ci.yml

name: CI

on:
  push:
    branches:
      - main
  pull_request:
  workflow_dispatch:

env:
  PRIMARY_NODE_VERSION: "22.x"
  PNPM_VERSION: "9.15.0"

concurrency:
  group: ci-${{ github.workflow }}-${{ github.ref }}
  # Superseded pull request pushes are wasted work, but superseded main pushes
  # are not: a cancelled run never reaches its post step, so it never saves a
  # Turbo cache. Cancelling them let a burst of merges leave every pull request
  # restoring from a main commit well behind HEAD.
  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}

jobs:
  checks:
    name: Checks (ubuntu-latest, Node 22.x)
    runs-on: blacksmith-4vcpu-ubuntu-2404
    timeout-minutes: 30

    # `actions: read` is what lets the cache-usage check call the Actions API;
    # checkout needs `contents: read`. The check degrades to a skip without
    # them, so this only makes the reporting reliable.
    permissions:
      contents: read
      actions: read

    steps:
      - name: Checkout repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Setup workspace
        uses: ./.github/actions/setup-workspace
        with:
          node-version: ${{ env.PRIMARY_NODE_VERSION }}
          pnpm-version: ${{ env.PNPM_VERSION }}
          cache-prefix: checks

      # Four tasks for four vCPUs: TypeScript 7 and esbuild are multi-threaded,
      # so turbo's default of ten concurrent tasks only adds contention here.
      # Measured pinned to 4 CPUs, two rounds each: 96 s / 110 s at the
      # default vs 90 s / 58 s at four.
      - name: Build, typecheck, and lint
        run: pnpm exec turbo run build typecheck lint --cache-dir=.turbo/cache --output-logs=new-only --concurrency=4

      # Runs after build and typecheck, so the guard's own turbo build is a
      # cache hit and the package it packs is the one this commit really ships.
      # A published version whose packed files or consumer-facing manifest
      # fields changed is a hard failure; an unreachable registry or a failed
      # local pack (exit 2) is infrastructure, not a finding.
      - name: Check plugin SDK npm version guard
        run: |
          # +e so the exit code can be inspected: GitHub's default shell runs
          # with -e, which would abort the step before the exit-2 check.
          set +e
          node packages/plugin-sdk/scripts/check-npm-version-guard.mjs
          guard_exit=$?
          set -e
          if [[ "$guard_exit" -eq 2 ]]; then
            echo "::warning::Skipping the plugin SDK npm version guard: the npm registry was unreachable."
            exit 0
          fi
          exit "$guard_exit"

      # Guards the JavaScript that blocks first paint in the web app, and the
      # thread route's static closure that blocks first thread paint. Heavy
      # editor, diff and math code reaches those paths through barrel
      # re-exports, which typecheck and lint cannot see.
      - name: Check app bundle budgets
        run: node apps/app/scripts/check-bundle-budget.mjs

      # Provider-literal ratchet (G1 of the provider-plugin migration):
      # core must never gain a new provider-id carve-out; the per-file
      # baseline may only shrink. See docs/provider-plugin-api.md.
      - name: Check provider-literal ratchet
        run: |
          git fetch --depth=1 origin "${{ github.base_ref || github.event.repository.default_branch }}" || true
          node scripts/check-provider-literal-ratchet.mjs --base "origin/${{ github.base_ref || github.event.repository.default_branch }}"

      # Exceeding the Actions cache quota is silent: GitHub evicts entries
      # without failing or warning anything, so the only symptom is caches
      # quietly ceasing to hit. Warn while there is still headroom.
      - name: Check Actions cache usage
        env:
          GITHUB_TOKEN: ${{ github.token }}
        run: node scripts/check-actions-cache-usage.mjs

  # Tests run on their own runners instead of inside the checks job: the big
  # suites are CPU-bound and previously fought each other (and the builds) for
  # the same 4 vCPUs, which made tests the critical path of every run.
  tests:
    name: Tests (${{ matrix.shard }}, ubuntu-latest, Node 22.x)
    runs-on: blacksmith-4vcpu-ubuntu-2404
    timeout-minutes: 30

    strategy:
      fail-fast: false
      matrix:
        include:
          - shard: server
            filter: --filter=@bb/server
            args: ""
          # @bb/app is by far the largest suite (365 files) and was the critical
          # path once the macOS smoke leg was fixed. Vitest splits by file, and
          # Turbo hashes passthrough args, so each leg is a distinct cache entry
          # rather than three jobs racing to reuse one.
          - shard: app-1
            filter: --filter=@bb/app
            args: -- --shard=1/3
          - shard: app-2
            filter: --filter=@bb/app
            args: -- --shard=2/3
          - shard: app-3
            filter: --filter=@bb/app
            args: -- --shard=3/3
          - shard: integration
            filter: --filter=@bb/integration-tests
            args: ""
          - shard: packages
            filter: --filter='!@bb/server' --filter='!@bb/app' --filter='!@bb/integration-tests'
            args: ""

    steps:
      - name: Checkout repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Setup workspace
        uses: ./.github/actions/setup-workspace
        with:
          node-version: ${{ env.PRIMARY_NODE_VERSION }}
          pnpm-version: ${{ env.PNPM_VERSION }}
          cache-prefix: test-${{ matrix.shard }}

      - name: Test
        run: pnpm exec turbo run test ${{ matrix.filter }} --cache-dir=.turbo/cache --output-logs=new-only --concurrency=4 ${{ matrix.args }}

  # The macOS legs run without the Turbo cache. Blacksmith's transparent cache
  # only backs their Linux runners, so on macOS the cache moves over GitHub's
  # own service at ~50 MB/s: restoring and saving the ~2 GB directory cost about
  # two minutes per run and returned 0 of 8 task hits, because the six ~2 GB
  # entries it wrote also blew past the repository's 10 GB cache quota and
  # evicted each other. `smoke:tarball` is itself `"cache": false`, so only its
  # build dependencies could ever have been reused.
  package-smoke:
    name: Package Smoke (${{ matrix.os }}, Node ${{ matrix.node-version }})
    runs-on: ${{ matrix.os }}
    timeout-minutes: 45

    strategy:
      fail-fast: false
      matrix:
        include:
          - os: blacksmith-4vcpu-ubuntu-2404
            node-version: "22.x"
            turbo-cache: "true"
          - os: blacksmith-6vcpu-macos-15
            node-version: "22.x"
            turbo-cache: "false"

    steps:
      - name: Checkout repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Setup workspace
        uses: ./.github/actions/setup-workspace
        with:
          node-version: ${{ matrix.node-version }}
          pnpm-version: ${{ env.PNPM_VERSION }}
          cache-prefix: package-smoke
          turbo-cache: ${{ matrix.turbo-cache }}

      - name: Smoke bb-app tarball
        run: pnpm exec turbo run smoke:tarball --filter=bb-app --cache-dir=.turbo/cache --output-logs=new-only

      - name: Install AppImage FUSE runtime
        if: ${{ runner.os == 'Linux' }}
        run: |
          sudo apt-get update
          sudo apt-get install --yes libfuse2t64

      - name: Package Linux AppImage
        if: ${{ runner.os == 'Linux' }}
        run: pnpm exec turbo run desktop:build:linux --filter=@bb/desktop --cache-dir=.turbo/cache --output-logs=new-only

      - name: Smoke Linux AppImage mount lifecycle
        if: ${{ runner.os == 'Linux' }}
        run: xvfb-run -a pnpm exec turbo run smoke:appimage-lifecycle --filter=@bb/desktop --force --cache-dir=.turbo/cache --output-logs=new-only

  node-compat-smoke:
    name: Node Compatibility Smoke (${{ matrix.os }}, Node ${{ matrix.node-version }})
    if: ${{ github.event_name != 'pull_request' }}
    runs-on: ${{ matrix.os }}
    timeout-minutes: 30
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: blacksmith-4vcpu-ubuntu-2404
            node-version: "24.x"
            turbo-cache: "true"
          - os: blacksmith-4vcpu-ubuntu-2404
            node-version: "26.x"
            turbo-cache: "true"
          - os: blacksmith-6vcpu-macos-15
            node-version: "24.x"
            turbo-cache: "false"
          - os: blacksmith-6vcpu-macos-15
            node-version: "26.x"
            turbo-cache: "false"

    steps:
      - name: Checkout repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Setup workspace
        uses: ./.github/actions/setup-workspace
        with:
          node-version: ${{ matrix.node-version }}
          pnpm-version: ${{ env.PNPM_VERSION }}
          cache-prefix: compat-smoke
          turbo-cache: ${{ matrix.turbo-cache }}

      - name: Smoke bb-app tarball
        run: pnpm exec turbo run smoke:tarball --filter=bb-app --cache-dir=.turbo/cache --output-logs=new-only