ci.yml

name: CI

on:
  push:
    branches: [main]
  pull_request:
  workflow_dispatch:

concurrency:
  group: ci-${{ github.workflow }}-${{ github.event_name == 'push' && github.sha || github.ref }}
  cancel-in-progress: ${{ github.event_name != 'push' }}

jobs:
  # oxfmt, oxlint, and typecheck share one runner: one checkout and one
  # install instead of three of each. Dummy job names prettier and eslint
  # stay for protect-main.
  static-analysis:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup Bun
        uses: oven-sh/setup-bun@v2
        with:
          bun-version: "1.3.14"

      - name: Cache dependencies
        uses: actions/cache@v4
        with:
          path: node_modules
          # Exact-key-only: a restore-keys prefix of bun- would hydrate
          # node_modules from a different lockfile. bun install then has to
          # reconcile a stale tree; missing that step leaves wrong deps.
          key: bun-${{ hashFiles('bun.lock') }}

      - name: Install dependencies
        run: bun install --frozen-lockfile

      - name: oxfmt
        run: bunx oxfmt --check .

      - name: oxlint
        run: bunx oxlint .

      - name: Typecheck
        run: bun run typecheck

  # Build runs beside the suite instead of before it: tests import ./src
  # directly and never read ./dist, so serializing build ahead of test put
  # build time on the critical path for no dependency reason.
  build:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup Node
        uses: actions/setup-node@v4
        with:
          node-version: "24"

      - name: Setup Bun
        uses: oven-sh/setup-bun@v2
        with:
          bun-version: "1.3.14"

      - name: Cache dependencies
        uses: actions/cache@v4
        with:
          path: node_modules
          key: bun-${{ hashFiles('bun.lock') }}

      - name: Install dependencies
        run: bun install --frozen-lockfile

      - name: Build
        run: bun run build

  # The suite is sharded so the slowest slice, not the whole suite, sets the
  # wall clock. Every shard still goes through check:projects-dir-guard: the
  # guard forwards these path filters to the suite it wraps, and the union of
  # the shards' filters is exactly ./src ./tests ./evals ./scripts, so the gate covers
  # the same tests as before, all of them sandboxed.
  test:
    runs-on: ubuntu-latest
    strategy:
      # A red shard must not cancel the other; both results are the signal.
      fail-fast: false
      matrix:
        shard:
          - name: src
            paths: ./src
          - name: tests-evals-and-scripts
            paths: ./tests ./evals ./scripts
    name: test (${{ matrix.shard.name }})
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup Node
        uses: actions/setup-node@v4
        with:
          node-version: "24"

      - name: Setup Bun
        uses: oven-sh/setup-bun@v2
        with:
          bun-version: "1.3.14"

      # The runner image has no ripgrep, so the grep plugin silently exercised
      # its fallback walker and left the ripgrep path untested.
      - name: Install ripgrep
        run: sudo apt-get install -y ripgrep

      - name: Cache dependencies
        uses: actions/cache@v4
        with:
          path: node_modules
          key: bun-${{ hashFiles('bun.lock') }}

      - name: Install dependencies
        run: bun install --frozen-lockfile

      # The same script the local `bun run check` gate runs, with the shard's
      # path filters forwarded through the guard to the suite. The guard
      # routes a filtered run through test:paths, which carries the same
      # seeded flags as the `test` script; bun test filters are additive, so
      # appending filters to `bun run test` could not narrow it. Randomized
      # order catches tests that only pass in the default file order (shared
      # module-level state, an unrestored global mock, a leaked env var).
      # The seed stays 424242 in every shard rather than varying per shard:
      # the shards already run disjoint file sets, and a fixed seed keeps
      # any failure reproducible locally with the same
      # `bun run test:paths <paths>`.
      - name: Test
        run: bun run check:projects-dir-guard ${{ matrix.shard.paths }}

  # protect-main still requires the pre-restructure check names. These jobs
  # exist only to publish those contexts after the real work succeeds.
  prettier:
    needs: static-analysis
    runs-on: ubuntu-latest
    steps:
      - run: "true"

  eslint:
    needs: static-analysis
    runs-on: ubuntu-latest
    steps:
      - run: "true"

  typecheck:
    needs: static-analysis
    runs-on: ubuntu-latest
    steps:
      - run: "true"

  build-and-test:
    needs: [build, test]
    runs-on: ubuntu-latest
    steps:
      - run: "true"