test.yml

name: Test

on:
  push:
    branches: [main]
  # Every pull request, not only those targeting main: a stacked pull
  # request opened against its parent branch is exactly the one that
  # most needs checking, and it was getting none.
  pull_request:
  schedule:
    - cron: '23 5 * * *'
  workflow_dispatch:

concurrency:
  group: ${{ github.event_name == 'pull_request' && format('test-pr-{0}', github.event.pull_request.number) || format('test-run-{0}', github.run_id) }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

permissions: {}

jobs:
  changes:
    name: Classify changes
    runs-on: ubuntu-latest
    permissions:
      contents: read
      pull-requests: read
    outputs:
      go: ${{ steps.decide.outputs.go }}
      tests: ${{ steps.decide.outputs.tests }}
    steps:
      - name: Classify the changed files
        id: filter
        if: github.event_name == 'pull_request'
        uses: dorny/paths-filter@ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d # v4.0.3
        with:
          predicate-quantifier: every
          filters: |
            go:
              - '**'
              - '!*.md'
              - '!.github/*.md'
              - '!skills/**/*.md'
              - '!skill-evals/**'
            tests:
              - '**'
              - '!*.md'
              - '!.github/*.md'

      - name: Decide what runs
        id: decide
        env:
          EVENT: ${{ github.event_name }}
          GO: ${{ steps.filter.outputs.go }}
          TESTS: ${{ steps.filter.outputs.tests }}
        run: |
          if [ "$EVENT" != "pull_request" ]; then
            echo "go=true" >> "$GITHUB_OUTPUT"
            echo "tests=true" >> "$GITHUB_OUTPUT"
            echo "Full run: $EVENT events are never narrowed." >> "$GITHUB_STEP_SUMMARY"
            exit 0
          fi

          for answer in "$GO" "$TESTS"; do
            case "$answer" in
              true|false) ;;
              *)
                echo "::error::the paths filter did not answer (go='$GO', tests='$TESTS'), so nothing can be skipped"
                exit 1
                ;;
            esac
          done

          echo "go=$GO" >> "$GITHUB_OUTPUT"
          echo "tests=$TESTS" >> "$GITHUB_OUTPUT"
          if [ "$GO" = "true" ]; then
            echo "Full run: this pull request changes files outside the docs and skill lists." >> "$GITHUB_STEP_SUMMARY"
          elif [ "$TESTS" = "true" ]; then
            echo "Skill or eval files only: Tests and Integration Tests run; Lint, Security, CLI Surface Check and the race shards skip." >> "$GITHUB_STEP_SUMMARY"
          else
            echo "Prose only: Tests runs the naming check; the Go jobs skip." >> "$GITHUB_STEP_SUMMARY"
          fi

  test:
    name: Tests
    runs-on: ubuntu-latest
    needs: changes
    if: ${{ !cancelled() }}
    permissions:
      contents: read
    env:
      BASECAMP_NO_KEYRING: "1"
      RUN_GO: ${{ needs.changes.outputs.tests != 'false' }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Set up Go
        if: env.RUN_GO == 'true'
        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version-file: 'go.mod'

      - name: Check SDK provenance
        if: env.RUN_GO == 'true'
        run: make provenance-check

      - name: Check module tidiness
        if: env.RUN_GO == 'true'
        run: make tidy-check

      - name: Check naming (no stale legacy references)
        run: make check-naming

      - name: Run unit tests
        if: env.RUN_GO == 'true'
        run: go test -tags dev -v ./...

      - name: Build binary
        if: env.RUN_GO == 'true'
        run: go build -tags dev -o bin/basecamp ./cmd/basecamp

      - name: Smoke test
        if: env.RUN_GO == 'true'
        run: |
          ./bin/basecamp --version
          ./bin/basecamp --help | head -5

      - name: Validate release build (no dev tag)
        if: env.RUN_GO == 'true'
        run: |
          go build -o bin/basecamp-release ./cmd/basecamp
          go test -v ./internal/commands/ -run TestStub

      - name: Say what did not run
        if: env.RUN_GO != 'true'
        run: |
          echo "Prose-only change: the naming check ran; the Go tests, build and smoke test did not." >> "$GITHUB_STEP_SUMMARY"

  lint:
    name: Lint
    runs-on: ubuntu-latest
    needs: changes
    if: ${{ !cancelled() && needs.changes.outputs.go != 'false' }}
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Set up Go
        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version-file: 'go.mod'

      # Runs before the linter: if the pins have drifted, say so plainly rather
      # than letting the odd job out fail later on a version-specific finding.
      - name: Check golangci-lint pins are in lockstep
        run: make check-lint-lockstep

      - name: Run golangci-lint
        uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a # v9.3.0
        with:
          version: v2.11.1
          args: --build-tags dev

  lint-actions:
    name: GitHub Actions audit
    runs-on: ubuntu-latest
    permissions:
      contents: read

    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Run actionlint
        uses: rhysd/actionlint@914e7df21a07ef503a81201c76d2b11c789d3fca # v1.7.12

      - name: Run zizmor
        uses: zizmorcore/zizmor-action@cc914d7f3750a2d13d75c7f184a1060aa0e9d482 # v0.6.4
        with:
          # The action resolves `version` (default "latest") through the digest
          # map checked in at its pinned SHA, so this stays stable either way —
          # the explicit pin keeps the release from shifting when the action SHA
          # is bumped, and matches the .mise.toml zizmor pin for local parity.
          version: "1.30.0"
          advanced-security: false

  security:
    name: Security
    runs-on: ubuntu-latest
    needs: changes
    if: ${{ !cancelled() && needs.changes.outputs.go != 'false' }}
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Set up Go
        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version-file: 'go.mod'

      - name: Run govulncheck
        # @latest intentional — pinning delays scanning improvements and
        # new Go version support for no meaningful reproducibility gain.
        run: |
          go install golang.org/x/vuln/cmd/govulncheck@latest
          govulncheck -tags dev ./...

  # The shards, and then Race Detection over them. The required status check
  # is the aggregate, so its name never changes and the ruleset never has to
  # be edited when the shard count does.
  race-shard:
    name: Race Detection (shard ${{ matrix.shard }} of 4)
    runs-on: ubuntu-latest
    needs: changes
    if: ${{ !cancelled() && needs.changes.outputs.go != 'false' }}
    permissions:
      contents: read
    strategy:
      # Every shard runs: stopping the others on the first failure would
      # leave the aggregate unable to tell a real gap from a cancelled job.
      fail-fast: false
      matrix:
        shard: [1, 2, 3, 4]
    env:
      BASECAMP_NO_KEYRING: "1"
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Set up Go
        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version-file: 'go.mod'

      # 20 minutes, not Go's default 10 per package. internal/connector runs
      # real sockets, real processes and the recovery harness; under -race it
      # takes about five minutes on a fast box and roughly twice that on a
      # runner. The default was not a hung test, it was the budget.
      - name: Run this shard under the race detector
        run: scripts/race-shard.sh "${{ matrix.shard }}" 4 "shard-records/shard-${{ matrix.shard }}"

      # Uploaded even when the shard failed: the aggregate has to be able to
      # tell "this shard ran its tests and one of them failed" from "this
      # shard never got as far as knowing what it was meant to run".
      - name: Record what this shard was assigned
        if: always()
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          # The name is the directory the aggregate reads: download-artifact
          # extracts each one to <path>/<name>/, so this has to be the
          # shard-N the union check looks for, not a name of its own.
          name: shard-${{ matrix.shard }}
          path: |
            shard-records/shard-${{ matrix.shard }}/all.txt
            shard-records/shard-${{ matrix.shard }}/shard.${{ matrix.shard }}.txt
          retention-days: 3
          if-no-files-found: error

  race-check:
    name: Race Detection
    runs-on: ubuntu-latest
    needs: [changes, race-shard]
    # always(), or a failed shard would skip this job — and a skipped required
    # check is not a failed one.
    if: ${{ always() && needs.changes.outputs.go != 'false' }}
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Download what each shard recorded
        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          pattern: shard-*
          path: shard-records

      # Naming what came back before judging it: a check that runs over
      # nothing is the failure this whole arrangement exists to prevent.
      - name: Show the records
        run: find shard-records -type f | sort

      - name: Every shard passed
        env:
          SHARDS: ${{ needs.race-shard.result }}
        run: |
          echo "shards: $SHARDS"
          [ "$SHARDS" = success ] || {
            echo "a race-detection shard did not pass" >&2
            exit 1
          }

      - name: The shards between them ran every test, once
        run: scripts/race-shard-union.sh shard-records 4

  integration:
    name: Integration Tests
    runs-on: ubuntu-latest
    needs: changes
    if: ${{ !cancelled() && needs.changes.outputs.tests != 'false' }}
    permissions:
      contents: read
    env:
      BASECAMP_NO_KEYRING: "1"
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Set up Go
        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version-file: 'go.mod'

      - name: Cache BATS
        id: cache-bats
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        # zizmor: ignore[cache-poisoning] -- cache is branch-isolated; fork PRs cannot write to the cache used by tag-push workflows
        with:
          path: ~/.local
          key: bats-1.11.0-home

      - name: Install BATS
        if: steps.cache-bats.outputs.cache-hit != 'true'
        run: |
          git clone --depth 1 --branch v1.11.0 https://github.com/bats-core/bats-core.git /tmp/bats-core
          /tmp/bats-core/install.sh ~/.local

      - name: Add BATS to PATH
        run: echo "$HOME/.local/bin" >> "$GITHUB_PATH"

      - name: Run BATS integration tests
        run: make test-e2e

      - name: Test the skills sync
        run: make test-sync-skills

      - name: Test the skill drift check
        run: make test-skill-drift

      # Same Ruby the eval runner gets, because the point of the check is the
      # engine: these patterns are Onigmo, and Go's RE2 guard cannot see them.
      - name: Set up Ruby
        uses: ruby/setup-ruby@e81a8fa391b11a595c1b7ed84177cc0fe02faf83 # v1.328.0
        with:
          ruby-version: '3.4'

      - name: Compile the skill-eval patterns
        run: make check-eval-patterns

  cli-surface:
    name: CLI Surface Check
    runs-on: ubuntu-latest
    needs: changes
    if: ${{ !cancelled() && needs.changes.outputs.go != 'false' }}
    permissions:
      contents: read
    env:
      BASECAMP_NO_KEYRING: "1"
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
          persist-credentials: false

      - name: Set up Go
        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version-file: 'go.mod'

      - name: Build and snapshot PR surface
        run: |
          make build
          scripts/check-cli-surface.sh ./bin/basecamp /tmp/current-surface.txt

      - name: Build and snapshot baseline surface
        run: |
          SCRIPT_DIR="$(pwd)/scripts"
          git worktree add /tmp/baseline-tree origin/main
          cd /tmp/baseline-tree
          make build
          "$SCRIPT_DIR/check-cli-surface.sh" ./bin/basecamp /tmp/baseline-surface.txt

      - name: Compare surfaces
        run: scripts/check-cli-surface-diff.sh /tmp/baseline-surface.txt /tmp/current-surface.txt

      - name: Cleanup worktree
        if: always()
        run: git worktree remove /tmp/baseline-tree --force 2>/dev/null || true

  # Whether the evals can run at all, answered before the job that would run
  # them. Split out because a job cannot skip itself: a step-level `if` leaves
  # the job green, and "Skill Evals: success" with no case run is the reading
  # this repository actually had. A `needs` + job-level `if` reports Skipped,
  # which is what happened.
  skill-eval-gate:
    name: Skill Evals (preflight)
    runs-on: ubuntu-latest
    permissions:
      contents: read
      pull-requests: read  # dorny/paths-filter enumerates PR files via the REST API
    if: github.event_name == 'pull_request'
    outputs:
      run: ${{ steps.decide.outputs.run }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Check for skill or eval changes
        id: filter
        uses: dorny/paths-filter@ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d # v4.0.3
        with:
          # test.yml is in its own filter so the job proves itself on the PR
          # that introduces or edits it.
          filters: |
            skill:
              - 'skills/basecamp/SKILL.md'
              - 'skills/basecamp-connect/SKILL.md'
              - 'skill-evals/**'
              - '.github/workflows/test.yml'

      - name: Decide whether the evals can run
        id: decide
        env:
          CHANGED: ${{ steps.filter.outputs.skill }}
          # Presence only, never the value. Fork PRs receive no secrets, so this
          # is false there by construction and the skip below is the honest
          # answer for them too.
          HAS_KEY: ${{ secrets.ANTHROPIC_API_KEY != '' }} # zizmor: ignore[secrets-outside-env] -- a presence test, not the key; adding an environment would block PR-triggered runs
        run: |
          # A preflight that cannot tell must not be allowed to say no. The
          # filter answers true or false; anything else means it did not answer,
          # and treating that as "nothing to run" would rebuild the defect this
          # job exists to remove, one level up (Copilot on #768).
          case "$CHANGED" in
            true|false) ;;
            *)
              echo "::error::the paths filter did not answer (skill='$CHANGED'), so this preflight cannot say whether the evals are needed"
              exit 1
              ;;
          esac

          if [ "$CHANGED" != "true" ]; then
            echo "run=false" >> "$GITHUB_OUTPUT"
            echo "No skill or eval changes on this pull request." >> "$GITHUB_STEP_SUMMARY"
            exit 0
          fi

          cases=$(find skill-evals/cases -name '*.yml' | wc -l | tr -d ' ')

          if [ "$HAS_KEY" != "true" ]; then
            echo "run=false" >> "$GITHUB_OUTPUT"
            echo "::warning title=Skill Evals did not run::ANTHROPIC_API_KEY is not configured for this repository, so none of the $cases eval cases were run on a pull request that changes them. The Skill Evals job below reports Skipped, not success."
            {
              echo "### Skill Evals: NOT RUN"
              echo
              echo "This pull request changes a skill or its evals, and **$cases eval cases were not run**."
              echo "\`ANTHROPIC_API_KEY\` is not configured for this repository, and fork pull requests never receive secrets."
              echo
              echo "What still covers these files:"
              echo "- \`make check-eval-patterns\` compiles every pattern in every case under Onigmo, the engine the runner uses."
              echo "- \`TestConnectSkillEvalRejectsHoldTheServeValueRule\` holds the \`--serve\` value rule in the connector cases."
              echo
              echo "Neither runs a case. If these evals must gate this repository, configure the secret; until then this job is Skipped rather than green."
            } >> "$GITHUB_STEP_SUMMARY"
            exit 0
          fi

          echo "run=true" >> "$GITHUB_OUTPUT"

  skill-eval:
    name: Skill Evals
    runs-on: ubuntu-latest
    permissions:
      contents: read
    needs: skill-eval-gate
    if: needs.skill-eval-gate.outputs.run == 'true'
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Set up Ruby
        uses: ruby/setup-ruby@e81a8fa391b11a595c1b7ed84177cc0fe02faf83 # v1.328.0
        with:
          ruby-version: '3.4'

      - name: Run skill evals
        env:
          ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }} # zizmor: ignore[secrets-outside-env] -- fork PRs don't receive secrets so untrusted code never sees the key; adding an environment would block PR-triggered runs
        run: |
          # The gate decided the key is there. If it is not, the gate is broken,
          # and that is a failure rather than a quiet exit 0 — the whole point
          # of this job is that it never reports success without running a case.
          if [ -z "$ANTHROPIC_API_KEY" ]; then
            echo "::error::the preflight said the evals could run, but ANTHROPIC_API_KEY is empty here"
            exit 1
          fi
          make skill-eval

  installer-bash32:
    name: Installer (bash 3.2)
    runs-on: macos-latest
    timeout-minutes: 10
    permissions:
      contents: read
      pull-requests: read  # dorny/paths-filter enumerates PR files via the REST API
    if: github.event_name == 'pull_request'
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Check for installer changes
        id: filter
        uses: dorny/paths-filter@ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d # v4.0.3
        with:
          # test.yml is in its own filter so the job proves itself on the PR
          # that introduces or edits it.
          filters: |
            installer:
              - 'scripts/install.sh'
              - 'e2e/installer.bats'
              - '.github/workflows/test.yml'

      - name: Assert /bin/bash is Bash 3.2
        if: steps.filter.outputs.installer == 'true'
        run: |
          # Same guard as the installer-smoke canary: honest 3.2 coverage
          # instead of silently degrading if a future runner image changes
          # /bin/bash. The e2e bats suite cannot provide this — bats 1.11.0
          # execs `env bash` at every layer, so the interpreter is not
          # pinnable through it.
          /bin/bash -c '[[ "${BASH_VERSINFO[0]}.${BASH_VERSINFO[1]}" == "3.2" ]]' \
            || { echo "/bin/bash is not Bash 3.2:" >&2; /bin/bash --version >&2; exit 1; }

      - name: Syntax-check installer under Bash 3.2
        if: steps.filter.outputs.installer == 'true'
        run: /bin/bash -n scripts/install.sh

      - name: Piped execution under Bash 3.2
        if: steps.filter.outputs.installer == 'true'
        run: |
          # PATH=/nonexistent forces the curl guard: the run must fail with
          # the guard's own message, never with an unbound-variable error
          # (the #558 regression class). A bare out=$(...) assignment of the
          # failing pipeline would exit this step immediately under the
          # runner's `bash -e -o pipefail`, so capture via if-else.
          status=0
          if out=$(cat scripts/install.sh | PATH=/nonexistent /bin/bash 2>&1); then
            status=0
          else
            status=$?
          fi
          printf '%s\n' "$out"
          if [ "$status" -eq 0 ]; then
            echo "expected the curl guard to fail without curl on PATH" >&2
            exit 1
          fi
          printf '%s\n' "$out" | grep -q 'curl is required but not installed'
          if printf '%s\n' "$out" | grep -q 'unbound variable'; then
            echo "installer emitted an unbound variable error under Bash 3.2" >&2
            exit 1
          fi

      - name: Offline full install under Bash 3.2
        if: steps.filter.outputs.installer == 'true'
        run: |
          # The curl-guard step above never gets past the prerequisite check,
          # and `bash -n` only checks grammar — neither catches Bash-4-only
          # constructs (declare -A, mapfile, 4.x expansions) in the download,
          # checksum, extract, or post-install code. Run one complete install
          # under real 3.2: a fixture curl serves a local release from disk,
          # and a pinned BASECAMP_VERSION skips version resolution. PATH is
          # restricted to fixture + system dirs so Homebrew tools (bash 4+,
          # cosign) cannot leak in.
          fixture_root=$(mktemp -d)
          mkdir -p "$fixture_root/bin" "$fixture_root/release" "$fixture_root/home" "$fixture_root/install"

          cat > "$fixture_root/release/basecamp" <<'STUB'
          #!/bin/bash
          if [ "$1" = "--version" ]; then echo "basecamp version 9.9.9"; fi
          exit 0
          STUB
          chmod +x "$fixture_root/release/basecamp"
          for arch in arm64 amd64; do
            tar -czf "$fixture_root/release/basecamp_9.9.9_darwin_${arch}.tar.gz" -C "$fixture_root/release" basecamp
          done
          (cd "$fixture_root/release" && shasum -a 256 ./*.tar.gz | sed 's|\./||' > checksums.txt)

          cat > "$fixture_root/bin/curl" <<'STUB'
          #!/bin/bash
          # Fixture curl: serves the local release dir. Handles the two shapes
          # install.sh uses: `--version` and `[-flags] <url> -o <dest>`.
          out=""; url=""
          while [ $# -gt 0 ]; do
            case "$1" in
              --version) echo "curl 8.0.0 (fixture)"; exit 0 ;;
              -o) out="$2"; shift ;;
              http://*|https://*) url="$1" ;;
            esac
            shift
          done
          name="${url##*/}"
          if [ -n "$out" ] && [ -f "$FIXTURE_RELEASE_DIR/$name" ]; then
            cp "$FIXTURE_RELEASE_DIR/$name" "$out"
            exit 0
          fi
          echo "fixture curl: no fixture for: $url" >&2
          exit 22
          STUB
          chmod +x "$fixture_root/bin/curl"

          status=0
          if out=$(cat scripts/install.sh | \
              HOME="$fixture_root/home" \
              FIXTURE_RELEASE_DIR="$fixture_root/release" \
              BASECAMP_BIN_DIR="$fixture_root/install" \
              BASECAMP_VERSION=9.9.9 \
              BASECAMP_SKIP_SETUP=1 \
              BASECAMP_SETUP_AGENT=none \
              PATH="$fixture_root/bin:/usr/bin:/bin" \
              /bin/bash 2>&1); then
            status=0
          else
            status=$?
          fi
          printf '%s\n' "$out"
          if [ "$status" -ne 0 ]; then
            echo "offline install failed under Bash 3.2 (exit $status)" >&2
            exit 1
          fi
          printf '%s\n' "$out" | grep -q 'Installed basecamp to'
          printf '%s\n' "$out" | grep -q 'version 9.9.9 installed'
          if printf '%s\n' "$out" | grep -q 'unbound variable'; then
            echo "installer emitted an unbound variable error under Bash 3.2" >&2
            exit 1
          fi
          "$fixture_root/install/basecamp" --version

  benchmarks:
    name: Benchmarks
    runs-on: ubuntu-latest
    permissions:
      contents: read
    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
    continue-on-error: true
    env:
      BASECAMP_NO_KEYRING: "1"
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 2
          persist-credentials: false

      - name: Check for benchmark-relevant changes
        id: filter
        uses: dorny/paths-filter@ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d # v4.0.3
        with:
          filters: |
            bench:
              - 'internal/api/**'
              - 'internal/names/**'
              - 'internal/dateparse/**'
              - 'internal/output/**'
              - 'go.mod'
              - 'go.sum'

      - name: Set up Go
        if: steps.filter.outputs.bench == 'true'
        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version-file: 'go.mod'

      - name: Run benchmarks
        if: steps.filter.outputs.bench == 'true'
        run: go test -tags dev -bench=. -benchmem -count=3 -run='^$' ./internal/... | tee benchmarks.txt

      - name: Download previous benchmark baseline
        if: steps.filter.outputs.bench == 'true'
        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: benchmarks-baseline.txt
          key: benchmarks-baseline-${{ github.sha }}
          restore-keys: |
            benchmarks-baseline-

      - name: Install benchstat
        if: steps.filter.outputs.bench == 'true'
        run: go install golang.org/x/perf/cmd/benchstat@latest

      - name: Compare benchmarks
        if: steps.filter.outputs.bench == 'true' && hashFiles('benchmarks-baseline.txt') != ''
        run: |
          echo "## Benchmark Comparison" >> "$GITHUB_STEP_SUMMARY"
          echo '```' >> "$GITHUB_STEP_SUMMARY"
          benchstat benchmarks-baseline.txt benchmarks.txt >> "$GITHUB_STEP_SUMMARY" 2>&1 || true
          echo '```' >> "$GITHUB_STEP_SUMMARY"

      - name: Check for significant regression
        if: steps.filter.outputs.bench == 'true' && hashFiles('benchmarks-baseline.txt') != ''
        run: |
          benchstat benchmarks-baseline.txt benchmarks.txt > comparison.txt 2>&1 || true
          if grep -E '\+[2-9][0-9]\.[0-9]+%|\+[1-9][0-9][0-9]+' comparison.txt; then
            echo "::error::Performance regression detected (>20% slower). See benchmark comparison in step summary."
            exit 1
          fi

      - name: Save benchmark baseline
        if: steps.filter.outputs.bench == 'true'
        run: cp benchmarks.txt benchmarks-baseline.txt

      - name: Cache benchmark baseline
        if: steps.filter.outputs.bench == 'true'
        uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: benchmarks-baseline.txt
          key: benchmarks-baseline-${{ github.sha }}

      - name: Upload benchmark results
        if: steps.filter.outputs.bench == 'true'
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: benchmarks
          path: benchmarks.txt
          retention-days: 30

  # The flake broke on 2026-07-13 when #533 raised go.mod to 1.26.5 while
  # flake.lock still pinned a nixpkgs carrying 1.26.4, and nothing noticed for
  # three weeks: nix-verify only runs on tags, and the release-time hash check
  # was reporting success on a failed build. Catch the drift where it is
  # introduced instead — a Go bump that outpaces the lock now fails its own PR.
  #
  # This job is *meant* to fail on a dependency bump: any go.mod or go.sum
  # change invalidates vendorHash, and dependabot does not update it, so every
  # weekly `gomod` PR lands here red. That is the check working. nix-build-check.sh
  # exists so it lands red with the correct hash and `make update-nix-hash`
  # attached, instead of a raw nix dump.
  #
  # The filter includes this file: a PR that changes only the job would
  # otherwise skip the job it changed.
  nix-build:
    name: Nix flake builds
    runs-on: ubuntu-latest
    permissions:
      contents: read
      pull-requests: read  # dorny/paths-filter enumerates PR files via the REST API
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 2
          persist-credentials: false

      - name: Check for flake-relevant changes
        id: filter
        uses: dorny/paths-filter@ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d # v4.0.3
        with:
          filters: |
            nix:
              - 'go.mod'
              - 'go.sum'
              - 'flake.nix'
              - 'flake.lock'
              - 'nix/**'
              - 'scripts/nix-build-check.sh'
              - 'scripts/extract-nix-vendor-hash.sh'
              - '.github/workflows/test.yml'

      - name: Install Nix
        if: steps.filter.outputs.nix == 'true'
        uses: cachix/install-nix-action@13d8dd58da0234aa297dedd986986ccb8e7f3e24 # v31.11.1

      - name: Build the flake
        if: steps.filter.outputs.nix == 'true'
        run: scripts/nix-build-check.sh

      # `nix build` builds packages.default, so nothing here ever looked at the
      # dev shell's package list — a misspelled attribute in it would land green
      # and break `nix develop` for whoever followed CONTRIBUTING. Evaluating the
      # derivation resolves every attribute without building any of them, which
      # costs seconds and is the difference between a list that is checked and a
      # list that is merely written down.
      - name: Check the dev shell's package list resolves
        if: steps.filter.outputs.nix == 'true'
        run: nix eval --raw .#devShells.x86_64-linux.default.drvPath