3tools/scripts...

      - name: Exercise release-only workflow steps
        run: node scripts/release-smoke.ts