build.yml

name: Feature Branch Libraries build

on:
  push:
    branches: [ main, develop ]
  pull_request:
    branches: [ main, develop ]

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

# Set all permissions to none
permissions: {}

jobs:
  # `allTests` used to run in a single job alongside `assemble`. On a 7 GB
  # ubuntu-latest runner the combined peak RSS (Gradle JVM + Kotlin daemon +
  # per-target test forks + Node for JS/Wasm + the native toolchain, all at
  # once) intermittently exceeded physical memory. The runner was then
  # OOM-killed and GitHub reported "The operation was canceled" after ~15 min
  # with no BUILD FAILED — the flaky ~20-minute reds.
  #
  # Splitting the test matrix so each leg runs one target family keeps every
  # job's memory well under the runner limit, and the legs run in parallel so
  # wall-clock is the slowest single leg rather than the sum. `assemble` runs
  # as its own (memory-light) job.
  test:
    name: test (${{ matrix.name }})
    runs-on: ubuntu-latest
    timeout-minutes: 40
    strategy:
      fail-fast: false
      matrix:
        include:
          - name: jvm
            # Plain-JVM modules (the skainet-plan CLI, the engine benchmark publisher) have a
            # `test` task rather than `jvmTest`, so the repo-wide jvmTest never reaches them.
            tasks: >-
              jvmTest
              :skainet-apps:skainet-plan:test
              :skainet-backends:benchmarks:jvm-cpu-publish:test
            # This leg runs nearly every module's jvmTest, each forking its own 8g-heap Test JVM
            # (build.gradle.kts `maxHeapSize`). ci-gradle.properties caps org.gradle.workers.max=2
            # repo-wide; this leg goes fully serial so at most one 8g fork runs next to the 4g
            # Gradle client JVM (GRADLE_OPTS below) on the 16 GB runner.
            #
            # History: the 40-minute reds after SKEEP-005 (#1262) were NOT memory — the runner had
            # 11 GB free when the job was killed. `CoroutineSchedule.forRange` blocked a
            # Dispatchers.Default worker on children that needed the same 4-thread pool, so
            # `skainet-backend-cpu:jvmTest` deadlocked in CoroutineScheduleTest on the 4-vCPU
            # runner. Fixed in the schedule itself; the serial setting stays for memory headroom.
            extraGradleArgs: -Dorg.gradle.workers.max=1
          # verifyNpmPins guards the npm-* pins in gradle/libs.versions.toml against
          # lockfile drift; it belongs on the leg that already has the JS toolchain.
          - name: js-wasm
            tasks: verifyNpmPins jsTest wasmJsTest wasmWasiTest
          - name: native
            tasks: linuxX64Test
          # Host-side (JVM) unit tests of the *Android* compilations: the mmap weight path (#921)
          # and the Android loading facade + device fit check (#1038, SKEEP-002). They compile
          # against androidMain, so no other leg proves that code builds — assemble compiles it but
          # runs nothing.
          - name: android
            tasks: testAndroidHostTest
          # golden-parity: the SKEEP-003 packed-encoding gate (#1005). Bit-identical decode /
          # scalar-kernel / TurboQuant digests on JVM and Kotlin/Native plus the dispatch parity
          # tests. Fast (a few minutes) so it fails early.
          - name: golden-parity
            tasks: >-
              :skainet-backends:skainet-backend-cpu:jvmTest --tests sk.ainet.exec.golden.*
              :skainet-backends:skainet-backend-cpu:linuxX64Test --tests sk.ainet.exec.golden.*
          # api-compatibility: the binary-compatibility check the contributing docs require but the
          # per-target test legs do not run. Its own leg — not folded into golden-parity — so a
          # stale api dump reads as "api-compatibility ✘" instead of a red parity leg nobody
          # associates with dumps (#1171 merged a stale dump exactly that way; #1174 repaired it).
          - name: api-compatibility
            tasks: apiCheck

    permissions:
      contents: read

    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Copy CI gradle.properties
        run: mkdir -p ~/.gradle ; cp .github/ci-gradle.properties ~/.gradle/gradle.properties

      - name: Set up JDK 25
        uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6.0.1
        with:
          distribution: 'zulu'
          java-version: 25

      - name: Set up Node.js
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: '20'

      # Warm the Gradle dependency/wrapper cache so each parallel leg does not
      # cold-download the full dependency graph. Matches docs.yml.
      - name: Cache Gradle
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: |
            ~/.gradle/caches
            ~/.gradle/wrapper
          key: gradle-${{ runner.os }}-${{ hashFiles('**/*.gradle*', '**/gradle-wrapper.properties', '**/libs.versions.toml') }}
          restore-keys: |
            gradle-${{ runner.os }}-

      - name: Disk space (observability)
        run: df -h

      - name: Test (${{ matrix.name }})
        env:
          GRADLE_OPTS: -Dorg.gradle.jvmargs="-Xmx4g -Dfile.encoding=UTF-8"
        run: |
          ./gradlew --no-daemon --stacktrace \
            -Dorg.gradle.caching=true \
            -Dorg.gradle.configuration-cache=true \
            ${{ matrix.extraGradleArgs }} \
            ${{ matrix.tasks }}

      # `cancelled()` matters: an OOM-killed runner reports the job as
      # cancelled, not failed, so `if: failure()` alone never captured the
      # memory snapshot on exactly the runs we needed it for.
      - name: Memory info (on failure or cancellation)
        if: failure() || cancelled()
        run: |
          free -h || true
          head -n 50 /proc/meminfo || true

      - name: Upload test reports (${{ matrix.name }})
        if: always()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: test-reports-${{ matrix.name }}
          path: |
            **/build/reports/tests/**
            **/build/test-results/**
          retention-days: 14

  assemble:
    name: assemble
    runs-on: ubuntu-latest
    timeout-minutes: 40

    permissions:
      contents: read
      
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Copy CI gradle.properties
        run: mkdir -p ~/.gradle ; cp .github/ci-gradle.properties ~/.gradle/gradle.properties

      - name: Set up JDK 25
        uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6.0.1
        with:
          distribution: 'zulu'
          java-version: 25

      - name: Set up Node.js
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: '20'

      - name: Cache Gradle
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: |
            ~/.gradle/caches
            ~/.gradle/wrapper
          key: gradle-${{ runner.os }}-${{ hashFiles('**/*.gradle*', '**/gradle-wrapper.properties', '**/libs.versions.toml') }}
          restore-keys: |
            gradle-${{ runner.os }}-

      - name: Assemble
        env:
          GRADLE_OPTS: -Dorg.gradle.jvmargs="-Xmx4g -Dfile.encoding=UTF-8"
        run: |
          ./gradlew --no-daemon --stacktrace \
            -Dorg.gradle.caching=true \
            -Dorg.gradle.configuration-cache=true \
            assemble

      - name: Memory info (on failure or cancellation)
        if: failure() || cancelled()
        run: |
          free -h || true
          head -n 50 /proc/meminfo || true

  # Aggregate gate. Branch protection references the single "build-job" check;
  # keeping a job with that exact name (now backed by the parallel test matrix
  # + assemble) preserves the required-status-check contract without needing to
  # re-point branch protection. Fails if any dependency did not succeed.
  build-job:
    name: build-job
    needs: [ test, assemble ]
    if: always()
    runs-on: ubuntu-latest
    steps:
      - name: Verify test matrix and assemble succeeded
        run: |
          echo "test result:     ${{ needs.test.result }}"
          echo "assemble result: ${{ needs.assemble.result }}"
          if [ "${{ needs.test.result }}" != "success" ] || [ "${{ needs.assemble.result }}" != "success" ]; then
            echo "::error::One or more build jobs did not succeed (see the test/assemble jobs above)."
            exit 1
          fi
          echo "All build jobs succeeded."