ci.yml

name: CI

on:
  push:
    branches: [master]
  pull_request:
    branches: [master]
  # Callable so the release pipeline gates on this exact workflow instead of a
  # copy of it. There is only one definition of "green", and it cannot drift.
  workflow_call:
    inputs:
      ref:
        description: 'Git ref to verify; defaults to the triggering ref'
        required: false
        type: string
  workflow_dispatch:
    inputs:
      run_wslg_receipt:
        description: 'Run the authoritative in-distro WSL2/WSLg receipt on the labeled self-hosted runner'
        required: true
        default: false
        type: boolean

# Cancel superseded runs on the same ref to save runner minutes.
concurrency:
  group: ci-${{ github.ref }}
  cancel-in-progress: true

jobs:
  frontend:
    name: Frontend (typecheck, test, build)
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
        with:
          ref: ${{ inputs.ref || github.ref }}

      - name: Set up Node.js
        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
        with:
          node-version: 22
          cache: npm

      - name: Install dependencies
        run: npm ci

      # Each check below runs even when an earlier one failed, so one run
      # reports every problem at once.
      - name: Lint
        if: ${{ !cancelled() }}
        run: npm run lint

      - name: Typecheck
        if: ${{ !cancelled() }}
        run: npm run typecheck

      - name: Test
        if: ${{ !cancelled() }}
        run: npm test

      - name: Build
        if: ${{ !cancelled() }}
        run: npm run build

  rust:
    name: Rust (fmt, clippy, test)
    # The native core (ConPTY, clipboard) is Windows-only, so it must be
    # built and tested on Windows.
    runs-on: windows-latest
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
        with:
          ref: ${{ inputs.ref || github.ref }}

      - name: Set up Rust toolchain
        uses: dtolnay/rust-toolchain@4be7066ada62dd38de10e7b70166bc74ed198c30 # stable
        with:
          components: rustfmt, clippy

      - name: Cache Cargo build
        uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2

      # A `cargo fmt` failure used to abort this job at its first step, which
      # hid the clippy and test results behind a formatting diff. Every check
      # now runs regardless, so one run reports every problem.
      - name: Check formatting
        if: ${{ !cancelled() }}
        run: cargo fmt --all -- --check

      - name: Clippy
        if: ${{ !cancelled() }}
        run: cargo clippy --workspace --all-targets -- -D warnings

      - name: Test compatibility harness
        run: cargo test -p splice-compat

      # This is deliberately separate from the workspace suite: native Windows
      # is the authority for ConPTY behavior, not a cross-compiled approximation.
      - name: ConPTY runtime regression gate (authoritative Windows)
        if: ${{ !cancelled() }}
        run: cargo test -p splice-pty --test conpty_smoke

      - name: Test
        if: ${{ !cancelled() }}
        run: cargo test --workspace

  ubuntu-runtime:
    name: Native Ubuntu PTY runtime
    runs-on: ubuntu-24.04
    timeout-minutes: 20
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
        with:
          ref: ${{ inputs.ref || github.ref }}

      - name: Set up Rust toolchain
        uses: dtolnay/rust-toolchain@4be7066ada62dd38de10e7b70166bc74ed198c30 # stable

      - name: Install Tauri build prerequisites
        run: >-
          sudo apt-get update && sudo apt-get install --yes
          libwebkit2gtk-4.1-dev libgtk-3-dev libayatana-appindicator3-dev librsvg2-dev

      - name: Run native Ubuntu PTY fixtures
        run: cargo test -p splice-pty --test platform_runtime_matrix -- --nocapture

      - name: Run platform default-shell and authority integration
        run: >-
           cargo test -p splice-pty --test session_contract &&
           cargo test -p splice-shell-desktop --test platform_authority

  wslg-runtime-receipt:
    name: WSL2/WSLg runtime receipt (manual, authoritative)
    # Generic Linux and hosted Windows do not prove this model. Successful real WSL2/WSLg receipt is required before support may be declared.
    if: ${{ github.event_name == 'workflow_dispatch' && inputs.run_wslg_receipt }}
    runs-on: [self-hosted, linux, x64, wsl2, wslg]
    timeout-minutes: 20
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
        with:
          ref: ${{ inputs.ref || github.ref }}

      - name: Verify in-distro WSL2 and WSLg prerequisites
        run: >-
          grep -q '^ID=ubuntu$' /etc/os-release &&
          grep -Eq '^VERSION_ID="(22.04|24.04)"$' /etc/os-release &&
          test -n "$WSL_DISTRO_NAME" &&
          grep -qi wsl2 /proc/sys/kernel/osrelease &&
          test -n "$WAYLAND_DISPLAY" &&
          test -n "$XDG_RUNTIME_DIR" &&
          test -S "$XDG_RUNTIME_DIR/$WAYLAND_DISPLAY" &&
          test -x /bin/sh && command -v xdg-open

      - name: Set up Rust toolchain
        uses: dtolnay/rust-toolchain@4be7066ada62dd38de10e7b70166bc74ed198c30 # stable

      - name: Run platform authority/default-shell prerequisite
        run: cargo test -p splice-shell-desktop --test platform_authority

      - name: Run WSL2/WSLg PTY receipt harness
        env:
          SPLICE_WSL_RECEIPT: artifacts/wsl-runtime-receipt.json
          SPLICE_WSL_RECEIPT_REQUIRED: 'true'
        run: cargo test -p splice-pty --test wsl_runtime_receipt -- --nocapture

      - name: Upload WSL2/WSLg machine-readable receipt
        if: ${{ always() }}
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        with:
          name: wsl2-wslg-runtime-receipt
          path: artifacts/wsl-runtime-receipt.json
          if-no-files-found: error