ci.yml

name: CI

on:
  push:
    branches: [main]
  pull_request:

concurrency:
  group: ci-${{ github.ref }}
  cancel-in-progress: true

env:
  DENO_VERSION: "2.9.5"
  WASM_TOOLS_VERSION: "1.247.0"
  JUST_VERSION: "1.54.0"

jobs:
  core:
    strategy:
      fail-fast: false
      matrix:
        # Dev parity is linux-arm64; ubuntu-24.04 (x64) is deliberately part
        # of the matrix — CI is the project's first non-arm validation.
        runner: [ubuntu-24.04, ubuntu-24.04-arm]
    runs-on: ${{ matrix.runner }}
    timeout-minutes: 45
    steps:
      - uses: actions/checkout@v4
        with:
          submodules: true # third_party/component-model: testgen + conformance corpus
      - uses: dtolnay/rust-toolchain@stable
        with:
          targets: wasm32-unknown-unknown,wasm32-wasip2
      - uses: Swatinem/rust-cache@v2
      - uses: taiki-e/install-action@v2
        with:
          tool: wasm-tools@${{ env.WASM_TOOLS_VERSION }},just@${{ env.JUST_VERSION }}
      - uses: denoland/setup-deno@v2
        with:
          deno-version: ${{ env.DENO_VERSION }}

      # The job body lives in the `gha` just module (one workflow job = one
      # `gha::` recipe, so `just ci` is exactly CI); step-level rationale
      # lives on the root-justfile recipes it composes. Suite order and
      # arch-conditional lanes (jsc-pinned is x64-only) are all encoded
      # there.
      #
      # The env below is the only thing the version guard's `pr` mode needs
      # (its first step): it reads the PR's LIVE labels and diffs against the
      # base. All three are empty on push runs, where the guard skips itself —
      # deliberately, since there is no PR to have labels. Note that label
      # edits do NOT re-trigger this workflow (no `types:` addition above, on
      # purpose): the PR pass is an early warning, release.yml's `cut` mode is
      # the enforcement point, and a re-run picks up corrected labels.
      - run: just gha::core
        env:
          PR_NUMBER: ${{ github.event.pull_request.number }}
          PR_BASE_SHA: ${{ github.event.pull_request.base.sha }}
          GH_TOKEN: ${{ github.token }}

  browser:
    runs-on: ubuntu-24.04
    timeout-minutes: 45
    # Post-merge only (operator decision, issue #22 follow-up): the
    # conformance corpus is engine-shaped, and per-PR/per-push engine
    # coverage now comes from the pinned shell lanes in the `core` job
    # above (sm-pinned, jsc-pinned) at fixed, sha256-verified pins. The
    # browser lanes verify something the shell lanes can't — the embedding
    # (real DOM/Worker/fetch globals) plus the SHIPPED-CHANNEL config
    # (e.g. Firefox's JSPI pref, which this lane sets explicitly — unlike
    # the jsshell, which has JSPI on by default; see
    # harness/shell/expectations/sm-pinned.ts) — so they stay as the gate
    # for the post-merge prerelease (`release`, below), which is the compat
    # matrix for now (revisit when real releases exist).
    if: github.event_name == 'push'
    steps:
      - uses: actions/checkout@v4
        with:
          submodules: true
      - uses: dtolnay/rust-toolchain@stable
        with:
          targets: wasm32-unknown-unknown,wasm32-wasip2
      - uses: Swatinem/rust-cache@v2
      - uses: taiki-e/install-action@v2
        with:
          tool: wasm-tools@${{ env.WASM_TOOLS_VERSION }},just@${{ env.JUST_VERSION }}
      - uses: denoland/setup-deno@v2
        with:
          deno-version: ${{ env.DENO_VERSION }}

      - name: cache playwright browsers
        uses: actions/cache@v4
        with:
          # run-lane.ts pins playwright@1.62.1 and a REPO-LOCAL browser cache
          # (PLAYWRIGHT_BROWSERS_PATH=$PWD/.browser-cache) — cache that path,
          # not ~/.cache/ms-playwright (rehearsal finding). The recipe's
          # install step below restores into it.
          path: .browser-cache
          key: playwright-1.62.1-${{ runner.os }}-${{ runner.arch }}

      # shim + corpus + browser install (--with-deps) + the chromium/firefox
      # required lanes + the best-effort webkit lane, per the recipes.
      - run: just gha::browser

  # Every GREEN main ref update ships a GitHub PRERELEASE: tag
  # pre-<shorthash>, shim artifacts + SHA256SUMS, and nothing on a registry
  # — JSR and npm carry cut releases only (#223). Gated on this same run's
  # core matrix + browser job, so "green" is the release criterion by
  # construction, and the prerelease doubles as the proof a cut later
  # requires ("a pre-<shorthash> release exists for this commit"). Notes:
  # (a) the concurrency group above cancels superseded runs, so rapid
  # consecutive pushes release only the surviving tip — a cancelled run was
  # never green; (b) continue-on-error steps (the webkit lane) do not block
  # a release, by the same policy that keeps them non-blocking in CI.
  release:
    needs: [core, browser]
    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
    # The prerelease path only ever uses `contents: write` (create a GitHub
    # release, upload assets) — no registry is published from a prerelease,
    # so id-token (JSR OIDC) and actions (the npm dispatch) are dead weight
    # here. They are granted anyway BECAUSE THEY MUST BE: a reusable-workflow
    # call fails at STARTUP unless the caller grants everything the called
    # workflow's `permissions` block requests, if-skipped steps included
    # (observed on #223: "requesting 'actions: write, id-token: write', but
    # is only allowed 'none'"), and release.yml requests all three for its
    # cut mode. The unused tokens are inert: the steps that would spend them
    # are `if: inputs.release`, which a workflow_call run cannot set.
    permissions:
      contents: write
      id-token: write # unused here; required by release.yml's request (cut mode)
      actions: write # ditto
    uses: ./.github/workflows/release.yml