ci.yml

name: CI

# ---------------------------------------------------------------------------
# Trigger rules
# ---------------------------------------------------------------------------
# Push to main: capability checks are selected by changed paths, just like PRs.
# Broad changes still run the full convergence set.
# PR: capability checks are selected by changed paths.  Broad/core changes
# (Cargo workspace, scripts, test inputs, CI itself) expand to the
# full check set; narrow path changes run only the relevant capability.
# Docs-only changes skip CI entirely.

on:
  push:
    branches: ["main"]
    paths-ignore:
      - "**/*.md"
      - "docs/**"
  pull_request:
    paths-ignore:
      - "**/*.md"
      - "docs/**"

permissions:
  contents: read

# ---------------------------------------------------------------------------
# Path filter: determines which capability jobs run on PRs and pushes.
# ---------------------------------------------------------------------------
jobs:
  paths:
    name: Detect paths
    runs-on: ubuntu-latest
    outputs:
      rust_core: ${{ steps.filter.outputs.rust_core }}
      opy: ${{ steps.filter.outputs.rust_core }}
      lpp: ${{ steps.filter.outputs.rust_core }}
      cli: ${{ steps.filter.outputs.rust_core }}
      dist: ${{ steps.filter.outputs.dist }}
    steps:
      - name: Checkout
        uses: actions/checkout@v7
        with:
          fetch-depth: 0

      - name: Filter paths
        id: filter
        uses: dorny/paths-filter@v4
        with:
          filters: |
            rust_core:
              - 'Cargo.toml'
              - 'Cargo.lock'
              - 'rust-toolchain'
              - 'rust-toolchain.toml'
              - '.cargo/**'
              - 'src/**'
              - 'crates/**'
              - 'tests/fixtures/**'
              - 'scripts/**'
              - '.github/workflows/**'
            dist:
              - 'dist/**'
              - 'install.sh'
              - 'install.ps1'
              - 'Cargo.toml'
              - 'Cargo.lock'
              - 'rust-toolchain'
              - 'rust-toolchain.toml'
              - '.cargo/**'
              - 'src/**'
              - 'crates/**'
              - 'tests/fixtures/**'
              - 'scripts/**'
              - '.github/workflows/**'
  # -------------------------------------------------------------------------
  # [1] RUST QUALITY & TESTS  (fundamental gate)
  # All other Rust-based jobs depend on this.
  # -------------------------------------------------------------------------
  rust-quality:
    name: Rust (stable)
    needs: paths
    if: needs.paths.outputs.rust_core == 'true'
    uses: wrightkit/.github/.github/workflows/rust-quality.yml@a83d0f1b4cbcb5b81fb0426e3a5aea1db0899fb5
    with:
      toolchain: stable
      cache-shared-key: linux-quality-stable-dev-test
      all-features: true

  # The reusable quality workflow installs its requested toolchain, but the
  # repository rust-toolchain.toml remains authoritative for bare Cargo
  # commands. Keep the MSRV gate local so every command explicitly selects
  # 1.85.0 and cannot silently fall back to stable.
  rust-msrv:
    name: Rust (1.85.0)
    needs: paths
    if: needs.paths.outputs.rust_core == 'true'
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v7

      - name: Install Rust (1.85.0)
        uses: dtolnay/rust-toolchain@master
        with:
          toolchain: 1.85.0
          components: rustfmt, clippy

      - name: Rust cache
        uses: Swatinem/rust-cache@v2
        with:
          shared-key: linux-quality-1.85.0-dev-test
          cache-targets: true
          cache-all-crates: false
          cache-workspace-crates: false
          cache-bin: false
          save-if: ${{ github.ref == 'refs/heads/main' }}
          cache-on-failure: false

      - name: Check formatting
        run: cargo +1.85.0 fmt --all -- --check

      # Keep the surviving owner-independent Wright crates on the declared
      # MSRV. The provider-backed consumer crates are covered by the stable
      # full-workspace gate and the dedicated integration jobs below.
      - name: Clippy (independent crates)
        run: >-
          cargo +1.85.0 clippy --locked --all-targets --all-features
          -p wright-analyzer -p wright-transform -p wright-lpp -- -D warnings

      - name: Test (independent crates)
        run: >-
          cargo +1.85.0 test --locked --all-targets --all-features
          -p wright-analyzer -p wright-transform -p wright-lpp

  # -------------------------------------------------------------------------
  # [1a] WRIGHT CLI ARTIFACT  (stable/debug executable for compatible jobs)
  # Build this exact workflow revision once. Consumers below need the CLI
  # executable only; jobs with another output or test-build identity stay
  # independent.
  # -------------------------------------------------------------------------
  wright-cli-build:
    name: Build CLI
    needs: [paths, rust-quality, rust-msrv]
    if: needs.paths.outputs.opy == 'true' || needs.paths.outputs.cli == 'true'
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v7

      - name: Install Rust
        uses: dtolnay/rust-toolchain@master
        with:
          toolchain: stable

      - name: Rust cache
        uses: Swatinem/rust-cache@v2
        with:
          shared-key: linux-quality-stable-dev-test
          cache-targets: true
          cache-all-crates: false
          cache-workspace-crates: false
          cache-bin: false
          save-if: false
          cache-on-failure: false

      - name: Build CLI
        run: cargo build --locked -p wright-cli

      - name: Upload CLI artifact
        uses: actions/upload-artifact@v7
        with:
          name: wright-cli-linux-stable-debug
          path: target/debug/wright
          if-no-files-found: error

      - name: Record CLI provenance
        shell: bash
        run: |
          digest="$(sha256sum target/debug/wright | cut -d ' ' -f1)"
          {
            printf '%s\n\n' '## Wright CLI artifact'
            printf -- "- Revision: \`%s\`\n" "$GITHUB_SHA"
            printf '%s\n' '- Build identity: stable / debug / ubuntu-latest'
            printf -- "- SHA-256: \`%s\`\n" "$digest"
          } >> "$GITHUB_STEP_SUMMARY"

  # -------------------------------------------------------------------------
  # [1b] WORKSHOP REAL-PROJECT INTEGRATION  (Wright's released Workshop consumer)
  # Runs the owner-pinned real-project inputs through the actual `wright`
  # check/lint commands. The source snapshots and residual expectations remain
  # owned by the released workshop-rs corpus.
  # -------------------------------------------------------------------------
  workshop-integration:
    name: Workshop (${{ matrix.project }})
    needs: [paths, rust-quality, rust-msrv, wright-cli-build]
    if: needs.paths.outputs.rust_core == 'true'
    runs-on: ubuntu-latest
    strategy:
      fail-fast: true
      matrix:
        include:
          - project: ai-pve
            expected_exit: 0
          - project: bastion
            expected_exit: 0
          # The pinned owner corpus admits this project's residual as a
          # source-level failure; the other projects must remain clean.
          - project: defend
            expected_exit: 1
          - project: illari
            expected_exit: 0
          - project: rework
            expected_exit: 0
    steps:
      - name: Checkout Wright
        uses: actions/checkout@v7

      - name: Checkout workshop-rs
        uses: actions/checkout@v7
        with:
          repository: wrightkit/workshop-rs
          ref: f1f3c58f790e9aede9300ca6421698f2503f5f62 # v0.3.11
          path: workshop-rs-pinned

      - name: Download CLI artifact
        uses: actions/download-artifact@v8
        with:
          name: wright-cli-linux-stable-debug
          path: target/debug

      - name: Prepare CLI executable
        run: chmod +x target/debug/wright

      - name: Run public CLI dogfood
        env:
          EXPECTED_EXIT: ${{ matrix.expected_exit }}
          PROJECT: workshop-rs-pinned/crates/workshop-rs/tests/fixtures/real-projects/${{ matrix.project }}.ow
        run: |
          set -euo pipefail

          run_workflow() {
            local command="$1"
            local output
            local status

            set +e
            output="$(target/debug/wright "$command" --kind workshop "$PROJECT" --format json)"
            status=$?
            set -e

            if [[ "$status" -ne "$EXPECTED_EXIT" ]]; then
              echo "wright $command returned $status; expected $EXPECTED_EXIT for $PROJECT" >&2
              return 1
            fi

            jq -e \
              --arg command "$command" \
              --argjson process_exit "$status" \
              '(
                .wright.contract == "wright-result/v1" and
                .command == $command and
                .exit == $process_exit and
                .ok == ($process_exit == 0) and
                (.diagnostics | type == "array") and
                (all(.diagnostics[]; type == "object")) and
                ([.diagnostics[] | select(.stage == "internal")] | length == 0)
              )' <<<"$output" >/dev/null
            printf '%s' "$output"
          }

          check_output="$(run_workflow check)"
          lint_output="$(run_workflow lint)"
          jq -e -n \
            --argjson check "$check_output" \
            --argjson lint "$lint_output" \
            '(
              $check.diagnostics == $lint.diagnostics and
              $check.ok == $lint.ok and
              $check.exit == $lint.exit and
              ($lint.result.program.rules | numbers | . > 0)
            )' >/dev/null

  # -------------------------------------------------------------------------
  # [2] PRODUCT INTEGRATION  (Wright-owned provider and product contracts)
  # The source-language owners test language semantics. Wright tests its
  # provider seam, provider distribution success path, failure routing, and
  # user-facing product behavior directly.
  # -------------------------------------------------------------------------
  opy-integration:
    name: Product integration
    needs: [paths, rust-quality, rust-msrv, wright-cli-build]
    if: needs.paths.outputs.opy == 'true'
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v7

      - name: Install Rust
        uses: dtolnay/rust-toolchain@master
        with:
          toolchain: stable
      - name: Download CLI artifact
        uses: actions/download-artifact@v8
        with:
          name: wright-cli-linux-stable-debug
          path: target/debug
      - name: Prepare CLI executable
        run: chmod +x target/debug/wright
      - name: Rust cache
        uses: Swatinem/rust-cache@v2
        with:
          shared-key: linux-quality-stable-dev-test
          cache-targets: true
          cache-all-crates: false
          cache-workspace-crates: false
          cache-bin: false
          save-if: false
          cache-on-failure: false

      - name: Run provider/product tests
        run: >-
          cargo test --locked
          -p wright-driver --test driver --test source_provider --test service
          --test workshop_provider

      - name: Run CLI/embedding tests
        run: >-
          cargo test --locked
          -p wright-cli --test cli --test diagnostics_schema --test serve
          && cargo test --locked -p wright-consumer --test consumer

      - name: Install pinned OPY provider
        run: target/debug/wright provider update opy --version 0.1.38

      - name: Compile OPY via provider
        run: >-
          target/debug/wright compile tests/fixtures/opy/basic-rule.opy
          --profile compat

  # -------------------------------------------------------------------------
  # [3] LPP INTEGRATION  (Wright's Language Provider Protocol client contract)
  # -------------------------------------------------------------------------
  lpp-integration:
    name: LPP integration
    needs: [paths, rust-quality, rust-msrv]
    if: needs.paths.outputs.lpp == 'true'
    runs-on: ubuntu-latest
    steps:
      - name: Checkout Wright
        uses: actions/checkout@v7

      - name: Install Rust
        uses: dtolnay/rust-toolchain@master
        with:
          toolchain: stable
      - name: Rust cache
        uses: Swatinem/rust-cache@v2
        with:
          shared-key: linux-quality-stable-dev-test
          cache-targets: true
          cache-all-crates: false
          cache-workspace-crates: false
          cache-bin: false
          save-if: false
          cache-on-failure: false

      # The mock provider is built from the pinned language-provider-protocol
      # commit the integration tests were validated against (merged LPP v1,
      # PR wrightkit/language-provider-protocol#2 plus docs-only follow-ups).
      - name: Checkout LPP
        uses: actions/checkout@v7
        with:
          repository: wrightkit/language-provider-protocol
          ref: 416b293e26e6fb2d29061608a493a7aecd2ce14f
          path: language-provider-protocol

      - name: Build mock provider
        run: cargo build --locked -p lpp-mock-provider
        working-directory: language-provider-protocol

      # REQUIRED: these suites self-skip when LPP_MOCK_PROVIDER is absent,
      # so the variable must be set here for them to run at all.
      - name: Run LPP tests
        env:
          LPP_MOCK_PROVIDER: ${{ github.workspace }}/language-provider-protocol/target/debug/lpp-mock-provider
        run: >-
          cargo test --locked -p wright-lpp -p wright-driver
          --test mock_provider --test lpp --test provider_edit

  # -------------------------------------------------------------------------
  # [4] CLI BEHAVIOR  (Wright CLI GitHub Actions renderer smoke test)
  # Validates CLI output format in a real GitHub Actions environment.
  # Related to #164 (user-facing GHA renderer); this job validates the
  # repository CI integration, not the renderer semantics layer.
  # -------------------------------------------------------------------------
  cli-behavior:
    name: CLI behavior
    needs: [paths, rust-quality, rust-msrv, wright-cli-build]
    if: needs.paths.outputs.cli == 'true'
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v7

      - name: Install Rust
        uses: dtolnay/rust-toolchain@master
        with:
          toolchain: stable

      - name: Download CLI artifact
        uses: actions/download-artifact@v8
        with:
          name: wright-cli-linux-stable-debug
          path: target/debug

      - name: Prepare CLI executable
        run: chmod +x target/debug/wright

      - name: Test GitHub Actions renderer
        run: scripts/test-cli-github-actions.sh target/debug/wright

  # -------------------------------------------------------------------------
  # [5] BENCHMARK  (performance evidence)
  # Non-blocking on PRs; records regression-detectable output as artifact.
  # Depends on rust-quality so a fundamental failure skips benchmark time.
  # -------------------------------------------------------------------------
  benchmark:
    name: Benchmarks
    needs: [paths, rust-quality, rust-msrv]
    if: needs.paths.outputs.opy == 'true'
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v7

      - name: Install Rust
        uses: dtolnay/rust-toolchain@master
        with:
          toolchain: stable
      - name: Rust cache
        uses: Swatinem/rust-cache@v2
        with:
          shared-key: linux-quality-stable-dev-test
          cache-targets: true
          cache-all-crates: false
          cache-workspace-crates: false
          cache-bin: false
          save-if: false
          cache-on-failure: false

      - name: Build benchmarks
        run: cargo build --locked -p wright-bench

      - name: Run benchmarks
        id: bench
        run: target/debug/wright-bench

      - name: Upload benchmark report
        if: always()
        uses: actions/upload-artifact@v7
        with:
          name: benchmark-report
          path: target/wright-bench-report.json

  # -------------------------------------------------------------------------
  # [8] DISTRIBUTION VALIDATION  (cross-platform package/binary smoke)
  # When source changes are in scope, this remains gated on the relevant Rust
  # and integration jobs. Distribution-only changes run this job directly.
  # -------------------------------------------------------------------------
  dist-cli-build:
    name: Build dist (${{ matrix.os }})
    needs:
      - paths
      - rust-quality
      - rust-msrv
      - opy-integration
      - lpp-integration
    if: |
      always() &&
      needs.paths.outputs.dist == 'true' &&
      (needs.rust-quality.result == 'success' || needs.paths.outputs.rust_core != 'true') &&
      (needs.rust-msrv.result == 'success' || needs.paths.outputs.rust_core != 'true') &&
      (needs.opy-integration.result == 'success' || needs.paths.outputs.opy != 'true') &&
      (needs.lpp-integration.result == 'success' || needs.paths.outputs.lpp != 'true')
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        os:
          - ubuntu-latest
          - macos-15
          - windows-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v7

      - name: Install Rust
        uses: dtolnay/rust-toolchain@master
        with:
          toolchain: stable

      - name: Rust cache
        uses: Swatinem/rust-cache@v2
        with:
          shared-key: dist-validation-${{ runner.os }}-stable-dev
          cache-targets: false
          cache-all-crates: false
          cache-workspace-crates: false
          cache-bin: false
          save-if: ${{ github.ref == 'refs/heads/main' }}
          cache-on-failure: false

      - name: Build CLI and LSP
        shell: bash
        run: cargo build --locked -p wright-cli -p wright-lsp

      - name: Upload distribution binaries
        uses: actions/upload-artifact@v7
        with:
          name: wright-dist-cli-${{ matrix.os }}
          path: |
            target/debug/wright
            target/debug/wright.exe
            target/debug/wright-lsp
            target/debug/wright-lsp.exe
          if-no-files-found: error

  dist-validation:
    name: Dist validation (${{ matrix.channel }}, ${{ matrix.os }})
    needs:
      - paths
      - rust-quality
      - rust-msrv
      - opy-integration
      - lpp-integration
      - dist-cli-build
    if: |
      always() &&
      needs.paths.outputs.dist == 'true' &&
      (needs.rust-quality.result == 'success' || needs.paths.outputs.rust_core != 'true') &&
      (needs.rust-msrv.result == 'success' || needs.paths.outputs.rust_core != 'true') &&
      (needs.opy-integration.result == 'success' || needs.paths.outputs.opy != 'true') &&
      (needs.lpp-integration.result == 'success' || needs.paths.outputs.lpp != 'true') &&
      needs.dist-cli-build.result == 'success'
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: ubuntu-latest
            channel: install.sh
          - os: macos-15
            channel: install.sh
          - os: macos-15
            channel: Homebrew
          - os: windows-latest
            channel: install.ps1
          - os: windows-latest
            channel: Scoop
          - os: windows-latest
            channel: WinGet
    steps:
      - name: Checkout
        uses: actions/checkout@v7

      - name: Set up Python
        uses: actions/setup-python@v7
        with:
          python-version: "3.12"

      - name: Install Scoop
        if: matrix.channel == 'Scoop'
        shell: pwsh
        run: ./scripts/setup-scoop.ps1

      - name: Enable WinGet local manifests
        if: matrix.channel == 'WinGet'
        shell: pwsh
        run: winget settings --enable LocalManifestFiles

      - name: Download distribution binaries
        uses: actions/download-artifact@v8
        with:
          name: wright-dist-cli-${{ matrix.os }}
          path: target/debug

      - name: Prepare distribution executables
        if: runner.os != 'Windows'
        run: chmod +x target/debug/wright target/debug/wright-lsp

      - name: Validate package metadata and installers
        if: matrix.channel == 'install.sh' || matrix.channel == 'install.ps1'
        run: python scripts/verify-dist.py

      - name: Test install.sh (functional)
        if: matrix.channel == 'install.sh'
        run: scripts/test-install.sh
      - name: Test install.sh (native smoke)
        if: matrix.channel == 'install.sh'
        run: python scripts/test-distribution-install-sh.py
      - name: Test install.ps1 (channel)
        if: matrix.channel == 'install.ps1'
        shell: pwsh
        run: ./scripts/test-install.ps1
      - name: Test install.ps1 (R2 smoke)
        if: matrix.channel == 'install.ps1'
        shell: pwsh
        run: ./scripts/test-install-r2.ps1
      - name: Test Homebrew channel
        if: matrix.channel == 'Homebrew'
        run: python scripts/test-distribution-homebrew.py
      - name: Test Scoop channel
        if: matrix.channel == 'Scoop'
        run: python scripts/test-distribution-scoop.py
      - name: Test WinGet channel
        if: matrix.channel == 'WinGet'
        run: python scripts/test-distribution-winget.py