ci.yml

name: CI

# Linux clippy/test/coverage/TUI also run on AWS CodeBuild when
# vars.AWS_CODEBUILD_ROLE_ARN is set. Status checks: cortex-cli-gha-x64
# and cortex-cli-gha-arm64. See deploy/aws/codebuild/README.md.
# Jobs in this workflow stay required and unchanged.

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

env:
  CARGO_TERM_COLOR: always
  RUST_BACKTRACE: 1
  CARGO_REGISTRIES_CRATES_IO_PROTOCOL: sparse
  CARGO_INCREMENTAL: 0
  # Clippy job uses -D warnings. Do not also deny rustc edition-migration
  # warnings here — those are allowed in [workspace.lints.rust] where needed.

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: read

jobs:
  quality:
    name: Source and dependency policy
    runs-on: ubuntu-latest
    timeout-minutes: 15
    env:
      QUALITY_BASE: ${{ github.event.pull_request.base.sha || github.event.before }}
    steps:
      - uses: actions/checkout@v7
        with:
          fetch-depth: 0
      - uses: actions/setup-python@v7
        with:
          python-version: '3.12'
      - uses: dtolnay/rust-toolchain@1.98.0
        with:
          components: rustfmt, clippy
      - uses: taiki-e/install-action@v2
        with:
          tool: cargo-machete@0.9.1
      - run: python -m pip install -r scripts/readiness/requirements.txt
      - run: python -B -m unittest discover -s scripts/readiness -p 'test_*.py'
      - run: python scripts/readiness/quality.py --base "$QUALITY_BASE"
      - run: cargo machete --with-metadata
      - run: python scripts/readiness/release_age.py --base "$QUALITY_BASE"
      - uses: actions/upload-artifact@v7
        if: always()
        with:
          name: source-quality
          path: target/readiness/quality.json
          retention-days: 14

  version-check:
    name: CLI Version and Distribution (${{ matrix.os }})
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, macos-latest, macos-15-intel, windows-latest]
    steps:
      - uses: actions/checkout@v7
      - uses: actions/setup-python@v7
        with:
          python-version: '3.12'
      - run: python -m pip install -r scripts/readiness/requirements.txt
      - name: Verify CLI version consistency
        shell: bash
        run: ./scripts/check-cli-version.sh
      - name: Verify installer fixtures and package contracts
        run: python -B -m unittest discover -s scripts/readiness -p test_distribution.py -v
      - name: Verify Windows installer arch detection
        shell: pwsh
        run: ./scripts/test-install-ps1.ps1

  fmt:
    name: Format
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - uses: dtolnay/rust-toolchain@1.98.0
        with:
          components: rustfmt
      - name: Check formatting
        run: cargo fmt --all -- --check

  clippy:
    name: Clippy
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - name: Install Linux dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y libasound2-dev libssl-dev pkg-config
      - uses: dtolnay/rust-toolchain@1.98.0
        with:
          components: clippy
      - uses: Swatinem/rust-cache@v2
        with:
          prefix-key: rust-clippy
      - name: Run clippy
        run: ./scripts/clippy.sh

  test:
    name: Test
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - name: Install Linux dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y libasound2-dev libssl-dev pkg-config git ripgrep
      - uses: dtolnay/rust-toolchain@1.98.0
      - uses: actions/setup-node@v7
        with:
          node-version: '22'
      - uses: Swatinem/rust-cache@v2
        with:
          prefix-key: rust-test
      - uses: taiki-e/install-action@v2
        with:
          tool: cargo-nextest@0.9.102
      - name: Run tests
        run: python3 scripts/readiness/tests.py
      - name: Run documentation tests
        run: cargo test --locked --workspace --doc
      - name: Verify generated API contracts
        run: python3 scripts/readiness/schema.py
      - name: Build local QA applications
        run: cargo build --locked -p cortex-cli -p cortex-app-server
      - name: Local functional QA and dynamic security tests
        run: python3 scripts/readiness/qa.py
      - uses: actions/upload-artifact@v7
        if: always()
        continue-on-error: true
        with:
          name: test-performance
          path: target/readiness/tests/
          retention-days: 30
      - uses: actions/upload-artifact@v7
        if: always()
        continue-on-error: true
        with:
          name: local-qa
          # Diagnostic journals and aggregates remain local to the runner.
          path: target/readiness/qa/report.json
          retention-days: 14

  coverage:
    name: Changed-line coverage
    runs-on: ubuntu-latest
    timeout-minutes: 30
    env:
      QUALITY_BASE: ${{ github.event.pull_request.base.sha || github.event.before }}
    steps:
      - uses: actions/checkout@v7
        with:
          fetch-depth: 0
      - run: sudo apt-get update && sudo apt-get install -y libasound2-dev libssl-dev pkg-config git ripgrep
      - uses: dtolnay/rust-toolchain@1.98.0
        with:
          components: llvm-tools-preview
      - uses: actions/setup-node@v7
        with:
          node-version: '22'
      - uses: Swatinem/rust-cache@v2
        with:
          prefix-key: rust-coverage
      - uses: taiki-e/install-action@v2
        with:
          tool: cargo-llvm-cov@0.6.21,cargo-nextest@0.9.102
      - name: Collect application coverage
        run: |
          mkdir -p target/readiness
          cargo llvm-cov nextest --locked -p cortex-cli -p cortex-app-server -p cortex-common --profile ci --lcov --output-path target/readiness/lcov.info
      - run: python3 scripts/readiness/coverage.py --base "$QUALITY_BASE"
      - uses: actions/upload-artifact@v7
        if: always()
        with:
          name: coverage
          path: |
            target/readiness/lcov.info
            target/readiness/coverage.json
          retention-days: 14

  tui:
    name: TUI checks
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - name: Install Linux dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y libasound2-dev libssl-dev pkg-config
      - uses: dtolnay/rust-toolchain@1.98.0
      - uses: Swatinem/rust-cache@v2
        with:
          prefix-key: rust-tui
      - name: Headless TUI / snapshot tests
        run: |
          cargo test -p cortex-tui -p cortex-tui-capture -p cortex-tui-components \
            -p cortex-tui-framework -p cortex-tui-core -p cortex-tui-buffer \
            -p cortex-tui-widgets -p cortex-tui-layout -p cortex-tui-text \
            -p cortex-tui-input -p cortex-tui-terminal -p cortex-tui-syntax

  audit:
    name: Security Audit
    runs-on: ubuntu-latest
    permissions:
      contents: read
    env:
      RUSTFLAGS: ""
    steps:
      - uses: actions/checkout@v7
      - uses: dtolnay/rust-toolchain@1.98.0
      - uses: taiki-e/install-action@v2
        with:
          tool: cargo-audit@0.22.2
      - name: Audit Rust dependencies
        run: cargo audit

  ci-success:
    name: CI Success
    runs-on: ubuntu-latest
    needs: [version-check, fmt, clippy, test, tui, audit, quality, coverage]
    if: always()
    steps:
      - name: Check all jobs
        run: |
          if [[ "${{ needs.version-check.result }}" != "success" || \
                "${{ needs.fmt.result }}" != "success" || \
                "${{ needs.clippy.result }}" != "success" || \
                "${{ needs.test.result }}" != "success" || \
                "${{ needs.tui.result }}" != "success" || \
                "${{ needs.audit.result }}" != "success" || \
                "${{ needs.quality.result }}" != "success" || \
                "${{ needs.coverage.result }}" != "success" ]]; then
            echo "One or more required CI jobs failed"
            exit 1
          fi
          echo "All CI checks passed"