ci.yml

name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
  workflow_dispatch:

env:
  DEVCONTAINERS_CLI_VERSION: 0.80.2
  GITLEAKS_VERSION: 8.30.1
  GO_VERSION: '1.26.6'

permissions:
  contents: read

concurrency:
  group: ci-${{ github.ref }}
  # Keep main CI runs alive so every successful main merge can trigger production deploy.
  # Pull request runs still cancel superseded commits for faster feedback.
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

jobs:
  changes:
    name: Detect Changes
    # Fork bypass: on a push to main in a fork (self-host), skip the canonical
    # repo's full CI suite. Pull requests always run CI (any repo), and the
    # canonical repo always runs CI. Fork operators update their running SAM
    # instance by manually running Deploy Production on main; the workflow_run
    # production deploy path is for the canonical repository's successful CI.
    # Because every other job depends on `changes` (directly via `needs`, or
    # explicitly via this same guard), skipping `changes` cascades a skip across
    # the whole workflow.
    if: github.event_name == 'pull_request' || github.repository == 'raphaeltm/simple-agent-manager'
    timeout-minutes: 5
    runs-on: ubuntu-latest
    outputs:
      vm-agent: ${{ steps.filter.outputs.vm-agent }}
      cli: ${{ steps.filter.outputs.cli }}
      devcontainer: ${{ steps.filter.outputs.devcontainer }}
      devcontainer-volume-mount: ${{ steps.filter.outputs.devcontainer-volume-mount }}
      web-ui: ${{ steps.filter.outputs.web-ui }}
      go-modules: ${{ steps.filter.outputs.go-modules }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: dorny/paths-filter@ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d # v4.0.3
        id: filter
        with:
          filters: |
            vm-agent:
              - 'packages/vm-agent/**'
              - '.github/workflows/ci.yml'
            cli:
              - 'packages/cli/**'
              - 'sonar-project.properties'
              - '.claude/rules/36-cli-quality.md'
              - '.github/workflows/ci.yml'
            devcontainer:
              - '.devcontainer/**'
              - '.github/workflows/ci.yml'
            devcontainer-volume-mount:
              - '.devcontainer/**'
              - 'scripts/ci/**'
              - 'packages/vm-agent/**'
              - 'packages/cloud-init/**'
              - '.github/workflows/ci.yml'
            web-ui:
              - 'apps/web/**'
              - 'packages/ui/**'
              - 'packages/terminal/**'
              - 'packages/acp-client/**'
              - '.github/workflows/ci.yml'
            go-modules:
              - '**/go.mod'
              - '**/go.sum'
              - 'scripts/quality/check-go-vulnerability-diff.ts'
              - '.github/workflows/ci.yml'

  preflight-evidence:
    name: Preflight Evidence
    if: github.event_name == 'pull_request'
    timeout-minutes: 15
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10

      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: '22'
          cache: 'pnpm'

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      # Preflight evidence documents an agent's pre-implementation research. Dependabot
      # opens PRs from a fixed template and cannot produce that evidence, so the check
      # is unsatisfiable for it and leaves the whole dependency lane permanently red.
      # The stale-binary guard below still runs for every author.
      #
      # Both identities are required. `user.login` is frozen when the PR is opened, and
      # dependabot branches live in this repo rather than a fork, so anyone with push
      # access can add a commit to an open dependabot/** branch without changing it.
      # `github.actor` is the actor of THIS event, so a human push flips it back and the
      # evidence check runs again. Skip only when both say dependabot.
      - name: Validate agent preflight evidence
        if: >-
          github.actor != 'dependabot[bot]' ||
          github.event.pull_request.user.login != 'dependabot[bot]'
        run: pnpm quality:preflight

      - name: Validate no stale binary artifacts are tracked
        run: pnpm quality:no-tracked-stale-binaries

  specialist-review-evidence:
    name: Specialist Review Evidence
    if: github.event_name == 'pull_request'
    timeout-minutes: 15
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10

      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: '22'
          cache: 'pnpm'

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Validate specialist review evidence
        run: pnpm quality:specialist-review

  ui-compliance:
    name: UI Compliance
    if: github.event_name == 'pull_request' || github.repository == 'raphaeltm/simple-agent-manager'
    timeout-minutes: 15
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10

      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: '22'
          cache: 'pnpm'

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Validate UI checklist evidence
        run: node scripts/ci/check-ui-compliance.mjs

  lint:
    name: Lint
    if: github.event_name == 'pull_request' || github.repository == 'raphaeltm/simple-agent-manager'
    timeout-minutes: 15
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0

      - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10

      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: '22'
          cache: 'pnpm'

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Check formatting
        run: pnpm format:check

      - name: Run Oxlint shadow
        run: pnpm lint:oxlint

      - name: Run ESLint authoritative layer
        run: pnpm lint

      - name: Enforce type-boundary ratchet
        run: pnpm quality:type-boundaries

      - name: Run SAM RuleTester fixtures
        run: pnpm --filter @simple-agent-manager/eslint-plugin-sam test

      - name: Shadow SAM fixtures through Oxlint alpha host
        continue-on-error: true
        run: pnpm lint:oxlint:sam-shadow

  secret-scan:
    name: Secret Scan
    if: github.event_name == 'pull_request' || github.repository == 'raphaeltm/simple-agent-manager'
    timeout-minutes: 15
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0

      - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10

      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: '22'
          cache: 'pnpm'

      - name: Install dependencies
        run: pnpm install --frozen-lockfile --ignore-scripts

      - name: Install verified Gitleaks release
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          mkdir -p "$RUNNER_TEMP/gitleaks"
          cd "$RUNNER_TEMP/gitleaks"
          gh release download "v${GITLEAKS_VERSION}" \
            --repo gitleaks/gitleaks \
            --pattern "gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz" \
            --pattern "gitleaks_${GITLEAKS_VERSION}_checksums.txt"
          sha256sum --ignore-missing --check "gitleaks_${GITLEAKS_VERSION}_checksums.txt"
          tar -xzf "gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz"

      - name: Scan current tree
        env:
          SAM_GITLEAKS_BIN: ${{ runner.temp }}/gitleaks/gitleaks
        run: pnpm quality:gitleaks:current

      - name: Scan pull request commit range
        if: github.event_name == 'pull_request'
        env:
          SAM_GITLEAKS_BIN: ${{ runner.temp }}/gitleaks/gitleaks
        run: pnpm quality:gitleaks:pr

  typecheck:
    name: Type Check
    if: github.event_name == 'pull_request' || github.repository == 'raphaeltm/simple-agent-manager'
    timeout-minutes: 15
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10

      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: '22'
          cache: 'pnpm'

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Build packages
        run: pnpm build

      - name: Type check
        run: pnpm typecheck

  test:
    name: Test
    if: github.event_name == 'pull_request' || github.repository == 'raphaeltm/simple-agent-manager'
    timeout-minutes: 15
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10

      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: '22'
          cache: 'pnpm'

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Build packages
        run: pnpm build

      - name: Run tests with coverage
        run: pnpm test:coverage

  build:
    name: Build
    if: github.event_name == 'pull_request' || github.repository == 'raphaeltm/simple-agent-manager'
    timeout-minutes: 15
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10

      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: '22'
          cache: 'pnpm'

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Build all packages
        run: pnpm build

  workspace-quality-surfaces:
    name: Workspace Quality Surfaces
    if: github.event_name == 'pull_request' || github.repository == 'raphaeltm/simple-agent-manager'
    timeout-minutes: 30
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10

      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: '22'
          cache: 'pnpm'

      - name: Install dependencies
        run: pnpm install --frozen-lockfile --ignore-scripts

      - name: Require test coverage scripts for every tested workspace
        run: pnpm quality:workspace-test-surfaces

      - name: Build Storybook production bundle
        run: pnpm --filter @simple-agent-manager/ui build-storybook

      - name: Build public docs and check internal links
        run: pnpm --filter @simple-agent-manager/www build && pnpm --filter @simple-agent-manager/www check:links

      - name: Install Chromium
        working-directory: packages/ui
        run: ./node_modules/.bin/playwright install --with-deps chromium

      - name: Audit Storybook in desktop and mobile browsers
        run: pnpm --filter @simple-agent-manager/ui test:storybook

      - name: Test public site in desktop and mobile browsers
        run: pnpm --filter @simple-agent-manager/www test:browser

      - name: Require complete Storybook and public browser evidence
        run: pnpm quality:browser-evidence

      - name: Upload workspace browser evidence
        if: always()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: workspace-browser-evidence
          path: .codex/tmp/playwright-screenshots/
          if-no-files-found: error
          retention-days: 7

  playwright-visual:
    name: Playwright Visual Tests
    needs: [changes]
    # Visual audits are informational and only relevant to reviewing a change.
    # Restrict to pull requests so they never run on push to main.
    if: github.event_name == 'pull_request' && needs.changes.outputs.web-ui == 'true'
    timeout-minutes: 45
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10

      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: '22'
          cache: 'pnpm'

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Build packages
        run: pnpm build

      - name: Install Playwright browsers
        working-directory: apps/web
        run: npx playwright install --with-deps chromium

      - name: Prepare screenshot output directory
        working-directory: apps/web
        run: mkdir -p ../../.codex/tmp/playwright-screenshots

      - name: Run Playwright visual audit tests
        id: playwright
        continue-on-error: true
        working-directory: apps/web
        run: |
          find tests/playwright \
            -name '*audit*.spec.ts' \
            ! -name 'staging-*.spec.ts' \
            -print0 \
            | xargs -0 npx playwright test \
                --project='iPhone 14 (390x844)' \
                --reporter=list
        env:
          CI: true

      - name: Fail if Playwright timed out
        if: steps.playwright.outcome == 'failure'
        run: |
          echo "::warning::Playwright visual audit tests had failures. See uploaded screenshots for details."
          echo "Visual audit failures are informational — individual test fixes tracked separately."

      - name: Upload screenshots on failure
        if: failure() || steps.playwright.outcome == 'failure'
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: playwright-screenshots
          path: .codex/tmp/playwright-screenshots/
          retention-days: 7

  deploy-scripts:
    name: Validate Deploy Scripts
    if: github.event_name == 'pull_request' || github.repository == 'raphaeltm/simple-agent-manager'
    timeout-minutes: 15
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10

      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: '22'
          cache: 'pnpm'

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Type check deployment scripts
        run: npx tsc --project scripts/deploy/tsconfig.json --noEmit

      - name: Validate script syntax
        run: |
          # Verify scripts can be parsed
          npx tsx --check scripts/deploy/setup-github.ts
          npx tsx --check scripts/deploy/sync-wrangler-config.ts
          npx tsx --check scripts/deploy/generate-keys.ts

      # Deploy/quality script behavior — includes the Durable Object migration
      # compatibility regression suite (clean install vs applied history).
      - name: Run deploy and quality script tests
        run: pnpm quality:scripts:test

      - name: Validate wrangler binding consistency
        run: pnpm quality:wrangler-bindings

      - name: Validate agent install manifest consistency
        run: pnpm quality:agent-install-manifest

  code-quality:
    name: Code Quality Checks
    if: github.event_name == 'pull_request' || github.repository == 'raphaeltm/simple-agent-manager'
    timeout-minutes: 15
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0

      - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10

      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: '22'
          cache: 'pnpm'

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: D1 migration safety check (blocks destructive DROP TABLE)
        run: pnpm quality:migration-safety

      - name: D1 migration ordering check (blocks ambiguous prefixes)
        run: pnpm quality:migration-ordering

      - name: DO migration safety check (blocks destructive patterns in Durable Object SQLite)
        run: pnpm quality:do-migration-safety

      - name: AST-based code quality checks
        run: pnpm quality:ast-checks

      - name: File size limit enforcement
        run: pnpm quality:file-sizes

      - name: Stale artifact check
        run: pnpm quality:stale-artifacts
      - name: Repo quality visibility report
        continue-on-error: true
        run: pnpm quality:repo-visibility

      - name: Source-contract test detection
        run: pnpm quality:source-contract-tests

      - name: Dependency governance pinning check
        run: pnpm quality:dependency-governance

      - name: Workspace test surface completeness
        run: pnpm quality:workspace-test-surfaces

      - name: Direct dependency evidence
        run: pnpm quality:direct-dependency-evidence

      - name: Runtime-boundary semantic check (blocking for apps/api/src)
        run: pnpm quality:runtime-boundary-semantics

      - name: CI workflow wiring tests
        run: pnpm exec vitest run --config scripts/quality/vitest.config.ts ci-quality-program.test.ts ci-worker-suite.test.ts

  go-vulnerability-diff:
    name: Go Vulnerability Diff
    needs: [changes]
    if: needs.changes.outputs.go-modules == 'true'
    timeout-minutes: 20
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0

      - name: Setup Go
        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version: ${{ env.GO_VERSION }}

      - name: Assert Go version
        run: go version | grep -E '^go version go1\.26\.6 '

      - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10

      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: '22'
          cache: 'pnpm'

      - name: Install dependencies
        run: pnpm install --frozen-lockfile --ignore-scripts

      - name: Install govulncheck
        run: |
          mkdir -p "$RUNNER_TEMP/go/bin"
          cd scripts/quality/govulncheck-tool
          go build -o "$RUNNER_TEMP/go/bin/govulncheck" golang.org/x/vuln/cmd/govulncheck

      - name: Scan changed Go modules
        env:
          SAM_GOVULNCHECK_BIN: ${{ runner.temp }}/go/bin/govulncheck
        run: pnpm quality:govulncheck-diff

  durable-object-workers:
    name: Durable Object Workers
    if: github.event_name == 'pull_request' || github.repository == 'raphaeltm/simple-agent-manager'
    timeout-minutes: 15
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10

      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: '22'
          cache: 'pnpm'

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Check Durable Object migration safety
        run: pnpm quality:do-migration-safety

      - name: Build packages
        run: pnpm build

      - name: Run Worker and Durable Object suites
        run: pnpm --filter @simple-agent-manager/api test:workers

  pulumi-infra:
    name: Pulumi Infrastructure Tests
    if: github.event_name == 'pull_request' || github.repository == 'raphaeltm/simple-agent-manager'
    timeout-minutes: 15
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10

      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: '22'
          cache: 'pnpm'

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Type check Pulumi infra
        working-directory: infra
        run: pnpm typecheck

      - name: Run Pulumi unit tests
        working-directory: infra
        run: pnpm test

  vm-agent-test:
    name: VM Agent Test
    needs: [changes]
    if: needs.changes.outputs.vm-agent == 'true'
    timeout-minutes: 15
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Setup Go
        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version: ${{ env.GO_VERSION }}
          cache-dependency-path: packages/vm-agent/go.sum

      - name: Assert Go version
        run: go version | grep -E '^go version go1\.26\.6 '

      - name: Run VM Agent tests
        working-directory: packages/vm-agent
        run: go test -race ./...

  cli-test:
    name: CLI Test
    needs: [changes]
    if: needs.changes.outputs.cli == 'true'
    timeout-minutes: 15
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Setup Go
        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version: ${{ env.GO_VERSION }}

      - name: Assert Go version
        run: go version | grep -E '^go version go1\.26\.6 '

      - name: Run CLI tests
        working-directory: packages/cli
        run: go test -race -coverprofile=coverage.out -covermode=atomic ./...

      - name: Cross-build CLI
        working-directory: packages/cli
        run: make build-all

      - name: Print CLI coverage summary
        working-directory: packages/cli
        run: go tool cover -func=coverage.out

      - name: Upload CLI coverage report
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: cli-go-coverage
          path: packages/cli/coverage.out
          retention-days: 7

  vm-agent-integration:
    name: VM Agent Integration
    needs: [changes]
    if: needs.changes.outputs.vm-agent == 'true'
    runs-on: ubuntu-latest
    timeout-minutes: 20
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Setup Go
        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version: ${{ env.GO_VERSION }}
          cache-dependency-path: packages/vm-agent/go.sum

      - name: Assert Go version
        run: go version | grep -E '^go version go1\.26\.6 '

      - name: Install devcontainers CLI
        run: npm install -g --ignore-scripts "@devcontainers/cli@${DEVCONTAINERS_CLI_VERSION}"

      - name: Prepare devcontainer fixture images
        run: bash scripts/ci/prepare-devcontainer-fixture-images.sh

      - name: Run VM Agent integration tests
        working-directory: packages/vm-agent
        run: go test -race -v -tags integration -timeout 15m ./internal/bootstrap/ ./internal/acp/

  vm-agent-e2e:
    name: VM Agent E2E
    needs: [changes]
    if: needs.changes.outputs.vm-agent == 'true'
    runs-on: ubuntu-latest
    timeout-minutes: 20
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Setup Go
        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version: ${{ env.GO_VERSION }}
          cache-dependency-path: packages/vm-agent/go.sum

      - name: Assert Go version
        run: go version | grep -E '^go version go1\.26\.6 '

      - name: Install devcontainers CLI
        run: npm install -g --ignore-scripts "@devcontainers/cli@${DEVCONTAINERS_CLI_VERSION}"

      - name: Prepare devcontainer fixture images
        run: bash scripts/ci/prepare-devcontainer-fixture-images.sh

      - name: Run VM Agent E2E tests
        working-directory: packages/vm-agent
        run: go test -race -v -tags e2e -timeout 15m ./internal/e2e/

  devcontainer:
    name: Devcontainer Validation
    needs: [changes]
    if: needs.changes.outputs.devcontainer == 'true'
    runs-on: ubuntu-latest
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: '22'

      - name: Install devcontainer CLI
        run: npm install -g --ignore-scripts "@devcontainers/cli@${DEVCONTAINERS_CLI_VERSION}"

      - name: Prepare devcontainer fixture images
        run: bash scripts/ci/prepare-devcontainer-fixture-images.sh

      - name: Validate devcontainer.json syntax
        run: |
          # devcontainer.json supports JSONC (comments + trailing commas)
          # Use node to parse it since JSON.parse doesn't handle comments
          node -e "
            const fs = require('fs');
            const raw = fs.readFileSync('.devcontainer/devcontainer.json', 'utf8');
            // Strip single-line comments and trailing commas before closing braces/brackets
            const stripped = raw
              .replace(/\/\/.*$/gm, '')
              .replace(/,(\s*[}\]])/g, '\$1');
            JSON.parse(stripped);
            console.log('devcontainer.json syntax: OK');
          "

      - name: Build devcontainer image
        run: devcontainer build --workspace-folder .

      - name: Start devcontainer with full lifecycle hooks
        run: |
          set -e

          echo "=== Starting devcontainer (running postCreateCommand + postStartCommand) ==="
          OUTPUT=$(devcontainer up --workspace-folder .)
          echo "$OUTPUT"

          # Extract container ID from JSON output
          CONTAINER_ID=$(echo "$OUTPUT" | jq -r '.containerId // empty' 2>/dev/null || true)
          if [ -z "$CONTAINER_ID" ]; then
            echo "Error: Could not extract container ID from devcontainer up output"
            exit 1
          fi
          echo "Container ID: $CONTAINER_ID"

      - name: Verify devcontainer feature tools
        run: |
          # Tools installed by devcontainer features (docker-in-docker, github-cli, go)
          devcontainer exec --workspace-folder . bash -c '
            set -e
            FAIL=0

            check() {
              local name="$1"
              shift
              if output=$("$@" 2>&1); then
                echo "OK: $name — $output"
              else
                echo "FAIL: $name"
                FAIL=$((FAIL + 1))
              fi
            }

            echo "=== Devcontainer Feature Tools ==="
            check "Node.js"     node --version
            check "npm"         npm --version
            check "pnpm"        pnpm --version
            check "Go"          go version
            check "Docker"      docker --version
            check "GitHub CLI"  gh --version
            check "git"         git --version
            check "curl"        curl --version
            check "jq"          jq --version

            exit $FAIL
          '

      - name: Verify post-create hook tools
        run: |
          # Tools installed by .devcontainer/post-create.sh
          devcontainer exec --workspace-folder . bash -c '
            set -e
            FAIL=0

            check() {
              local name="$1"
              shift
              if output=$("$@" 2>&1); then
                echo "OK: $name — $(echo "$output" | head -1)"
              else
                echo "FAIL: $name"
                FAIL=$((FAIL + 1))
              fi
            }

            optional_check() {
              local name="$1"
              shift
              if output=$("$@" 2>&1); then
                echo "OK: $name — $(echo "$output" | head -1)"
              else
                echo "WARNING: optional $name unavailable — $(echo "$output" | head -1)"
              fi
            }

            echo "=== Post-Create Hook Tools ==="
            # post-create.sh installs these with try_run so transient external
            # installer failures do not make the workspace invalid.
            optional_check "Claude Code"   claude --version
            optional_check "OpenAI Codex"  codex --version
            optional_check "happy-coder"   happy --version
            optional_check "Playwright"    npx playwright --version

            echo ""
            echo "=== Post-Create Hook Build Artifacts ==="

            # Verify pnpm install ran (node_modules exists)
            if [ -d "node_modules" ]; then
              echo "OK: node_modules directory exists"
            else
              echo "FAIL: node_modules directory missing — pnpm install did not run"
              FAIL=$((FAIL + 1))
            fi

            # Verify pnpm build ran (check for built package outputs)
            BUILD_FAIL=0
            for pkg in packages/shared packages/ui packages/terminal packages/acp-client; do
              if [ -d "$pkg/dist" ]; then
                echo "OK: $pkg/dist exists"
              else
                echo "FAIL: $pkg/dist missing — pnpm build did not complete"
                BUILD_FAIL=1
              fi
            done
            FAIL=$((FAIL + BUILD_FAIL))

            exit $FAIL
          '

      - name: Verify post-start hook
        run: |
          # post-start.sh runs "happy daemon start"
          devcontainer exec --workspace-folder . bash -c '
            set -e
            echo "=== Post-Start Hook Verification ==="

            if ! command -v happy >/dev/null 2>&1; then
              echo "WARNING: happy binary unavailable; postStartCommand treats this as non-fatal"
              exit 0
            fi

            # The happy daemon should have been started by postStartCommand
            if happy daemon status 2>&1 | grep -qi "running\|started\|active"; then
              echo "OK: happy daemon is running"
            else
              STATUS=$(happy daemon status 2>&1 || true)
              echo "WARNING: happy daemon status unclear: $STATUS"
              # Not a hard failure — daemon may not persist in CI environment
              echo "Verifying happy binary is at least callable..."
              happy --version
              echo "OK: happy binary is functional"
            fi
          '

      - name: Verify MCP server configuration
        run: |
          devcontainer exec --workspace-folder . bash -c '
            set -e
            FAIL=0

            echo "=== MCP Server Configuration ==="

            # Claude MCP servers are configured only when the non-fatal Claude
            # install succeeds and the binary is available on PATH.
            if command -v claude >/dev/null 2>&1; then
              for server in playwright sequential-thinking context7 cloudflare-observability; do
                if claude mcp get "$server" >/dev/null 2>&1; then
                  echo "OK: Claude MCP server '$server' configured"
                else
                  echo "FAIL: Claude MCP server '$server' not found"
                  FAIL=$((FAIL + 1))
                fi
              done
            else
              echo "WARNING: Claude CLI unavailable; skipping Claude MCP server verification"
            fi

            # Codex Cloudflare Observability MCP is intentionally opt-in after
            # OAuth login. post-create.sh prints the setup commands instead of
            # configuring it automatically, so absence here must not fail the
            # devcontainer validation.
            if codex mcp get cloudflare-observability >/dev/null 2>&1; then
              echo "OK: Codex MCP server 'cloudflare-observability' configured"
            else
              echo "WARNING: Codex MCP server 'cloudflare-observability' not configured; opt in with codex mcp add/login after OAuth"
            fi

            exit $FAIL
          '

          echo ""
          echo "=== Devcontainer full validation passed ==="

  devcontainer-volume-mount:
    name: Devcontainer Volume Mount
    needs: [changes]
    if: needs.changes.outputs.devcontainer-volume-mount == 'true'
    runs-on: ubuntu-latest
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: '22'

      - name: Install devcontainer CLI
        run: npm install -g --ignore-scripts "@devcontainers/cli@${DEVCONTAINERS_CLI_VERSION}"

      - name: Prepare devcontainer fixture images
        run: bash scripts/ci/prepare-devcontainer-fixture-images.sh

      - name: Run SAM volume mount devcontainer test
        run: bash scripts/ci/test-devcontainer-volume-mount.sh .