ci.yml

# CI — runs on every pull request, whatever its base branch.
#
# Stacked pull requests target another feature branch rather than develop.
# Filtering by base branch left those PRs with no typecheck, lint, test, or
# clippy signal at all, so a defect could only be found after the whole stack
# landed. The scope job below still keeps the cost proportional to the diff.
#
# Frontend starts immediately. A lightweight scope job decides whether the
# Rust job is relevant; frontend and ordinary Markdown documentation diffs
# keep the required Rust check but mark it skipped/successful without
# allocating a macOS runner.
#
# Within the frontend job, lint covers only the files the pull request changed
# (see scripts/ci/select-lint-targets.cjs), and unit tests cover only the test
# files whose import graphs reach the diff, plus the guard tests that read
# files outside their imports (see scripts/ci/select-unit-tests.cjs).
# unit-tests-develop.yml runs the whole unit suite on every push to develop.
# Typecheck stays whole-repo.
#
# Gitleaks independently scans full HEAD history against an exact reviewed baseline.
#
# Mirrors the toolchain versions used in release.yaml (Node 20, pnpm 9,
# Rust stable, swatinem/rust-cache) so CI and release builds stay in sync.

name: "CI"

on:
  pull_request:

# A new push makes an older run for the same PR obsolete. Cancel it before it
# can consume one of the organization's limited hosted-runner slots.
concurrency:
  group: ci-pr-${{ github.event.pull_request.number }}
  cancel-in-progress: true

permissions:
  contents: read

jobs:
  # ── Secret scan ────────────────────────────────────────────────────────────
  gitleaks:
    name: Gitleaks secret scan
    runs-on: ubuntu-latest
    timeout-minutes: 10

    steps:
      - name: Checkout (full history)
        uses: actions/checkout@v6
        with:
          fetch-depth: 0

      - name: Test secret scanning policy
        env:
          GITLEAKS_DOCKER_IMAGE: ghcr.io/gitleaks/gitleaks:v8.24.3
        run: node --test scripts/security/gitleaks.test.cjs

      - name: Scan git history for secrets
        run: >
          docker run --rm
          -v "$PWD:/repo"
          -e GIT_CONFIG_COUNT=1
          -e GIT_CONFIG_KEY_0=safe.directory
          -e GIT_CONFIG_VALUE_0=/repo
          ghcr.io/gitleaks/gitleaks:v8.24.3
          git /repo --log-opts=HEAD --no-banner --redact --verbose
          --config /repo/config/gitleaks.toml
          --gitleaks-ignore-path /repo/config/gitleaksignore

  # ── Change scope ────────────────────────────────────────────────────────────
  changes:
    name: Detect CI scope
    runs-on: ubuntu-latest
    outputs:
      rust_required: ${{ steps.scope.outputs.rust_required }}
      audit_required: ${{ steps.scope.outputs.audit_required }}

    steps:
      - name: Checkout
        uses: actions/checkout@v6
        with:
          fetch-depth: 0

      - name: Detect Rust and audit scope
        id: scope
        env:
          BASE_SHA: ${{ github.event.pull_request.base.sha }}
          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
        run: |
          # One diff read by both detectors: clippy and cargo audit consume
          # different inputs, and re-running git would let the two answers
          # describe different trees.
          git diff --name-only -z "${BASE_SHA}...${HEAD_SHA}" \
            > "${RUNNER_TEMP}/changed-paths"

          rust_required="$(
            node scripts/ci/detect-rust-changes.cjs \
              < "${RUNNER_TEMP}/changed-paths"
          )"
          audit_required="$(
            node scripts/ci/detect-audit-changes.cjs \
              < "${RUNNER_TEMP}/changed-paths"
          )"

          echo "rust_required=${rust_required}" >> "${GITHUB_OUTPUT}"
          echo "audit_required=${audit_required}" >> "${GITHUB_OUTPUT}"
          echo "Rust required: ${rust_required}"
          echo "Audit required: ${audit_required}"

  # ── Frontend ────────────────────────────────────────────────────────────────
  frontend:
    name: Frontend (typecheck · lint · test)
    runs-on: ubuntu-latest

    steps:
      # fetch-depth 0 so the file-length and lint-scope steps below can diff
      # base..head. The `changes` job pays the same cost in ~10s.
      - name: Checkout
        uses: actions/checkout@v6
        with:
          fetch-depth: 0

      - name: Setup pnpm
        uses: pnpm/action-setup@v6

      - name: Setup Node.js
        uses: actions/setup-node@v6
        with:
          node-version: "20"
          cache: "pnpm"

      - name: Test CI policy helpers
        run: node --test scripts/ci/*.test.cjs

      # TypeScript files (.ts/.tsx under src/) a pull request touches must stay
      # within 700 lines. Only the diff is judged: a long file nobody edits
      # never fails a build, and it gets split the next time a pull request
      # changes it. Markdown, JSON, styles, and Rust are out of scope. Needs
      # only git and node, so it runs before the dependency install.
      # `shell: bash` adds pipefail, so a failed diff fails the step instead of
      # passing an empty file list.
      - name: File length (changed files)
        shell: bash
        env:
          BASE_SHA: ${{ github.event.pull_request.base.sha }}
          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
        run: |
          git diff --name-only --diff-filter=ACMR -z "${BASE_SHA}...${HEAD_SHA}" |
            node scripts/ci/check-changed-file-length.cjs

      # warm-frontend-cache.yml publishes this same key from develop after
      # lockfile-changing merges, so a PR's first run restores the base
      # branch's cache. Keep the key in sync with that workflow.
      - name: Cache node_modules
        uses: actions/cache@v5
        with:
          path: node_modules
          key: node-modules-${{ runner.os }}-${{ hashFiles('pnpm-lock.yaml') }}

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      # tsgo (@typescript/native-preview): native full-project check,
      # measured ~10s idle vs 65s warm-incremental / >10min cold for tsc on
      # this codebase. tsc remains the arbiter in nightly-full-checks.yml —
      # if the preview compiler ever disagrees, nightly surfaces it within
      # 24h and this step can be pointed back at `pnpm typecheck`.
      - name: Type check (tsgo)
        run: pnpm typecheck:fast

      # Every rule in package.json#eslintConfig judges one file at a time, so a pull request
      # cannot make an untouched file newly non-compliant; whole-tree linting
      # spent ~3m45s re-proving 6000+ unchanged files. Diffs that change the
      # rules themselves still lint everything -- see select-lint-targets.cjs.
      - name: Select lint targets
        id: lint_scope
        env:
          BASE_SHA: ${{ github.event.pull_request.base.sha }}
          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
        run: |
          git diff --name-only --diff-filter=ACMR -z "${BASE_SHA}...${HEAD_SHA}" |
            node scripts/ci/select-lint-targets.cjs \
              --out "${RUNNER_TEMP}/lint-targets" >> "${GITHUB_OUTPUT}"

      - name: Lint (full tree)
        if: steps.lint_scope.outputs.lint_mode == 'all'
        run: pnpm lint

      - name: i18n contracts
        run: pnpm check:i18n:contracts

      - name: Web production build
        run: pnpm build:web
        env:
          NODE_OPTIONS: "--max-old-space-size=6144"

      # nightly-full-checks.yml relints the whole tree once a day, so a rule
      # that starts failing on untouched files still surfaces within 24h.
      - name: Lint (changed files)
        if: steps.lint_scope.outputs.lint_mode == 'files'
        run: |
          xargs -0 -r pnpm exec eslint \
            --max-warnings 0 --report-unused-disable-directives \
            < "${RUNNER_TEMP}/lint-targets"

      # Documentation alone did not hold this: two directories re-mixed the two
      # test-placement conventions within a day of the 53-directory cleanup.
      - name: Test placement
        run: pnpm run check:test-placement

      # Missing / unused translation keys can enter from either side of the
      # boundary (a new t() call or a locale edit), so the gate fires on any
      # frontend source or locale change and skips Rust/docs/tooling diffs.
      # Deletions count: removing the last t("key") makes that key unused.
      - name: Detect i18n scope
        id: i18n_scope
        env:
          BASE_SHA: ${{ github.event.pull_request.base.sha }}
          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
        run: |
          i18n_required="$(
            git diff --name-only -z "${BASE_SHA}...${HEAD_SHA}" |
              node scripts/ci/detect-i18n-changes.cjs
          )"
          echo "i18n_required=${i18n_required}" >> "${GITHUB_OUTPUT}"
          echo "i18n check required: ${i18n_required}"

      - name: i18n keys (missing · unused · locale gaps)
        if: steps.i18n_scope.outputs.i18n_required == 'true'
        run: |
          pnpm run test:i18n-keys
          pnpm run check:i18n-keys

      # Runs the test files this pull request can affect, selected from each
      # file's Vitest import graph; dependency, config, and setup-file changes
      # run the whole suite. The step summary lists the selection and its
      # reason. The diff goes to a file first so a failed `git diff` stops the
      # step, rather than reaching the runner as an empty diff that it would
      # answer with the whole suite.
      - name: Unit tests
        shell: bash
        env:
          BASE_SHA: ${{ github.event.pull_request.base.sha }}
          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
        run: |
          git diff --name-only -z "${BASE_SHA}...${HEAD_SHA}" \
            > "${RUNNER_TEMP}/unit-test-paths"
          node scripts/ci/run-unit-tests.mjs < "${RUNNER_TEMP}/unit-test-paths"

  # ── Rust ────────────────────────────────────────────────────────────────────
  rust:
    name: Rust (clippy)
    needs: changes
    if: needs.changes.outputs.rust_required == 'true'
    runs-on: macos-latest

    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Install Rust stable
        uses: dtolnay/rust-toolchain@stable

      # warm-rust-cache.yml publishes this same shared key from develop, so a
      # PR's first run restores the base branch's cache instead of starting
      # cold. Keep the key and workspace mapping in sync with that workflow.
      - name: Rust cache
        uses: swatinem/rust-cache@v2
        with:
          workspaces: "./src-tauri -> target"
          shared-key: "ci-macos"

      - name: Stage org2-pm sidecar
        run: node scripts/tauri/prepare-sidecars.cjs --profile debug

      # Clippy runs the full compiler front-end, so it subsumes `cargo check`.
      # Check every target and reject new warnings now that the workspace
      # baseline is clean.
      - name: cargo clippy (all targets, warnings denied)
        working-directory: src-tauri
        run: cargo clippy --workspace --all-targets -- -D warnings

      # `--workspace` is load-bearing: src-tauri/Cargo.toml lists "." plus 44
      # member crates and sets no `default-members`, so a bare `cargo test` here
      # would run the root package only and skip ~5700 tests. Clippy above has
      # already built every test target against the same cache, so this step is
      # mostly link plus ~1 min of execution for ~6800 tests.
      - name: cargo test (workspace)
        working-directory: src-tauri
        run: cargo test --workspace --no-fail-fast

  # ── Rust (Windows) ──────────────────────────────────────────────────────────
  # The macOS job above cannot see a `#[cfg(windows)]` / `#[cfg(unix)]` split
  # that only breaks on Windows: the compiler configures the other arm out.
  # Two consecutive releases (v2.0.0, v2.0.1) failed in exactly that way,
  # each on a Windows-only unresolved import that no PR check had compiled.
  # This job runs the same warnings-denied clippy gate on the release target
  # so such a defect fails the PR instead of the tag build.
  #
  # Compile-only on purpose: the workspace test suite already runs on macOS,
  # and the Windows runner's job is to prove the release target builds.
  rust-windows:
    name: Rust (clippy, Windows)
    needs: changes
    if: needs.changes.outputs.rust_required == 'true'
    runs-on: windows-latest

    steps:
      - name: Checkout
        uses: actions/checkout@v6

      # windows-latest's host toolchain is x86_64-pc-windows-msvc, the same
      # triple release.yaml builds, so no explicit --target is needed.
      - name: Install Rust stable
        uses: dtolnay/rust-toolchain@stable

      # warm-rust-cache.yml publishes this same shared key from develop. Keep
      # the key and workspace mapping in sync with that workflow.
      - name: Rust cache
        uses: swatinem/rust-cache@v2
        with:
          workspaces: "./src-tauri -> target"
          shared-key: "ci-windows"

      - name: Stage org2-pm sidecar
        run: node scripts/tauri/prepare-sidecars.cjs --profile debug

      - name: cargo clippy (all targets, warnings denied)
        working-directory: src-tauri
        run: cargo clippy --workspace --all-targets -- -D warnings

  # ── Dependency audit ────────────────────────────────────────────────────────
  # Only signal on the ~1000-crate Rust closure; nothing else watches Cargo.lock.
  # Runs on its own runner rather than inside the `rust` job so an advisory
  # cannot be masked by, or delay, a clippy/test failure. Ignored advisories and
  # the reason each one is blocked live in src-tauri/.cargo/audit.toml.
  #
  # Gated on the lockfile rather than on rust_required: cargo audit never builds
  # the workspace, so an .rs-only diff cannot move its verdict. Advisory-database
  # updates carry no diff at all and are covered by nightly-full-checks.yml.
  cargo-audit:
    name: Rust (cargo audit)
    needs: changes
    if: needs.changes.outputs.audit_required == 'true'
    runs-on: ubuntu-latest

    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Install Rust stable
        uses: dtolnay/rust-toolchain@stable

      # cargo-audit only parses Cargo.lock -- it never builds the workspace, so
      # this needs no sidecar staging and no target cache.
      - name: Cache cargo-audit binary
        id: audit-cache
        uses: actions/cache@v5
        with:
          path: ~/.cargo/bin/cargo-audit
          key: cargo-audit-${{ runner.os }}-v1

      # A miss compiles cargo-audit for ~3 min before a 4 s scan. Caches saved
      # during a PR run are scoped to that PR's merge ref, so this only ever
      # hits because nightly-full-checks.yml re-saves the same key from develop
      # and PR runs may restore their base branch's caches. (Same reasoning as
      # warm-frontend-cache.yml and warm-rust-cache.yml.)
      - name: Install cargo-audit
        if: steps.audit-cache.outputs.cache-hit != 'true'
        run: cargo install cargo-audit --locked

      - name: cargo audit
        working-directory: src-tauri
        run: cargo audit