checks.yml

name: checks

on:
  workflow_call:
  workflow_dispatch:

permissions:
  contents: read

jobs:
  # Which checks a pull request's changes can affect (.github/scripts/ci-changes.sh). A job is
  # skipped only when the script prints `false` for its flag; an unset flag, and every push or
  # dispatch (the deploy chain's checks), runs it. Every gated job needs this one, so its failure
  # skips them and fails `ci` below.
  changes:
    name: changes
    runs-on: &runner-2vcpu ${{ (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == 'blacksmith') && 'blacksmith-2vcpu-ubuntu-2404' || 'ubuntu-latest' }}
    timeout-minutes: 5
    outputs:
      full: ${{ github.event_name != 'pull_request' || steps.classify.outputs.full != 'false' }}
      test: ${{ github.event_name != 'pull_request' || steps.classify.outputs.test != 'false' }}
      build: ${{ github.event_name != 'pull_request' || steps.classify.outputs.build != 'false' }}
      desktop_live: ${{ github.event_name != 'pull_request' || steps.classify.outputs.desktop_live != 'false' }}
    steps:
      - name: Checkout code (mirror)
        if: github.event_name == 'pull_request' && !github.event.pull_request.head.repo.fork
        uses: useblacksmith/checkout@25227e61ff9dafe400e22fa487b673eac4e4409a # v1.8.1
        with:
          fetch-depth: 2
      - name: Checkout code
        if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6
        with:
          fetch-depth: 2
      - name: Classify the pull request's changes
        id: classify
        if: github.event_name == 'pull_request'
        env:
          BASE: ${{ github.event.pull_request.base.sha }}
        run: bash .github/scripts/ci-changes.sh "$BASE" >> "$GITHUB_OUTPUT"

  integration:
    # Runs the real-infrastructure test layer: every `*.integration.ts` in packages/db and
    # apps/sim, discovered by glob (`vitest run --mode integration`), against the database each
    # provisioning path produces. A new integration suite needs no workflow change.
    #
    # The two paths build different schemas (migrations add triggers, checks and NOT VALID
    # constraints that `db:push` does not), so each runs the whole suite. Vitest splits each
    # suite's files across four shards by measured duration (DurationBalancedSequencer in vitest.shared.ts); a
    # shard runs its files one at a time against its own database. Files run serially, so a shard
    # barely uses more than one core: 4 vCPU is enough.
    name: integration (${{ matrix.provision }}, ${{ matrix.shard }}/4)
    needs: changes
    if: needs.changes.outputs.full == 'true'
    runs-on: &runner-4vcpu ${{ (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == 'blacksmith') && 'blacksmith-4vcpu-ubuntu-2404' || 'ubuntu-latest' }}
    timeout-minutes: 20
    strategy:
      fail-fast: false
      matrix:
        provision: [push, migrate]
        shard: [1, 2, 3, 4]
    services:
      redis:
        image: redis:8.2-alpine
        ports:
          - 6379:6379
        options: >-
          --health-cmd "redis-cli ping"
          --health-interval 5s
          --health-timeout 5s
          --health-retries 10
      postgres:
        image: pgvector/pgvector:pg17
        env:
          POSTGRES_USER: postgres
          POSTGRES_PASSWORD: postgres
          POSTGRES_DB: sim_test
        ports:
          - 5432:5432
        options: >-
          --health-cmd "pg_isready -U postgres -d sim_test"
          --health-interval 5s
          --health-timeout 5s
          --health-retries 10
      # Only push/1 runs the PostgreSQL 16 step below; an empty image skips the service elsewhere.
      postgres-legacy:
        image: ${{ matrix.provision == 'push' && matrix.shard == 1 && 'postgres:16-alpine' || '' }}
        env:
          POSTGRES_USER: postgres
          POSTGRES_PASSWORD: postgres
          POSTGRES_DB: sim_test
        ports:
          - 5433:5432
        options: >-
          --health-cmd "pg_isready -U postgres -d sim_test"
          --health-interval 5s
          --health-timeout 5s
          --health-retries 10
    env:
      TEST_DATABASE_URL: postgresql://postgres:postgres@127.0.0.1:5432/sim_test
      TEST_REDIS_URL: redis://127.0.0.1:6379
      DATABASE_URL: postgresql://postgres:postgres@127.0.0.1:5432/sim_test
      BETTER_AUTH_SECRET: oauth-postgres-ci-secret-at-least-32-characters
      NEXT_PUBLIC_APP_URL: https://test.sim.ai
      ENCRYPTION_KEY: '0000000000000000000000000000000000000000000000000000000000000000'

    steps:
      # A same-repository pull request checks out through a git mirror on a sticky disk, so a slow
      # clone from GitHub (1 in 10 took a minute or more, up to 4) no longer sets the run's pace.
      # The mirror is one disk per repository that job steps can write to, so fork pull requests
      # and pushes, whose checks gate a deploy, keep the plain checkout: same trust split as the
      # setup action's caches.
      - &checkout-mirror
        name: Checkout code (mirror)
        if: github.event_name == 'pull_request' && !github.event.pull_request.head.repo.fork
        uses: useblacksmith/checkout@25227e61ff9dafe400e22fa487b673eac4e4409a # v1.8.1
      - &checkout-plain
        name: Checkout code
        if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.fork
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6

      - name: Setup workspace
        uses: ./.github/actions/setup
        with:
          provider: ${{ vars.CI_PROVIDER }}

      - name: Provision a fresh database through the supported command
        working-directory: packages/db
        run: |
          bun -e 'import postgres from "postgres"; const sql = postgres(process.env.DATABASE_URL); for (const extension of ["vector", "btree_gin", "pg_trgm"]) await sql`CREATE EXTENSION IF NOT EXISTS ${sql(extension)}`; await sql.end()'
          bun run db:${{ matrix.provision }}

      - name: Verify migration replay is a no-op
        if: matrix.provision == 'migrate' && matrix.shard == 1
        working-directory: packages/db
        run: bun run db:migrate

      - name: Run packages/db integration tests
        working-directory: packages/db
        run: bun run test --mode integration --shard=${{ matrix.shard }}/4

      - name: Run apps/sim integration tests
        working-directory: apps/sim
        # A non-UTC process zone keeps timestamp-without-time-zone handling honest.
        env:
          TZ: America/Los_Angeles
        run: bun run test --mode integration --shard=${{ matrix.shard }}/4

      - name: Verify cumulative billing timeout recovery on PostgreSQL 16
        if: matrix.provision == 'push' && matrix.shard == 1
        working-directory: apps/sim
        env:
          TEST_DATABASE_URL: postgresql://postgres:postgres@127.0.0.1:5433/sim_test
        run: >-
          bun run test --mode integration lib/billing/core/usage-log.integration.ts
          --outputFile.json=test-results/integration-pg16.json

      - name: Upload integration test reports
        if: always()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: integration-reports-${{ matrix.provision }}-${{ matrix.shard }}
          path: |
            packages/db/test-results/*.json
            apps/sim/test-results/*.json
          if-no-files-found: warn
          retention-days: 14

  # Acceptance suites that cross a real HTTP boundary, one job per app, each on its own database.
  # Off the integration jobs' path: the SCIM app boots hosted, which starts background usage replay
  # against DATABASE_URL, so it must never share a database with suites asserting on billing rows.
  # The suites exercise HTTP behavior rather than a provisioning path, so they run once, against
  # the production (migrate) path. Each group's app environment lives in http-e2e.sh.
  #
  # SCIM's hosted suites use 8 vCPU; the other self-hosted suites fit on 4. The mobile browser
  # suite runs in e2e-mobile below.
  e2e:
    name: e2e (${{ matrix.group }})
    needs: changes
    if: needs.changes.outputs.full == 'true'
    runs-on: ${{ (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == 'blacksmith') && matrix.runner || 'ubuntu-latest' }}
    timeout-minutes: 20
    strategy:
      fail-fast: false
      matrix:
        include:
          - group: scim
            runner: blacksmith-8vcpu-ubuntu-2404
          - group: cli
            runner: blacksmith-4vcpu-ubuntu-2404
          - group: stop-after
            runner: blacksmith-4vcpu-ubuntu-2404
          - group: desktop-inbox
            runner: blacksmith-4vcpu-ubuntu-2404
    services:
      postgres:
        image: pgvector/pgvector:pg17
        env:
          POSTGRES_USER: postgres
          POSTGRES_PASSWORD: postgres
          POSTGRES_DB: sim_test
        ports:
          - 5432:5432
        options: >-
          --health-cmd "pg_isready -U postgres -d sim_test"
          --health-interval 5s
          --health-timeout 5s
          --health-retries 10
      # Only the desktop executor's app is given REDIS_URL: its doorbell and presence live there.
      redis:
        image: redis:8.2-alpine
        ports:
          - 6379:6379
        options: >-
          --health-cmd "redis-cli ping"
          --health-interval 5s
          --health-timeout 5s
          --health-retries 10
    env:
      DATABASE_URL: postgresql://postgres:postgres@127.0.0.1:5432/sim_test
      BETTER_AUTH_SECRET: http-e2e-ci-secret-at-least-32-characters
      ENCRYPTION_KEY: '0000000000000000000000000000000000000000000000000000000000000000'

    steps:
      - *checkout-mirror
      - *checkout-plain

      - name: Setup workspace
        uses: ./.github/actions/setup
        with:
          provider: ${{ vars.CI_PROVIDER }}

      # Migrations create their own extensions, as on a fresh self-hosted install.
      - name: Provision the database through migrations
        working-directory: packages/db
        run: bun run db:migrate

      # No step timeout: the job's bound covers a hang without cutting a slow but healthy suite
      # short of writing its report.
      - name: Run end-to-end suites
        working-directory: apps/sim
        run: bash ../../.github/scripts/http-e2e.sh "${{ matrix.group }}"

      - name: Upload end-to-end reports and server logs
        if: failure()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: http-e2e-${{ matrix.group }}
          path: ${{ runner.temp }}/e2e/
          if-no-files-found: ignore
          retention-days: 7

  # The mobile browser suite against the production build e2e-build uploads, served by
  # `next start` (http-e2e.sh), one browser per job: Chromium and WebKit no longer run back to
  # back, and no route waits on a dev compile. Gated like `e2e`, on a build that already ran.
  #
  # 8 vCPU: `next start`, Postgres, the realtime server and one Playwright browser would fit a 4
  # vCPU runner's 16 GB, but the suite is timing-sensitive, and CPU contention between the browser
  # and the server is what turns a slow tap into a flake.
  e2e-mobile:
    name: e2e (mobile, ${{ matrix.browser }})
    needs: [changes, e2e-build]
    if: needs.changes.outputs.full == 'true'
    runs-on: ${{ (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == 'blacksmith') && 'blacksmith-8vcpu-ubuntu-2404' || 'ubuntu-latest' }}
    timeout-minutes: 25
    strategy:
      fail-fast: false
      matrix:
        browser: [chromium, webkit]
    services:
      postgres:
        image: pgvector/pgvector:pg17
        env:
          POSTGRES_USER: postgres
          POSTGRES_PASSWORD: postgres
          POSTGRES_DB: sim_test
        ports:
          - 5432:5432
        options: >-
          --health-cmd "pg_isready -U postgres -d sim_test"
          --health-interval 5s
          --health-timeout 5s
          --health-retries 10
    env:
      DATABASE_URL: postgresql://postgres:postgres@127.0.0.1:5432/sim_test
      BETTER_AUTH_SECRET: http-e2e-ci-secret-at-least-32-characters
      ENCRYPTION_KEY: '0000000000000000000000000000000000000000000000000000000000000000'

    steps:
      - *checkout-mirror
      - *checkout-plain

      - name: Setup workspace
        uses: ./.github/actions/setup
        with:
          provider: ${{ vars.CI_PROVIDER }}

      - name: Provision the database through migrations
        working-directory: packages/db
        run: bun run db:migrate

      - name: Download the production build
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: next-build
          path: ${{ runner.temp }}

      # A hosted build (NEXT_PUBLIC_APP_URL on sim.ai) prerenders every post; the build production
      # images use prerenders none. The URL itself is no marker: next.config's redirects name
      # www.sim.ai in every build.
      - name: Extract the production build
        run: |
          tar -I zstd -xf "$RUNNER_TEMP/next-build.tar.zst" -C apps/sim
          jq -e '[.routes[].srcRoute] | any(. == "/blog/[slug]" or . == "/library/[slug]") | not' \
            apps/sim/.next/prerender-manifest.json > /dev/null ||
            { echo "::error::The build prerendered posts (a hosted build) or has no prerender manifest."; exit 1; }

      - name: Run end-to-end suites
        working-directory: apps/sim
        env:
          MOBILE_E2E_BROWSER: ${{ matrix.browser }}
        run: bash ../../.github/scripts/http-e2e.sh mobile

      - name: Upload end-to-end reports and server logs
        if: failure()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: http-e2e-mobile-${{ matrix.browser }}
          path: ${{ runner.temp }}/e2e/
          if-no-files-found: ignore
          retention-days: 7

  # Desktop tools in the real Electron app against a local app, on its own runner: the
  # Electron app, the dev app and its realtime server together outgrow the e2e runner.
  # Two runners: the lease-lapse test sleeps through a long import and then a lease (~3 min), as
  # long as the rest of the spec together, so on one runner it set the time for every run.
  desktop-live:
    name: desktop-live (${{ matrix.tests }})
    needs: changes
    if: needs.changes.outputs.desktop_live == 'true'
    runs-on: ${{ (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == 'blacksmith') && 'blacksmith-16vcpu-ubuntu-2404' || 'ubuntu-latest' }}
    timeout-minutes: 30
    strategy:
      fail-fast: false
      matrix:
        include:
          - tests: lease-lapse
            filter: --grep @lease-lapse
          - tests: rest
            filter: --grep-invert @lease-lapse
    services:
      postgres:
        image: pgvector/pgvector:pg17
        env:
          POSTGRES_USER: postgres
          POSTGRES_PASSWORD: postgres
          POSTGRES_DB: sim_test
        ports:
          - 5432:5432
        options: >-
          --health-cmd "pg_isready -U postgres -d sim_test"
          --health-interval 5s
          --health-timeout 5s
          --health-retries 10
      redis:
        image: redis:8.2-alpine
        ports:
          - 6379:6379
        options: >-
          --health-cmd "redis-cli ping"
          --health-interval 5s
          --health-timeout 5s
          --health-retries 10
    env:
      DATABASE_URL: postgresql://postgres:postgres@127.0.0.1:5432/sim_test
      BETTER_AUTH_SECRET: desktop-live-e2e-ci-secret-at-least-32-characters
      ENCRYPTION_KEY: '0000000000000000000000000000000000000000000000000000000000000000'

    steps:
      - *checkout-mirror
      - *checkout-plain

      - name: Setup workspace
        uses: ./.github/actions/setup
        with:
          provider: ${{ vars.CI_PROVIDER }}

      - name: Provision the database through migrations
        working-directory: packages/db
        run: bun run db:migrate

      # Turbopack's dev cache turns the spec's route warm-up from a cold compile (~4 min) into a
      # restore. It is content-addressed, so a pull request's changed modules still recompile; the
      # key carries the installed Next version so an upgrade starts from an empty cache, and the
      # event and fork segments keep untrusted runs off the cache trusted runs read.
      - name: Resolve Turbopack dev cache key
        id: next-cache
        run: echo "key=${GITHUB_REPOSITORY}-next-dev-desktop-live-${GITHUB_EVENT_NAME}${FORK_SUFFIX}-$(jq -r .version node_modules/next/package.json)" >> "$GITHUB_OUTPUT"
        env:
          FORK_SUFFIX: ${{ github.event.pull_request.head.repo.fork && '-fork' || '' }}

      - name: Mount Turbopack dev cache
        uses: ./.github/actions/cache
        with:
          provider: ${{ vars.CI_PROVIDER }}
          key: ${{ steps.next-cache.outputs.key }}
          path: ./apps/sim/.next/dev

      # Chat switches, Stop, sign-out, approval, the dormant-executor round trip, and background
      # runs across a chat switch and a network cut. The spec runs the recording proxy (the app's
      # public origin) and the stand-in worker.
      - name: Verify desktop tools in the Electron app against a local app
        env:
          NEXT_PUBLIC_APP_URL: http://127.0.0.1:3020
          BETTER_AUTH_URL: http://127.0.0.1:3020
          REDIS_URL: redis://127.0.0.1:6379
          SIM_AGENT_API_URL: http://127.0.0.1:3022
          NEXT_PUBLIC_SOCKET_URL: http://127.0.0.1:3023
          SOCKET_SERVER_URL: http://127.0.0.1:3023
          NEXT_PUBLIC_FORCE_HOSTED: 'false'
          COPILOT_API_KEY: desktop-tools-e2e-ci-local-copilot-key
          COPILOT_TOOL_PERMISSIONS_ENABLED: 'true'
          MOTHERSHIP_SIM_TRANSPORT: direct
          INTERNAL_API_SECRET: desktop-tools-e2e-ci-local-secret-at-least-32-characters
          DISABLE_TELEMETRY: 'true'
          NEXT_TELEMETRY_DISABLED: '1'
          READY_TIMEOUT_SECONDS: 300
        run: |
          report_dir="$RUNNER_TEMP/e2e"
          next_log="$report_dir/desktop-tools-next.log"
          mkdir -p "$report_dir"
          # Each app runs in its own session under an E2E_APP tag, and stop-session.sh returns once
          # every process it started has exited.
          realtime_tag="desktop-realtime-$GITHUB_RUN_ID-$GITHUB_RUN_ATTEMPT-$$"
          server_tag="desktop-tools-$GITHUB_RUN_ID-$GITHUB_RUN_ATTEMPT-$$"
          # Keeps the restored cache under the cap the dev scripts apply locally.
          (cd apps/sim && bun run dev:cache:cap)
          start_sim() {
            (cd apps/sim && E2E_APP="$server_tag" exec setsid node ../../node_modules/next/dist/bin/next dev --hostname 127.0.0.1 \
              --port 3021 >> "$next_log" 2>&1) &
            server_pid=$!
          }
          # A corrupted cache aborts Turbopack instead of falling back. Only then is the shared cache
          # dropped: a failing test must not cost every later run its warm cache.
          cache_broken() {
            grep -qiE 'cache corruption|turbopack.*panic|panicked' "$next_log" 2>/dev/null
          }
          # The cache directory is a mount point: empty it rather than remove it. Absolute, because
          # the EXIT trap runs after the step has moved into apps/desktop.
          clear_cache() {
            find "$GITHUB_WORKSPACE/apps/sim/.next/dev" -mindepth 1 -maxdepth 1 -exec rm -rf {} +
          }
          # SIGINT first: `next dev` SIGKILLs its server 100ms after SIGTERM, which discards a cache
          # write in flight. stop-session.sh then removes anything still running.
          # SIGINT is best-effort; the cleanup always runs, since workers and the detached telemetry
          # flush can outlive a server that has already exited.
          stop_sim() {
            if kill -INT "$server_pid" 2>/dev/null; then
              for _ in $(seq 1 30); do kill -0 "$server_pid" 2>/dev/null || break; sleep 1; done
            fi
            bash "$GITHUB_WORKSPACE/.github/scripts/stop-session.sh" "$server_pid" "$server_tag"
          }
          (cd apps/realtime && PORT=3023 SIM_DB_ROLE=realtime ALLOWED_ORIGINS="$NEXT_PUBLIC_APP_URL" \
            E2E_APP="$realtime_tag" exec setsid bun src/index.ts > "$report_dir/desktop-tools-realtime.log" 2>&1) &
          realtime_pid=$!
          start_sim
          finish() {
            status=$?
            stop_sim || status=1
            bash "$GITHUB_WORKSPACE/.github/scripts/stop-session.sh" "$realtime_pid" "$realtime_tag" || status=1
            wait "$server_pid" "$realtime_pid" 2>/dev/null || true
            if cache_broken; then
              echo "::warning::Turbopack reported a broken dev cache; clearing it for the next run."
              clear_cache
            fi
            exit "$status"
          }
          trap finish EXIT
          # The apps boot while the runner installs Electron's libraries and bundles the shell.
          sudo apt-get update -q
          sudo apt-get install -yq xvfb libgtk-3-0t64 libnss3 libasound2t64 libgbm1 libxss1 \
            libxtst6 libatk-bridge2.0-0t64 libxkbcommon0 > /dev/null
          # Bundle only: `bun run build` also fetches the macOS node-pty prebuilds for packaging,
          # which a Linux run does not use.
          (cd apps/desktop && bun run scripts/build.ts)
          started=$SECONDS
          retried=0
          until curl --fail --silent --max-time 10 http://127.0.0.1:3021/api/health > /dev/null &&
            curl --fail --silent --max-time 10 http://127.0.0.1:3023/health > /dev/null; do
            if ! kill -0 "$server_pid" 2>/dev/null; then
              tail -n 200 "$next_log"
              if [ "$retried" = 0 ] && cache_broken; then
                echo "::warning::Turbopack rejected the restored dev cache; restarting from an empty cache."
                bash "$GITHUB_WORKSPACE/.github/scripts/stop-session.sh" "$server_pid" "$server_tag"
                clear_cache
                : > "$next_log"
                retried=1
                start_sim
                continue
              fi
              exit 1
            fi
            kill -0 "$realtime_pid" 2>/dev/null || { tail -n 200 "$report_dir/desktop-tools-realtime.log"; exit 1; }
            [ $((SECONDS - started)) -lt "$READY_TIMEOUT_SECONDS" ] || { echo '::error::Local app did not become ready'; exit 1; }
            sleep 2
          done
          echo "Local apps ready $((SECONDS - started))s after the Electron bundle"
          cd apps/desktop
          SIM_DESKTOP_E2E_SIM_URL=http://127.0.0.1:3021 \
          SIM_DESKTOP_E2E_PROXY_PORT=3020 \
          SIM_DESKTOP_E2E_AGENT_PORT=3022 \
          SIM_DESKTOP_E2E_DATABASE_URL="$DATABASE_URL" \
          SIM_DESKTOP_E2E_REDIS_URL="$REDIS_URL" \
          SIM_DESKTOP_E2E_AUTH_SECRET="$BETTER_AUTH_SECRET" \
            xvfb-run -a -s '-screen 0 1920x1200x24' bunx playwright test e2e/desktop-tools-live-sim.spec.ts \
            ${{ matrix.filter }} --output "$report_dir/desktop-tools-results" --retries=0

      - name: Upload Electron E2E results and server logs
        if: failure()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: desktop-live-e2e-results-${{ matrix.tests }}
          path: ${{ runner.temp }}/e2e/
          if-no-files-found: ignore
          retention-days: 7

  # Lint, audits, type-check and the schema sync check: about two minutes of mostly cached work,
  # kept off the test shards so neither waits on the other.
  lint:
    name: lint
    runs-on: *runner-4vcpu
    timeout-minutes: 15

    steps:
      # The diff-based audits below need a base commit to read, and the default
      # depth of 1 clones a single commit with no parent. They normally fetch
      # their base by SHA (see "Resolve base ref"), so this depth only covers the
      # `HEAD~1` fallback — but without it that fallback resolves to nothing.
      #
      # Worth stating because the failure was invisible for so long: the migration
      # audit read the resulting `git diff` failure as "no migrations changed" and
      # exited 0, so it had never actually run on a push build.
      # Same mirror/plain split as the integration job's checkout.
      - &checkout-mirror-depth2
        name: Checkout code (mirror)
        if: github.event_name == 'pull_request' && !github.event.pull_request.head.repo.fork
        uses: useblacksmith/checkout@25227e61ff9dafe400e22fa487b673eac4e4409a # v1.8.1
        with:
          fetch-depth: 2
      - &checkout-plain-depth2
        name: Checkout code
        if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.fork
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6
        with:
          fetch-depth: 2

      - name: Setup workspace
        uses: ./.github/actions/setup
        with:
          provider: ${{ vars.CI_PROVIDER }}
          turbo-cache-key: turbo-cache

      # Surfaces known CVEs in the dependency tree. Non-blocking until the
      # existing advisory backlog is triaged, then flip to a required gate by
      # removing continue-on-error.
      - name: Security audit
        run: bun audit
        continue-on-error: true

      - name: Validate env flags
        run: |
          FILE="apps/sim/lib/core/config/env-flags.ts"
          ERRORS=""

          echo "Checking for hardcoded boolean env flags..."

          # Use perl for multiline matching to catch both:
          #   export const isHosted = true
          #   export const isHosted =
          #     true
          HARDCODED=$(perl -0777 -ne 'while (/export const (is[A-Za-z]+)\s*=\s*\n?\s*(true|false)\b/g) { print "  $1 = $2\n" }' "$FILE")

          if [ -n "$HARDCODED" ]; then
            ERRORS="${ERRORS}\n❌ Env flags must not be hardcoded to boolean literals!\n\nFound hardcoded flags:\n${HARDCODED}\n\nEnv flags should derive their values from environment variables.\n"
          fi

          echo "Checking env flag naming conventions..."

          # Check that all export const (except functions) start with 'is'
          # This finds exports like "export const someFlag" that don't start with "is" or "get"
          BAD_NAMES=$(grep -E "^export const [a-z]" "$FILE" | grep -vE "^export const (is|get)" | sed 's/export const \([a-zA-Z]*\).*/  \1/')

          if [ -n "$BAD_NAMES" ]; then
            ERRORS="${ERRORS}\n❌ Env flags must use 'is' prefix for boolean flags!\n\nFound incorrectly named flags:\n${BAD_NAMES}\n\nExample: 'hostedMode' should be 'isHostedMode'\n"
          fi

          if [ -n "$ERRORS" ]; then
            echo ""
            echo -e "$ERRORS"
            exit 1
          fi

          echo "✅ All env flags are properly configured"

      # One fetch for both base-ref audits, and no `|| true`: a swallowed fetch leaves
      # the base ref absent, which neither audit can tell apart from a branch that
      # changed nothing. The block-registry check at least degrades to a visible
      # `⚠ … skipping` line; the migration audit printed `✓ No new migrations to
      # check` and exited 0, clearing the only guard on production DDL.
      #
      # Depth stays at 1 — without a merge-base the migration audit diffs the two
      # tips, which under `--diff-filter=AM` is exactly the migrations new here.
      #
      # On push the base is `github.event.before`, the tip the branch had before
      # this push — not `HEAD~1`, which names only the last commit and would let a
      # multi-commit push slip every earlier commit's migrations past the audit.
      # It is fetched by SHA at depth 1; the audits diff two tips and need no
      # common ancestry. An all-zero `before` means the branch is new and has no
      # predecessor to diff, so `HEAD~1` remains the fallback there.
      - name: Resolve base ref for diff-based audits
        id: audit_base
        run: |
          if [ "${{ github.event_name }}" = "pull_request" ]; then
            git fetch --depth=1 origin "${{ github.base_ref }}"
            echo "ref=origin/${{ github.base_ref }}" >> "$GITHUB_OUTPUT"
          elif [ -n "${{ github.event.before }}" ] &&
               [ "${{ github.event.before }}" != "0000000000000000000000000000000000000000" ]; then
            git fetch --depth=1 origin "${{ github.event.before }}"
            echo "ref=${{ github.event.before }}" >> "$GITHUB_OUTPUT"
          else
            echo "ref=HEAD~1" >> "$GITHUB_OUTPUT"
          fi

      - name: Check block registry invariants
        run: bun run apps/sim/scripts/check-block-registry.ts "${{ steps.audit_base.outputs.ref }}"

      - name: Lint code
        run: bun run lint:check

      # Workflow syntax, expressions, `needs` references and runner labels. ShellCheck stays off
      # here: the existing run blocks carry info-level findings that are their own cleanup.
      - name: Lint workflows
        env:
          ACTIONLINT_VERSION: 1.7.12
          ACTIONLINT_SHA256: 8aca8db96f1b94770f1b0d72b6dddcb1ebb8123cb3712530b08cc387b349a3d8
        run: |
          archive="$RUNNER_TEMP/actionlint.tar.gz"
          curl -fsSL -o "$archive" \
            "https://github.com/rhysd/actionlint/releases/download/v${ACTIONLINT_VERSION}/actionlint_${ACTIONLINT_VERSION}_linux_amd64.tar.gz"
          echo "${ACTIONLINT_SHA256}  ${archive}" | sha256sum -c -
          tar -xzf "$archive" -C "$RUNNER_TEMP" actionlint
          "$RUNNER_TEMP/actionlint" -color -shellcheck= -pyflakes=

      # Every zero-argument `check:*` script, run concurrently. The list is derived in
      # scripts/run-audits.ts, which also writes the per-audit timing table to the job
      # summary and annotates failures. Audits needing a base ref stay separate below.
      - name: Repo audits
        run: bun run check:audits

      - name: Migration safety (zero-downtime) audit
        run: bun run check:migrations "${{ steps.audit_base.outputs.ref }}"

      # Every workspace, not just realtime. packages/emcn, packages/utils,
      # apps/desktop and apps/docs had no type check in CI at all; apps/sim's
      # source was covered only as a side effect of `next build` in the separate
      # `build` job. This does NOT cover apps/sim's tests — its tsconfig
      # excludes *.test.ts(x), which carry ~2.2k errors; the `test-types` job
      # ratchets those per file instead.
      - name: Type-check all workspaces
        run: bunx turbo run type-check

      - name: Check schema and migrations are in sync
        working-directory: packages/db
        run: |
          bunx drizzle-kit generate --config=./drizzle.config.ts
          if [ -n "$(git status --porcelain ./migrations)" ]; then
            echo "❌ Schema and migrations are out of sync!"
            echo "Run 'cd packages/db && bunx drizzle-kit generate' and commit the new migrations."
            git status --porcelain ./migrations
            git diff ./migrations
            exit 1
          fi
          echo "✅ Schema and migrations are in sync"

  # Type errors in apps/sim's unit tests, ratcheted per file and TS code against a committed
  # baseline (scripts/check-test-types.ts). It type-checks the whole app with its ~3.4k test files:
  # lint's uncached apps/sim type-check alone takes ~35 s on this runner, so it gets its own job
  # beside lint rather than a place in check:audits, which also runs on laptops. Gated like `test`.
  # On failure the compiler output and its exit status are uploaded, so a fix can shrink the
  # existing baseline from them (`--diagnostics <file> --update`) without a local compile; nothing
  # ever raises the baseline.
  test-types:
    name: test-types
    needs: changes
    if: needs.changes.outputs.test == 'true'
    runs-on: *runner-4vcpu
    timeout-minutes: 10

    steps:
      - *checkout-mirror
      - *checkout-plain

      - name: Setup workspace
        uses: ./.github/actions/setup
        with:
          provider: ${{ vars.CI_PROVIDER }}

      - name: Ratchet type errors in apps/sim tests
        run: bun run scripts/check-test-types.ts --report "$RUNNER_TEMP/test-types"

      - name: Upload compiler output and counts
        if: failure()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: test-types
          path: ${{ runner.temp }}/test-types/
          if-no-files-found: ignore
          retention-days: 14

  # The root scripts and every workspace's Vitest suite (`bun run test`), split in two. apps/sim is
  # about 98% of the time, so only its files are sharded; shard 1 also runs the root scripts and
  # the other workspaces. Each shard keeps its own Turbo cache: pass-through args are part of the
  # task hash, so a shard only ever replays its own result.
  test:
    name: test (${{ matrix.shard }}/2)
    needs: changes
    if: needs.changes.outputs.test == 'true'
    runs-on: ${{ (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == 'blacksmith') && 'blacksmith-8vcpu-ubuntu-2404' || 'ubuntu-latest' }}
    timeout-minutes: 15
    strategy:
      fail-fast: false
      matrix:
        shard: [1, 2]

    steps:
      - *checkout-mirror-depth2
      - *checkout-plain-depth2

      - name: Setup workspace
        uses: ./.github/actions/setup
        with:
          provider: ${{ vars.CI_PROVIDER }}
          turbo-cache-key: turbo-cache-test-${{ matrix.shard }}

      # cloud-review-tools.test.ts runs the real helper on the runner, which shells
      # out to rg. Blacksmith's image ships it, GitHub's doesn't.
      - name: Install ripgrep
        run: command -v rg || (sudo apt-get update && sudo apt-get install -y ripgrep)

      - name: Verify shell placeholder compilation in Bash
        if: matrix.shard == 1
        working-directory: apps/sim
        env:
          SHELL_PLACEHOLDERS_REPORT_PATH: ${{ runner.temp }}/shell-placeholders.json
        run: bun scripts/test-shell-placeholders-e2e.ts

      - name: Upload shell placeholder execution report
        if: failure() && matrix.shard == 1
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: shell-placeholders
          path: ${{ runner.temp }}/shell-placeholders.json
          if-no-files-found: warn
          retention-days: 7

      - name: Run tests
        env:
          NODE_OPTIONS: '--no-warnings --max-old-space-size=8192'
          NEXT_PUBLIC_APP_URL: 'https://www.sim.ai'
          DATABASE_URL: 'postgresql://postgres:postgres@localhost:5432/simstudio'
          ENCRYPTION_KEY: '0000000000000000000000000000000000000000000000000000000000000000' # dummy key for CI only
          TURBO_CACHE_DIR: .turbo
          SHARD: ${{ matrix.shard }}
        run: |
          if [ "$SHARD" = 1 ]; then
            bun run test:scripts
            bunx turbo run test --filter='!@sim/app'
          fi
          bunx turbo run test --filter=@sim/app -- --shard="$SHARD/2"

  # Next.js production build, in parallel with lint + tests. Sticky disks are
  # cloned from the last committed snapshot per job and committed last-writer-
  # wins, so concurrent mounts are safe. The bun/node_modules disks are shared
  # with the test jobs (the lockfile-hashed key means they only ever share when the
  # dependency tree really is identical, so LWW loss is harmless), but the Turbo
  # cache gets its own key: with a shared key, only the last committer's new
  # entries survive each run, so the test and build Turbo entries would evict
  # each other nondeterministically.
  #
  # Runner is sized for the COLD-cache build, which is what OOM-killed the 8vcpu
  # tier (23 kills / 1074 runs at 98% of its 30.4 GB): warm peaks ~12 GB, cold
  # peaked 51 GB. NODE_OPTIONS' --max-old-space-size caps only Node's JS heap,
  # not the native Turbopack workers that dominate, so it cannot prevent this.
  build:
    name: build
    needs: changes
    if: needs.changes.outputs.build == 'true'
    runs-on: ${{ (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == 'blacksmith') && 'blacksmith-16vcpu-ubuntu-2404' || 'linux-x64-8-core' }}
    # Build durations crossed 15 minutes as the app grew (10m02 on Jul 29 AM,
    # 14m44 after the folders/desktop/library merges, then two straight
    # timeouts) — GitHub reports a job timeout as "cancelled". 25 keeps
    # headroom without masking a genuine hang.
    timeout-minutes: 25

    steps:
      - *checkout-mirror
      - *checkout-plain

      - name: Setup workspace
        uses: ./.github/actions/setup
        with:
          provider: ${{ vars.CI_PROVIDER }}
          turbo-cache-key: turbo-cache-build

      # No `.next/cache` mount: the Turbopack persistent build cache is off. A
      # controlled A/B on one branch (PR #6078) with a byte-identical module graph
      # measured compile at 113s with the cache off, 162s cold with it on, and
      # 360s warm — the cache made the same build 3.2x slower, and it grew
      # 5.1 GB -> 12 GB across two runs of an unchanged tree, so a disk degrades
      # the more it is used. Mounting a disk nothing reads would only cost storage.

      # Running out of RAM kills the whole VM and surfaces only as "the runner
      # has received a shutdown signal" — no mention of memory, ~12 min in. Warn
      # with the real numbers so that failure is a one-line diagnosis instead of
      # a mystery. Warn, never fail: a warm build peaks ~12 GB and a partial one
      # ~28 GB, so a 32 GB runner still completes plenty of builds, and the
      # GitHub fallback is the break-glass path — degrading it to a guaranteed
      # failure would be worse than the risk this flags.
      - name: Check runner memory headroom
        run: |
          TOTAL_GB=$(awk '/MemTotal/ {printf "%d", $2/1048576}' /proc/meminfo)
          echo "Runner memory: ${TOTAL_GB} GB"
          if [ "$TOTAL_GB" -lt 40 ]; then
            echo "::warning::Runner has ${TOTAL_GB} GB. A cold-cache build peaks ~51 GB, so this run may be OOM-killed (reported only as 'the runner has received a shutdown signal'). Warm/partial builds should still fit."
          fi

      - name: Build application
        env:
          NODE_OPTIONS: '--no-warnings --max-old-space-size=8192'
          NEXT_PUBLIC_APP_URL: 'https://www.sim.ai'
          DATABASE_URL: 'postgresql://postgres:postgres@localhost:5432/simstudio'
          STRIPE_SECRET_KEY: 'dummy_key_for_ci_only'
          STRIPE_WEBHOOK_SECRET: 'dummy_secret_for_ci_only'
          RESEND_API_KEY: 'dummy_key_for_ci_only'
          AWS_REGION: 'us-west-2'
          ENCRYPTION_KEY: '0000000000000000000000000000000000000000000000000000000000000000' # dummy key for CI only
          TURBO_CACHE_DIR: .turbo
        run: bunx turbo run build --filter=@sim/app

  # The production build e2e-mobile serves with `next start`, built in the public-env mode
  # production images use: NEXT_PUBLIC_APP_URL is docker/app.Dockerfile's localhost default, so
  # every route is dynamic and NEXT_PUBLIC_* are read at start. (Images run the standalone
  # DOCKER_BUILD server; this is the plain `next build` output.) The `build` job above keeps the
  # hosted value, under which `next build` prerenders every post. Gated like `e2e`; its own Turbo
  # cache key, so the two builds never evict each other's entries. 16 vCPU for the same reason as
  # `build`: a cold build peaks at 51 GB.
  e2e-build:
    name: build (e2e)
    needs: changes
    if: needs.changes.outputs.full == 'true'
    runs-on: ${{ (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == 'blacksmith') && 'blacksmith-16vcpu-ubuntu-2404' || 'linux-x64-8-core' }}
    timeout-minutes: 25

    steps:
      - *checkout-mirror
      - *checkout-plain

      - name: Setup workspace
        uses: ./.github/actions/setup
        with:
          provider: ${{ vars.CI_PROVIDER }}
          turbo-cache-key: turbo-cache-build-e2e

      - name: Check runner memory headroom
        run: |
          TOTAL_GB=$(awk '/MemTotal/ {printf "%d", $2/1048576}' /proc/meminfo)
          echo "Runner memory: ${TOTAL_GB} GB"
          if [ "$TOTAL_GB" -lt 40 ]; then
            echo "::warning::Runner has ${TOTAL_GB} GB. A cold-cache build peaks ~51 GB, so this run may be OOM-killed (reported only as 'the runner has received a shutdown signal'). Warm/partial builds should still fit."
          fi

      - name: Build application
        env:
          NODE_OPTIONS: '--no-warnings --max-old-space-size=8192'
          NEXT_PUBLIC_APP_URL: 'http://localhost:3000'
          DATABASE_URL: 'postgresql://postgres:postgres@localhost:5432/simstudio'
          STRIPE_SECRET_KEY: 'dummy_key_for_ci_only'
          STRIPE_WEBHOOK_SECRET: 'dummy_secret_for_ci_only'
          RESEND_API_KEY: 'dummy_key_for_ci_only'
          AWS_REGION: 'us-west-2'
          ENCRYPTION_KEY: '0000000000000000000000000000000000000000000000000000000000000000' # dummy key for CI only
          TURBO_CACHE_DIR: .turbo
          # This build is on the e2e-mobile critical path; its ~30 s TypeScript pass repeats what
          # lint's type-check and the `build` job's own `next build` (generated route types too)
          # already enforce.
          NEXT_BUILD_SKIP_TYPE_CHECK: 'true'
        run: bunx turbo run build --filter=@sim/app

      # Everything `next start` reads; node_modules and the source tree come from e2e-mobile's own
      # checkout and setup, at the same workspace path and lockfile. Source maps are over half the
      # build and only serve stack traces and devtools, which the suite never reads.
      - name: Package the build for e2e-mobile
        run: >-
          tar -I 'zstd -T0' -cf "$RUNNER_TEMP/next-build.tar.zst" -C apps/sim
          --exclude .next/cache --exclude .next/trace --exclude '*.map' .next

      # Already zstd-compressed, so stored without zip compression. `overwrite` lets a re-run of
      # this job replace the earlier attempt's build; three days covers re-running a failed shard
      # after a weekend.
      - name: Upload the build for e2e-mobile
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: next-build
          path: ${{ runner.temp }}/next-build.tar.zst
          if-no-files-found: error
          compression-level: 0
          overwrite: true
          retention-days: 3

  # One status for every check above: the single check to require on a branch ruleset, so adding,
  # sharding or renaming a job never means editing the ruleset. .github/scripts/ci-gate.sh decides:
  # a skip passes only for a gated job whose `changes` flag is exactly `false`; any other skip (a
  # failed or skipped `changes`, a lost output, an ungated job) fails, as does a failure or a
  # cancellation. A failed checkout fails the gate too.
  # `always()`, not `!cancelled()`: a skipped job satisfies a required check, so a gate that skips
  # on a cancelled run would report a cancelled head commit as passing.
  ci:
    name: ci
    needs:
      [changes, integration, e2e, e2e-mobile, desktop-live, lint, test-types, test, build, e2e-build]
    if: ${{ always() }}
    runs-on: *runner-2vcpu
    timeout-minutes: 5
    steps:
      - *checkout-mirror
      - *checkout-plain
      - name: Require every check to pass
        env:
          NEEDS: ${{ toJSON(needs) }}
        run: bash .github/scripts/ci-gate.sh