ci.yml

name: CI

on:
  push:
    branches: [main]
  pull_request:

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  unit:
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@v5
      - uses: actions/setup-node@v5
        with:
          node-version: 22
          cache: npm
      - run: npm run check:lockfile
      - run: npm ci
      # The pi print/RPC test loads the extension the way pi does, through the
      # package's own entry points, so dist has to exist before the unit run.
      - run: npm run build --workspace @onkernel/browser-loop
      - name: Unit tests
        run: npm test --workspace @onkernel/browser-loop
      - name: Pack tarball
        run: npm pack --workspace @onkernel/browser-loop --pack-destination "$RUNNER_TEMP"
      - name: ESM import smoke test
        run: |
          mkdir -p "$RUNNER_TEMP/esm-smoke"
          cd "$RUNNER_TEMP/esm-smoke"
          npm init -y
          npm install "$RUNNER_TEMP"/onkernel-browser-loop-*.tgz
          node --input-type=module -e "import('@onkernel/browser-loop').then((m) => { if (typeof m.compileLoopToolCatalog !== 'function') process.exit(1); })"
          node --input-type=module -e "import('@onkernel/browser-loop/pi').then((m) => { if (typeof m.attach !== 'function') process.exit(1); })"

  typecheck-and-ptywright:
    runs-on: ubuntu-latest
    timeout-minutes: 15
    env:
      PTYWRIGHT_ZIG_VERSION: "0.15.2"
    steps:
      - uses: actions/checkout@v5
      - uses: actions/setup-node@v5
        with:
          node-version: 22
          cache: npm
      - run: npm ci
      - name: Cache Zig toolchain
        uses: actions/cache@v4
        with:
          path: .dev/tools/zig-x86_64-linux-${{ env.PTYWRIGHT_ZIG_VERSION }}
          key: zig-${{ runner.os }}-${{ env.PTYWRIGHT_ZIG_VERSION }}
      - name: Install Zig ${{ env.PTYWRIGHT_ZIG_VERSION }}
        run: |
          set -euo pipefail
          ZIG_DIR=".dev/tools/zig-x86_64-linux-${PTYWRIGHT_ZIG_VERSION}"
          if [ ! -x "${ZIG_DIR}/zig" ]; then
            mkdir -p .dev/tools
            curl -fsSL "https://ziglang.org/download/${PTYWRIGHT_ZIG_VERSION}/zig-x86_64-linux-${PTYWRIGHT_ZIG_VERSION}.tar.xz" \
              | tar -xJ -C .dev/tools
          fi
          "${ZIG_DIR}/zig" version
          echo "${GITHUB_WORKSPACE}/${ZIG_DIR}" >> "${GITHUB_PATH}"
      - name: Cache ptywright native artifacts
        uses: actions/cache@v4
        with:
          path: |
            packages/ptywright/.cache
            packages/ptywright/native/build
          key: ptywright-${{ runner.os }}-${{ hashFiles('packages/ptywright/GHOSTTY_UPSTREAM', 'packages/ptywright/native/**', 'packages/ptywright/scripts/**') }}
      # The only job that typechecks the whole project graph rather than one
      # package, and the only one that builds and tests ptywright.
      - name: Typecheck workspace
        run: npx tsc -b
      - name: Build ptywright (native binding)
        run: npm run build --workspace @onkernel/ptywright
      - name: Ptywright tests
        run: npm test --workspace @onkernel/ptywright

  integration:
    runs-on: ubuntu-latest
    timeout-minutes: 15
    # Only run on the main repo (not forks) so secrets are available.
    # Skip draft PRs; still run on every commit to non-draft PRs and on main pushes.
    if: github.event_name == 'push' || (github.event.pull_request.head.repo.full_name == github.repository && !github.event.pull_request.draft)
    steps:
      - uses: actions/checkout@v5
      - uses: actions/setup-node@v5
        with:
          node-version: 22
          cache: npm
      - run: npm ci
      - name: Integration tests
        env:
          OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
          ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
          GOOGLE_API_KEY: ${{ secrets.GOOGLE_API_KEY }}
          XAI_API_KEY: ${{ secrets.XAI_API_KEY }}
          MOONSHOT_API_KEY: ${{ secrets.MOONSHOT_API_KEY }}
        run: npm run test:integration --workspace @onkernel/browser-loop

  live-e2e:
    runs-on: ubuntu-latest
    timeout-minutes: 45
    # Only run on the main repo (not forks) so secrets are available.
    # Skip draft PRs; still run on every commit to non-draft PRs and on main pushes.
    if: github.event_name == 'push' || (github.event.pull_request.head.repo.full_name == github.repository && !github.event.pull_request.draft)
    steps:
      - uses: actions/checkout@v5
      - uses: actions/setup-node@v5
        with:
          node-version: 22
          cache: npm
      - run: npm ci
      - name: Live smoke tests (all providers)
        env:
          LOOP_E2E_LIVE: "1"
          KERNEL_API_KEY: ${{ secrets.KERNEL_API_KEY }}
          OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
          ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
          GOOGLE_API_KEY: ${{ secrets.GOOGLE_API_KEY }}
          XAI_API_KEY: ${{ secrets.XAI_API_KEY }}
          MOONSHOT_API_KEY: ${{ secrets.MOONSHOT_API_KEY }}
        run: npm run test:integration --workspace @onkernel/browser-loop -- test/e2e.live.test.ts