ci.yml

name: Journal CI

on:
  workflow_call:
    inputs:
      sqlite-profile:
        type: string
        default: brew
  pull_request:
  push:
    branches: [main]

# Only a newer head for this PR supersedes its old run. Main and controlled
# comparisons use unique run groups and cannot cancel one another.
concurrency:
  group: ${{ github.workflow }}-${{ github.event_name == 'pull_request' && format('pr-{0}', github.event.pull_request.number) || format('{0}-{1}', github.ref, github.run_id) }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' && github.event.action == 'synchronize' }}

permissions:
  contents: read

jobs:
  build-and-test:
    # The production transport explicitly requires Apple DNS-SD.
    runs-on: macos-latest
    timeout-minutes: 60
    env:
      CI_SQLITE_PROFILE: ${{ inputs.sqlite-profile || 'brew' }}
      CI_COMPILER: ocaml-base-compiler.5.5.0
      # This commit binds compiler source checksums, patches, build commands and
      # every repository package recipe. Update deliberately with the toolchain.
      CI_OPAM_REPOSITORY: git+https://github.com/ocaml/opam-repository.git#7b5e9a2b084fe7ff750c4a9449289065ef9f9216
      CI_OPAM_VERSION: 2.6.1
      HOMEBREW_NO_AUTO_UPDATE: 1
      OPAMJOBS: 3
      OPAMEXTERNALSOLVER: builtin-0install
      OPAMPRECISETRACKING: 1
    steps:
      - uses: actions/checkout@v4
      - name: Verify Apple app icon packaging
        run: python3 .agents/skills/journal-build/scripts/test_apple_app_icon.py
      - name: Prepare native system libraries before cache lookup
        run: |
          brew install pkg-config gmp sqlite zlib zstd
          echo "PKG_CONFIG_PATH=$(brew --prefix gmp)/lib/pkgconfig:$(brew --prefix sqlite)/lib/pkgconfig:$(brew --prefix zlib)/lib/pkgconfig:$(brew --prefix zstd)/lib/pkgconfig" >> "$GITHUB_ENV"
      - name: Prepare optional controlled SQLite provider
        run: python3 .agents/skills/journal-build/scripts/prepare_ci_sqlite.py
      - name: Resolve declared dependency sources
        run: python3 .agents/skills/journal-build/scripts/prepare_ci_dependencies.py
      - name: Identify dependency build inputs before compiler setup
        id: dependency-identity
        run: |
          python3 .agents/skills/journal-build/scripts/prepare_ci_dependencies.py --cache-identity
          python3 - <<'PY'
          import json, os
          from pathlib import Path
          report = json.loads(Path('.ci-reports/opam-cache.json').read_text())
          with open(os.environ['GITHUB_OUTPUT'], 'a') as output:
              print('prefix=' + report['identity']['opam_prefix'], file=output)
              print('root=' + report['identity']['opam_root'], file=output)
              print('key=' + report['key'], file=output)
              print('native-key=' + report['native_key'], file=output)
          PY
      # This small, data-only record explains misses outside the compatible
      # switch family. It never authorizes executable state restoration.
      - name: Restore prior input record for miss diagnostics
        id: input-cache
        uses: actions/cache/restore@v4
        continue-on-error: true
        with:
          path: .ci-reports/cache-candidate
          key: journal-opam-input-v4-${{ runner.os }}-${{ runner.arch }}-${{ steps.dependency-identity.outputs.key }}-${{ steps.dependency-identity.outputs.native-key }}
          restore-keys: journal-opam-input-v4-${{ runner.os }}-${{ runner.arch }}-
      - name: Restore compiler, installed dependencies and opam metadata
        id: dependency-cache
        uses: actions/cache/restore@v4
        continue-on-error: true
        with:
          path: |
            ${{ steps.dependency-identity.outputs.prefix }}
            ${{ steps.dependency-identity.outputs.root }}
          # Prefix fallback is confined to the same compiler/SDK/lock family.
          # Native provider differences require receipt + real link/runtime probes.
          key: journal-opam-v4-${{ runner.os }}-${{ runner.arch }}-${{ steps.dependency-identity.outputs.key }}-${{ steps.dependency-identity.outputs.native-key }}
          restore-keys: journal-opam-v4-${{ runner.os }}-${{ runner.arch }}-${{ steps.dependency-identity.outputs.key }}-
      - name: Validate restored cache or select a clean cold setup
        env:
          CI_CACHE_HIT: ${{ steps.dependency-cache.outputs.cache-hit }}
          CI_CACHE_MATCHED_KEY: ${{ steps.dependency-cache.outputs.cache-matched-key }}
        run: python3 .agents/skills/journal-build/scripts/prepare_ci_dependencies.py --validate-cache
      # Pinned because its provisioning behavior participates in the input key.
      - uses: ocaml/setup-ocaml@93303b622b2522e4411e295f9e77411a24912ac7 # v3
        with:
          ocaml-compiler: ${{ env.CI_COMPILER }}
          opam-repositories: |
            default: ${{ env.CI_OPAM_REPOSITORY }}
          cache: false
      - name: Pin resolved checkouts after cache restoration
        run: python3 .agents/skills/journal-build/scripts/prepare_ci_dependencies.py --pin
      - name: Verify native system dependencies on the fresh runner
        run: opam install . --deps-only --with-test --locked --ignore-pin-depends --depext-only --yes
      - name: Probe restored native bindings and repair incompatible packages only
        run: python3 .agents/skills/journal-build/scripts/prepare_ci_dependencies.py --check-native-cache
      - name: Install locked dependencies
        run: opam install . --deps-only --with-test --locked --ignore-pin-depends --yes
      - name: Verify build and cache helper boundaries
        env:
          # Apple CLI boundary fixtures deliberately reject ambient pkg-config.
          # The CI identity fixture selects its own explicit providers.
          PKG_CONFIG_PATH: ''
          JOURNAL_TEST_SWITCH: ${{ github.workspace }}
          PYTHONDONTWRITEBYTECODE: 1
        run: python3 .agents/skills/journal-build/scripts/test_journal_build.py
      - name: Record installed package versions
        if: always()
        run: opam list --installed --columns=name,installed-version --short --color=never > .ci-reports/packages.txt
      - name: Build all targets and native embed
        run: |
          opam exec -- dune build @all app/native_embed.exe.o
      - name: Run full regression suite
        run: opam exec -- dune runtest --force
      - name: Verify final cache inputs and seal installed state
        run: python3 .agents/skills/journal-build/scripts/prepare_ci_dependencies.py --seal-cache
      - name: Save compiler, installed dependencies and opam metadata
        if: success() && steps.dependency-cache.outputs.cache-hit != 'true'
        uses: actions/cache/save@v4
        with:
          path: |
            ${{ steps.dependency-identity.outputs.prefix }}
            ${{ steps.dependency-identity.outputs.root }}
          key: journal-opam-v4-${{ runner.os }}-${{ runner.arch }}-${{ steps.dependency-identity.outputs.key }}-${{ steps.dependency-identity.outputs.native-key }}
      - name: Save successful input record for miss diagnostics
        if: success() && steps.input-cache.outputs.cache-hit != 'true'
        uses: actions/cache/save@v4
        with:
          path: .ci-reports/cache-candidate
          key: journal-opam-input-v4-${{ runner.os }}-${{ runner.arch }}-${{ steps.dependency-identity.outputs.key }}-${{ steps.dependency-identity.outputs.native-key }}
      - name: Upload resolved dependencies and test logs
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: journal-ci-evidence${{ inputs.sqlite-profile && format('-{0}', inputs.sqlite-profile) || '' }}
          include-hidden-files: true
          if-no-files-found: error
          path: |
            .ci-reports/
            _build/default/**/_build/_tests/
            _build/_tests/