name: CI

on:
  push:
    branches: [main]
  pull_request:
  schedule:
    - cron: '23 4 * * 1'
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: ci-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

env:
  PYTHONUNBUFFERED: '1'
  PIP_DISABLE_PIP_VERSION_CHECK: '1'

jobs:
  capabilities:
    name: Capabilities and shell quality
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - name: Install shell tools
        run: |
          sudo apt-get update
          sudo apt-get install --yes --no-install-recommends shellcheck jq
      - name: Check capabilities
        run: bash scripts/check-capabilities.sh
      - name: Validate Bash syntax
        run: git ls-files -z '*.sh' | xargs -0 -r -n1 bash -n
      - name: Lint Bash
        run: shellcheck --severity=warning $(git ls-files '*.sh')

  python:
    name: Python tests and compilation
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - uses: actions/setup-python@82c7e631bb3cdc910f68e0081d67478d79c6982d # v5.6.0
        with:
          python-version: '3.12'
      - name: Compile Python sources
        run: python -m compileall -q scripts shared
      - name: Run Python tests
        run: |
          set -euo pipefail
          for file in scripts/test-*.py; do
            echo "==> $file"
            python "$file"
          done
      - name: Validate generated configuration
        run: python scripts/validate-config.py generated/codex-powershell/config.toml generated/claude-powershell/settings.json

  powershell-on-ubuntu:
    name: PowerShell tests on Ubuntu
    runs-on: ubuntu-latest
    timeout-minutes: 20
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - name: Check PowerShell runtime
        run: pwsh -NoLogo -NoProfile -NonInteractive -Command '$PSVersionTable.PSVersion.ToString()'
      - name: Run PowerShell tests
        shell: pwsh
        run: |
          $ErrorActionPreference = 'Stop'
          ./scripts/check-capabilities.ps1
          Get-ChildItem scripts/test-*.ps1 | ForEach-Object {
            Write-Host "==> $($_.Name)"
            & $_.FullName -Summary
          }

  build:
    name: Build and inspect generated packages
    runs-on: ubuntu-latest
    timeout-minutes: 15
    needs: [capabilities, python]
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - name: Build packages
        env:
          REQUIRE_CODEX_SCHEMA: 'false'
        run: bash scripts/build.sh --summary
      - name: Run build validation
        run: bash scripts/test-build-validation.sh --summary
      - name: Check generated files are reproducible
        run: |
          before=$(find generated -type f -print0 | sort -z | xargs -0 sha256sum)
          bash scripts/build.sh --summary
          after=$(find generated -type f -print0 | sort -z | xargs -0 sha256sum)
          test "$before" = "$after"