governance.yml

name: Governance

on:
  push:
    branches: [main]
    paths:
      - 'website/**'
      - 'pkg/**'
      - 'internal/**'
      - 'cmd/**'
      - 'tests/**'
      - '.github/workflows/governance.yml'
      - 'docs/adr/ADR-0016-direction-a-governance.md'
      - 'docs/standards/maintenance.md'
      - 'docs/CONSTRAINTS.md'
  workflow_dispatch:

permissions:
  contents: read

# Soft-fail strategy: a11y/lighthouse/godoc warnings do not block CI.
# Only the perf-budget job is hard-failing (hard budget threshold).
concurrency:
  group: governance
  cancel-in-progress: true

jobs:
  # ---- Hard gate: bundle size budget. Block merge on fail. ----
  perf-budget:
    name: Perf budget (initial JS <= 200KB gz)
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: website
    steps:
      - uses: actions/checkout@v5

      - uses: actions/setup-node@v5
        with:
          node-version: '20'

      - name: Install deps
        run: npm install --no-audit --no-fund

      - name: Build (Next export)
        run: npm run build

      - name: Run perf budget
        run: node scripts/perf-budget.mjs

      - name: Upload report
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: perf-budget
          path: ${{ github.workspace }}/website/.perf-budget.json
          retention-days: 14

  # ---- Soft gate: Lighthouse audit (homepage categories). ----
  lighthouse:
    name: Lighthouse CI (perf/a11y/bp/seo)
    runs-on: ubuntu-latest
    needs: perf-budget
    defaults:
      run:
        working-directory: website
    steps:
      - uses: actions/checkout@v5

      - uses: actions/setup-node@v5
        with:
          node-version: '20'

      - name: Install deps
        run: npm install --no-audit --no-fund

      - name: Build (Next export)
        run: npm run build

      - name: Serve static export
        working-directory: website
        run: python3 -m http.server 3000 --directory ./out &
        shell: bash

      - name: Run Lighthouse CI
        uses: treosh/lighthouse-ci-action@v9
        with:
          configPath: website/.lighthouserc.cjs
          uploadArtifacts: false
          temporaryPublicStorage: true

  # ---- Soft gate: axe-core a11y across 9 locales. ----
  a11y:
    name: axe-core a11y (9 locales)
    runs-on: ubuntu-latest
    needs: perf-budget
    steps:
      - uses: actions/checkout@v5

      - uses: actions/setup-node@v5
        with:
          node-version: '20'

      - name: Install test deps
        working-directory: tests
        run: npm install --no-audit --no-fund

      - name: Install Chromium for Playwright
        working-directory: tests
        run: npx playwright install --with-deps chromium

      - name: Build (Next export)
        working-directory: website
        run: npm install --no-audit --no-fund && npm run build

      - name: Run axe a11y
        working-directory: tests
        run: npm run test:a11y
        env:
          WEBSITE_OUT_DIR: ${{ github.workspace }}/website/out

      - name: Upload a11y logs
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: a11y-logs
          path: ${{ github.workspace }}/tests/test-results/
          retention-days: 14

  # ---- Soft gate: end-to-end RAG + memory demo through Director. ----
  rag-demo:
    name: RAG + memory demo (Director end-to-end)
    runs-on: ubuntu-latest
    continue-on-error: true
    steps:
      - uses: actions/checkout@v5

      - uses: actions/setup-go@v6
        with:
          go-version: "1.25"

      - name: Build CLI
        run: go build ./cmd/aicodingagentteam/...

      - name: Run knowledge demo
        run: go run ./cmd/aicodingagentteam knowledge demo

      - name: Upload demo report
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: rag-demo
          path: |
            .aicodingagentteam/demo-report.md
            .aicodingagentteam/demo-report.json
          retention-days: 14

  # ---- Soft gate: real host driver end-to-end (codex stub binary, no API key). ----
  host-e2e:
    name: Host driver e2e (codex stub binary)
    runs-on: ubuntu-latest
    continue-on-error: true
    steps:
      - uses: actions/checkout@v5

      - uses: actions/setup-go@v6
        with:
          go-version: "1.25"

      - name: Make stub binary executable
        run: chmod +x testdata/stubbin/codex

      - name: Build CLI
        run: go build ./cmd/aicodingagentteam/...

      - name: Run host driver e2e tests
        run: go test ./internal/scheduler/... -run "TestScheduler_HostE2E" -v

      - name: Upload host artifacts
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: host-e2e
          path: |
            .aicodingagentteam/host/
          retention-days: 14
          if-no-files-found: ignore

  # ---- Soft gate: regenerate Go API docs and upload artifact. ----
  godocgen:
    name: Go public API docs (godocgen)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5
        with:
          fetch-depth: 0

      - uses: actions/setup-go@v6
        with:
          go-version: '1.25'

      - name: Generate godoc (9 locales)
        run: go run ./cmd/godocgen --locale=en,zh,ja,ko,fr,de,ru,es,it --version=${{ github.sha }}

      - name: Smoke test (9 locale indexes exist)
        run: |
          for locale in en zh ja ko fr de ru es it; do
            test -f "website/content/docs/api/$locale/index.md"
          done

      - name: Upload godoc artifact
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: godocgen
          path: ${{ github.workspace }}/website/content/docs/api/
          retention-days: 14

  # ---- Soft gate: CLI smoke tests for cmd/aicodingagentteam + cmd/godocgen. ----
  cli-smoke:
    name: CLI smoke (cmd/aicodingagentteam + cmd/godocgen)
    runs-on: ubuntu-latest
    continue-on-error: true
    steps:
      - uses: actions/checkout@v5

      - uses: actions/setup-go@v6
        with:
          go-version: "1.25"

      - name: Build CLI binaries
        run: |
          go build ./cmd/aicodingagentteam/...
          go build ./cmd/godocgen/...

      - name: CLI smoke -- version subcommand
        run: go run ./cmd/aicodingagentteam version

      - name: CLI smoke -- knowledge demo
        run: go run ./cmd/aicodingagentteam knowledge demo

      - name: CLI smoke -- godocgen (en)
        run: go run ./cmd/godocgen --locale=en --version=test

      - name: Run unit tests for cmd packages
        run: go test ./cmd/... -cover

      - name: Upload smoke logs
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: cli-smoke
          path: |
            .aicodingagentteam/demo-report.md
            .aicodingagentteam/demo-report.json
          retention-days: 14
          if-no-files-found: ignore

  # ---- Summary job: aggregates results in the GitHub Actions UI. ----
  summary:
    name: Governance summary
    runs-on: ubuntu-latest
    needs: [perf-budget, lighthouse, a11y, rag-demo, host-e2e, godocgen, cli-smoke]
    if: always()
    steps:
      - name: Summarize
        run: |
          echo "### Governance results" >> "$GITHUB_STEP_SUMMARY"
          echo "" >> "$GITHUB_STEP_SUMMARY"
          echo "- perf-budget: ${{ needs.perf-budget.result }}" >> "$GITHUB_STEP_SUMMARY"
          echo "- lighthouse:  ${{ needs.lighthouse.result }}" >> "$GITHUB_STEP_SUMMARY"
          echo "- a11y:        ${{ needs.a11y.result }}" >> "$GITHUB_STEP_SUMMARY"
          echo "- godocgen:    ${{ needs.godocgen.result }}" >> "$GITHUB_STEP_SUMMARY"
          echo "- host-e2e:    ${{ needs.host-e2e.result }}" >> "$GITHUB_STEP_SUMMARY"
          echo "- rag-demo:    ${{ needs.rag-demo.result }}" >> "$GITHUB_STEP_SUMMARY"
          echo "- cli-smoke:   ${{ needs.cli-smoke.result }}" >> "$GITHUB_STEP_SUMMARY"