ci.yml

name: ci

on:
  push:
  pull_request:

# Same-repo PRs already ran on the head-branch push. Keep pull_request for forks.
concurrency:
  group: ci-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true

jobs:
  # No-Zig checks — always enforced. The SDKs are committed, so they can be
  # validated without building the binary.
  sdk:
    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.fork
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7

      - name: Pinned Zig installer integrity tests
        run: python3 scripts/test-install-zig-ci.py

      - name: Zig source-size guard integrity tests
        run: python3 scripts/test-zig-lines.py

      - name: Tuiguard pool deadline integrity (#704)
        run: python3 scripts/eval/test_tier1_tuiguard.py

      - name: Behavioral outcome verifier integrity
        run: python3 scripts/eval/test_tier2_outcomes.py

      - name: Model-shape benchmark integrity
        run: python3 benchmarks/test_model_shape.py

      - name: Spec kernel conformance (properties + fixture staleness)
        run: python3 spec/conformance.py

      - name: Python SDK import smoke
        run: python3 -c "import sys; sys.path.insert(0, 'sdk/py'); import harness_sdk; assert harness_sdk.MODELS and harness_sdk.TOOLS; print('py sdk ok:', len(harness_sdk.MODELS), 'models')"

      - uses: actions/setup-node@v7
        with:
          node-version: 22

      - uses: oven-sh/setup-bun@v2

      - name: TypeScript SDK test, typecheck, build, and package smoke
        working-directory: sdk/ts
        run: |
          npm install --ignore-scripts --workspaces=false
          bun test
          npm run typecheck
          npm run build
          npm pack --dry-run
          npm run test:packed
          node -e "import('./dist/harness.js').then(m => { if (!m.Harness || !m.runAgent || !m.MODELS) throw new Error('missing exports'); console.log('ts sdk ok:', m.MODELS.length, 'models'); })"

  # Zig build / fmt / test + SDK drift, pinned to the exact 0.17 dev build the
  # codebase targets.
  zig:
    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.fork
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7

      - name: Install Zig
        uses: ./.github/actions/setup-codegraff-zig

      - name: zig build
        run: zig build

      - name: zig fmt --check
        run: zig fmt --check src build.zig

      - name: Zig source size guard
        run: bash scripts/check-zig-lines.sh

      - name: zig build test
        run: zig build test --summary all

      - name: Publication, handoff, deferred MCP and legacy listener regressions
        run: |
          command -v lsof || (sudo apt-get update && sudo apt-get install -y lsof)
          python3 scripts/eval/test_tier1_count.py
          python3 scripts/eval/test_process_guard.py
          python3 scripts/test-acp-failure.py
          python3 scripts/regression-release-297.py
          python3 scripts/test-server-retention.py --evidence "$RUNNER_TEMP/server-retention"
          python3 scripts/test-pr-completion-acp.py
          python3 scripts/test-claim-repository.py
          python3 scripts/test-claim-lifecycle.py
          python3 scripts/eval-tier2.py --only repository-scoped-claim-release
          python3 scripts/eval-tier2.py --only passing-draft-is-still-unverified --only base-failure-cannot-waive-pr-completion --only draft-handoff-needs-no-user-command --only ready-pr-failing-ci-defers --only legacy-pr-acceptance-option-is-ignored --only current-head-passing-pr-completes

      - name: Title command result contract
        run: python3 scripts/test-title-result.py

      - name: Bounded codedb guard probes
        run: |
          for outcome in timeout failure unindexed indexed; do
            python3 scripts/test-codedb-probe-deadline.py --first "$outcome" --output "$RUNNER_TEMP/codedb-probe-$outcome"
          done
          python3 scripts/test-codedb-probe-deadline.py --nested --output "$RUNNER_TEMP/codedb-probe-nested"
          python3 scripts/test-codedb-probe-deadline.py --cancel --output "$RUNNER_TEMP/codedb-probe-cancel"

      - name: Observed local checks before publication
        run: python3 scripts/test-pr-local-checks.py --graff zig-out/bin/graff --evidence /tmp/pr-local-checks

      - name: Committed claim review before publication
        run: |
          for verdict in unsupported unresolved invalid supported; do
            python3 scripts/test-pr-claim-review.py --case "$verdict"
          done
          python3 scripts/test-pr-claim-review.py --case unsupported --plain
          python3 scripts/test-pr-claim-review.py --case unsupported --oneshot
          python3 scripts/test-pr-claim-review.py --case supported --budget-exhausted
          python3 scripts/test-pr-claim-review.py --case supported --ready --repo
          python3 scripts/test-pr-claim-review.py --case unsupported --ready --repo
          python3 scripts/test-pr-review-cancel.py
          python3 scripts/test-pr-claim-review.py --case supported --url
          python3 scripts/test-pr-claim-review.py --case supported --changed-body

      - name: Multi-turn clarification, editing and recovery workflows
        run: python3 scripts/eval-tier2.py --only human-workflow-clarify-edit-recover-followup --only human-workflow-missing-config-clarify-followup --evidence-dir "$RUNNER_TEMP/interactive-workflows"

      - name: Local learning lifecycle and security regression
        run: python3 tests/learn_e2e.py --graff zig-out/bin/graff

      - name: Zero-configuration learning bootstrap
        run: python3 tests/learn_bootstrap_e2e.py --graff zig-out/bin/graff

      - name: Evolutionary tournament and behavioral metric regression
        run: |
          python3 tests/learn_tournament_e2e.py --graff zig-out/bin/graff
          python3 tests/learn_graff_adapters.py
          python3 tests/learn_graff_evaluator_retries.py

      - name: Behavioral trace stream, re-scorer, and replay round trip
        run: python3 scripts/test-behavior-trace.py zig-out/bin/graff

      - name: Concurrent operational trace isolation and JSONL integrity
        run: python3 scripts/test-run-isolation.py zig-out/bin/graff

      - name: JSON live-control and mid-turn cancellation tests
        run: |
          python3 scripts/test-json-controls.py zig-out/bin/graff
          python3 scripts/test-json-cancel.py zig-out/bin/graff

      - name: Fresh-process session catalog and layout restoration
        run: python3 scripts/test-resume-cache.py --graff zig-out/bin/graff --mode offline --out "$RUNNER_TEMP/resume-cache"

      - name: ACP cancellation and same-session follow-up
        run: python3 scripts/test-acp-steer.py zig-out/bin/graff

      - name: Isolated read-only review regression
        run: |
          python3 scripts/test-review-mode.py zig-out/bin/graff
          python3 scripts/test-review-deadline.py zig-out/bin/graff
          python3 scripts/test-review-acp.py zig-out/bin/graff
          python3 scripts/test-review-acp-checkpoint.py zig-out/bin/graff

      - name: Automatic learning bootstrap and its idle-workspace guard
        run: python3 scripts/test-learn-auto-init.py zig-out/bin/graff

      - name: Streamable HTTP MCP handshake and session regression
        run: python3 scripts/test-mcp-streamable-http.py --graff zig-out/bin/graff

      - name: Optional MCP project opt-in and startup consent
        run: python3 scripts/test-mcp-optional.py zig-out/bin/graff

      - name: Embedder mode --no-local-tools gate (#330)
        run: python3 scripts/test-no-local-tools.py --graff zig-out/bin/graff

      - name: Embedder mode resumable serve streams (#330)
        run: python3 scripts/test-serve-resume.py zig-out/bin/graff

      - name: Over-cap tool output spills to a session artifact (#409)
        run: python3 scripts/test-spill-artifact.py zig-out/bin/graff

      - name: Live JSON stream contains no raw stdout lines
        run: python3 scripts/test-json-live.py zig-out/bin/graff

      - name: PTY spinner anti-stealth test
        run: python3 scripts/test-pty-spinner.py zig-out/bin/graff

      - name: YOLO background-TTY job-control regression
        run: python3 scripts/test-yolo-job-control.py zig-out/bin/graff

      - name: Backgrounded prompt releases the TTY instead of suspending (#396)
        run: python3 scripts/test-tty-release-on-exit.py zig-out/bin/graff

      - name: PTY REPL interaction test
        run: python3 scripts/test-pty-repl.py zig-out/bin/graff

      - name: Terminal model-selection confirmation regression
        run: python3 scripts/test-model-confirmation.py zig-out/bin/graff

      - name: PTY Markdown rendering test
        run: python3 scripts/test-pty-markdown.py zig-out/bin/graff

      - name: Parallel bash Esc cancellation test (#266)
        run: python3 scripts/test-pty-parallel-cancel.py zig-out/bin/graff

      - name: PTY model preference and fallback test
        run: python3 scripts/test-model-preference.py zig-out/bin/graff

      - name: Root and subagent model-shape routing
        run: python3 scripts/test-model-shape.py zig-out/bin/graff

      - name: Codex WS/SSE transport and mid-turn compaction test
        run: python3 scripts/test-pty-codex-ws.py zig-out/bin/graff

      - name: Concurrent Codex WS interactive sessions (#480)
        run: python3 scripts/test-pty-codex-ws-concurrent.py zig-out/bin/graff

      - name: PTY /goal autonomous collapse wiring test
        run: python3 scripts/test-pty-goal-loop.py zig-out/bin/graff

      - name: PTY peer-channel delivery smoke test (#469)
        run: python3 scripts/test-pty-peer-channel.py zig-out/bin/graff

      - name: AI title and first turn run in parallel
        run: python3 scripts/test-title-parallel.py zig-out/bin/graff

      - name: Stream stall/drop is not a user Esc (#134/#132)
        run: python3 scripts/test-stall-drop.py zig-out/bin/graff

      - name: Newer-issue E2E — blank sessions not persisted (#184)
        run: python3 scripts/test-e2e-newer-issues.py zig-out/bin/graff

      - name: Expired codex token recovered mid-turn, retry carries it (#402)
        run: python3 scripts/test-codex-auth-recovery.py zig-out/bin/graff

      - name: SDK generation drift
        run: |
          python3 sdk/generate.py --harness ./zig-out/bin/graff
          git diff --exit-code sdk/ \
            || (echo "::error::SDKs are stale — run: python3 sdk/generate.py --harness ./zig-out/bin/graff" && exit 1)

  # Windows build + smoke — the harness has a Win32 console backend, so verify
  # it compiles, passes tests, and the binary loads + runs on a real Windows
  # runner (the macOS/Linux jobs above can't exercise the console backend).
  windows:
    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.fork
    runs-on: windows-latest
    steps:
      - uses: actions/checkout@v7

      - name: Install Zig
        uses: ./.github/actions/setup-codegraff-zig

      - name: zig build
        run: zig build

      - name: zig build test
        run: zig build test --summary all

      - name: Local learning lifecycle and security regression (Windows)
        run: python3 tests/learn_e2e.py --graff zig-out/bin/graff.exe

      - name: smoke --version
        shell: cmd
        run: zig-out\bin\graff.exe --version

      - name: smoke --help
        shell: cmd
        run: zig-out\bin\graff.exe --help