name: CI

on:
  push:
    branches: [main]
  pull_request:
  schedule:
    - cron: '23 4 * * 1'
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: ci-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

env:
  PYTHONUNBUFFERED: '1'
  PIP_DISABLE_PIP_VERSION_CHECK: '1'

jobs:
  capabilities:
    name: Capabilities and shell quality
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Install shell tools
        run: |
          sudo apt-get update
          sudo apt-get install --yes --no-install-recommends shellcheck jq
      - name: Check capabilities
        run: bash scripts/commands/check-capabilities.sh
      - name: Validate Bash syntax
        run: git ls-files -z '*.sh' | xargs -0 -r -n1 bash -n
      - name: Lint Bash
        run: shellcheck --severity=warning $(git ls-files '*.sh')

  python:
    name: Python tests and compilation
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: '3.12'
      - name: Compile Python sources
        run: python -m compileall -q scripts shared
      - name: Run Python tests
        run: |
          set -euo pipefail
          for file in scripts/tests/test-*.py; do
            echo "==> $file"
            python "$file"
          done
      - name: Validate generated configuration
        run: python scripts/checks/validate-config.py generated/codex-powershell/config.toml generated/claude-powershell/settings.json

  powershell-on-ubuntu:
    name: PowerShell tests on Ubuntu
    runs-on: ubuntu-latest
    timeout-minutes: 20
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Install PowerShell runtime
        shell: bash
        run: |
          set -euo pipefail
          if ! command -v pwsh >/dev/null 2>&1; then
            # Microsoft's signed apt repository; the job fails when PowerShell cannot be installed.
            . /etc/os-release
            wget -q -O "$RUNNER_TEMP/packages-microsoft-prod.deb" "https://packages.microsoft.com/config/$ID/$VERSION_ID/packages-microsoft-prod.deb"
            sudo dpkg -i "$RUNNER_TEMP/packages-microsoft-prod.deb"
            sudo apt-get update
            sudo apt-get install --yes --no-install-recommends powershell
          fi
          pwsh -NoLogo -NoProfile -NonInteractive -Command '$PSVersionTable.PSVersion.ToString()'
      - name: Run PowerShell tests
        shell: bash
        run: |
          set -euo pipefail
          pwsh -NoLogo -NoProfile -NonInteractive -File ./scripts/commands/check-capabilities.ps1
          pwsh -NoLogo -NoProfile -NonInteractive -File ./scripts/commands/build.ps1 -Summary
          for file in scripts/tests/test-*.ps1; do
            echo "==> $file"
            pwsh -NoLogo -NoProfile -NonInteractive -File "$file" -Summary
          done

  build:
    name: Build and inspect generated packages
    runs-on: ubuntu-latest
    timeout-minutes: 15
    needs: [capabilities, python]
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Build packages
        env:
          REQUIRE_CODEX_SCHEMA: 'false'
        run: bash scripts/commands/build.sh --summary
      - name: Run build validation
        run: bash scripts/tests/test-build-validation.sh --summary
      - name: Check generated files are reproducible
        run: |
          before=$(find generated -type f -print0 | sort -z | xargs -0 sha256sum)
          bash scripts/commands/build.sh --summary
          after=$(find generated -type f -print0 | sort -z | xargs -0 sha256sum)
          test "$before" = "$after"

  shell-integration:
    name: Bash integration and installation guards
    runs-on: ubuntu-latest
    timeout-minutes: 25
    needs: [build]
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Build packages for integration checks
        env:
          REQUIRE_CODEX_SCHEMA: 'false'
        run: bash scripts/commands/build.sh --summary
      - name: Run integration tests
        run: |
          set -euo pipefail
          bash scripts/tests/test-install-guards.sh --summary
          bash scripts/tests/test-plugin-selection.sh --summary
          bash scripts/tests/test-quick-update.sh --summary
          bash scripts/tests/test-managed-install.sh --summary
          bash scripts/tests/test-shell-packages.sh --summary
          bash scripts/tests/test-runtime-status.sh --summary
          bash scripts/tests/test-install-selections.sh --summary
          bash scripts/tests/test-command-summaries.sh --summary
      - name: Run doctor and prompt budget checks
        run: |
          bash scripts/commands/doctor.sh --summary
          bash scripts/commands/prompt-budget.sh --summary
      - name: Verify dry-run installation safety
        run: |
          bash scripts/commands/install.sh --summary --dry-run --client both --shell bash
          bash scripts/commands/update.sh --summary --dry-run --client both --shell bash

  client-smoke:
    name: Installed client configuration smoke tests
    runs-on: ubuntu-latest
    timeout-minutes: 20
    needs: [build]
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: '3.12'
      - name: Build packages
        run: bash scripts/commands/build.sh --summary
      - uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v22.16.0
        with:
          node-version: '24'
      - name: Install current client CLIs
        run: npm install --global @openai/codex @anthropic-ai/claude-code
      - name: Install Claude sandbox dependencies
        run: |
          sudo apt-get update
          sudo apt-get install --yes --no-install-recommends bubblewrap socat
      - name: Validate current Codex and Claude settings
        run: |
          set -euo pipefail
          schema_home=$(mktemp -d)
          cp generated/codex-powershell/config.toml "$schema_home/config.toml"
          CODEX_HOME="$schema_home" codex --strict-config --help >/dev/null
          claude --settings generated/claude-powershell/settings.json --help >/dev/null
      - name: Run client behavior smoke tests
        env:
          AI_CONFIG_REQUIRE_CLIENTS: '1'
        run: timeout 900 python scripts/tests/test-client-smoke.py -v

  qmd:
    name: QMD local search integration
    runs-on: ubuntu-latest
    timeout-minutes: 45
    needs: [python]
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v22.16.0
        with:
          node-version: '24'
      - name: Install QMD
        run: npm install --global @tobilu/qmd@2.8.3
      - name: Run QMD unit tests
        run: node --test scripts/tests/test-qmd-lib.mjs scripts/tests/test-qmd-daemon.mjs scripts/tests/test-qmd-search.mjs scripts/tests/test-qmd-warm.mjs scripts/tests/test-qmd-benchmark.mjs
      - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: .cache/qmd-models
          key: qmd-models-${{ runner.os }}-2.8.3-qwen3
      - name: Run QMD integration test with real models
        env:
          QMD_TEST_CACHE: ${{ github.workspace }}/.cache/qmd-models
        run: node --test scripts/tests/test-qmd-integration.mjs

  security:
    name: CI configuration security checks
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Reject unsafe workflow settings
        run: |
          set -euo pipefail
          unsafe_patterns='runs-on:[[:space:]]*windows|pull_request_'
          unsafe_patterns+='target|permissions:[[:space:]]*write-all|actions/checkout@'
          unsafe_patterns+='v|actions/setup-python@'
          unsafe_patterns+='v|curl[[:space:]].*\|[[:space:]]*(bash|sh)|wget[[:space:]].*\|[[:space:]]*(bash|sh)'
          ! grep -RInE "$unsafe_patterns" .gitea/workflows
          test "$(grep -Roh 'runs-on: ubuntu-latest' .gitea/workflows | wc -l)" -ge 1
          test "$(grep -Roh 'uses: actions/[^@]*@[0-9a-f]\{40\}' .gitea/workflows | wc -l)" -ge 1
      - name: Check for tracked secrets
        run: |
          set -euo pipefail
          if git ls-files | grep -E '(^|/)(\.env($|\.)|.*\.(pem|key))$'; then
            echo 'Potential secret file or private key tracked' >&2
            exit 1
          fi
          if git ls-files -z | xargs -0 -r grep -IlE 'BEGIN (RSA|OPENSSH|EC) PRIVATE KEY'; then
            echo 'Potential private key material tracked' >&2
            exit 1
          fi