ci.yml

name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
    types: [opened, synchronize, reopened, ready_for_review]
  workflow_dispatch:

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: read

env:
  # CI must never mutate the runner's OS trust store (2026-07-05: a cert-flow
  # test installed a fake PEM on a persistent self-hosted runner and broke all
  # system TLS). Belt-and-suspenders with tests/_setup/isolateDataDir.ts.
  OMNIROUTE_SKIP_SYSTEM_TRUST: "1"
  CI_NODE_VERSION: "24"
  CI_NODE_24_VERSION: "24"
  CI_NODE_26_VERSION: "26"

jobs:
  changes:
    name: Change Classification
    runs-on: ubuntu-latest
    outputs:
      code: ${{ steps.classify.outputs.code }}
      docs: ${{ steps.classify.outputs.docs }}
      i18n: ${{ steps.classify.outputs.i18n }}
      workflow: ${{ steps.classify.outputs.workflow }}
      testsOnly: ${{ steps.classify.outputs.testsOnly }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        with:
          persist-credentials: false
          fetch-depth: 0
      - uses: actions/setup-node@v7
        with:
          node-version: ${{ env.CI_NODE_VERSION }}
      # Refuse a PR that targets its own head branch before spending anything on it. #8912 has
      # head == base == release/v3.8.50: no diff, can never merge, and it sits in the queue with
      # a full check board attached on every push to that branch. One field comparison.
      - name: Reject a PR that targets its own branch
        if: github.event_name == 'pull_request'
        env:
          HEAD_REF: ${{ github.head_ref }}
          BASE_REF: ${{ github.base_ref }}
          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
          BASE_SHA: ${{ github.event.pull_request.base.sha }}
        run: node scripts/check/check-pr-self-target.mjs

      - id: classify
        env:
          EVENT_NAME: ${{ github.event_name }}
          BASE_SHA: ${{ github.event.pull_request.base.sha }}
          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
        run: |
          # Single source of truth: scripts/quality/classify-pr-changes.mjs
          # (unit-tested). Push/dispatch always enable every lane.
          if [ "$EVENT_NAME" != "pull_request" ]; then
            {
              echo "code=true"
              echo "docs=true"
              echo "i18n=true"
              echo "workflow=true"
            } >> "$GITHUB_OUTPUT"
            exit 0
          fi

          git diff --name-only "$BASE_SHA" "$HEAD_SHA" > changed-files.txt
          node scripts/quality/classify-pr-changes.mjs changed-files.txt >> "$GITHUB_OUTPUT"

  lint:
    name: Lint
    runs-on: ubuntu-latest
    needs: changes
    # P3 (plano mestre): a release-PR viva fica DRAFT o ciclo inteiro — jobs pesados pulam
    # drafts (ciclo v3.8.44: 123 runs pesados re-disparados por merges na release, 88 cancelados).
    # Path filter: pure docs / pure message-catalog PRs skip the code lint bag + typecheck.
    # Existence reason of this job is code regression; docs/i18n have dedicated jobs.
    if: ${{ github.event_name != 'pull_request' || (github.event.pull_request.draft == false && needs.changes.outputs.code == 'true') }}
    env:
      # tsx gates below (known-symbols, route-guard-membership) import modules that
      # open SQLite on load; provide DB env so a fresh CI DB initializes cleanly.
      JWT_SECRET: ci-lint-secret-with-sufficient-length-for-validation
      API_KEY_SECRET: ci-lint-api-key-secret-long
      DISABLE_SQLITE_AUTO_BACKUP: "true"
    steps:
      - uses: actions/checkout@v7
        with:
          fetch-depth: 0
          persist-credentials: false
      - uses: actions/setup-node@v7
        with:
          node-version: ${{ env.CI_NODE_VERSION }}
          cache: npm
      - uses: ./.github/actions/npm-ci-retry
      - run: npm run check:node-runtime
      - run: npm run audit:deps
      - name: Restore ESLint file cache
        uses: actions/cache@v6
        with:
          path: |
            .eslintcache
            .eslintcache-complexity
          key: eslint-${{ runner.os }}-${{ hashFiles('eslint.config.mjs', 'eslint.complexity-ratchets.config.mjs', 'config/quality/eslint-suppressions.json', 'package-lock.json') }}
          # No restore-keys fallback on purpose (#11600, P-II.1 of the v3.8.50 postmortem): a
          # cache built under a different suppressions file / lint config / lockfile reports
          # stale per-file verdicts, which is exactly how 215 pre-existing errors stayed
          # invisible for a whole cycle. Exact key or a cold full lint (~13 min) — never a
          # partial cache from another configuration.
      # Single ESLint inventory (JSON) — quality-gate reuses the artifact instead of
      # a second cold full-tree pass for eslintWarnings ratchet counts.
      - name: ESLint (JSON report)
        run: npm run lint:json
      - name: Upload ESLint results
        if: always()
        uses: actions/upload-artifact@v7
        with:
          name: eslint-results
          path: .artifacts/eslint-results.json
          if-no-files-found: warn
          retention-days: 7
      - run: npm run check:cycles
      - run: npm run check:route-validation:t06
      - run: npm run check:any-budget:t11
      - run: npm run check:provider-consistency
      - run: npm run check:model-lifecycle
      - run: npm run check:provider-asset-provenance
      - run: npm run check:fetch-targets
      - run: npm run check:deps
      - run: npm run check:file-size
      - run: npm run check:error-helper
      - run: npm run check:migration-numbering
      - run: npm run check:public-creds
      - run: npm run check:db-rules
      - run: npm run check:known-symbols
      - run: npm run check:route-guard-membership
      - run: npm run check:test-discovery
      - run: npm run check:tracked-artifacts
      # (gap 30) Also lives in quality.yml's PR-only "Merge integrity" job — because the
      # CHANGELOG half of that job needs a base to diff against. This half does NOT: the
      # generator either reproduces the committed SKILL.md files or it does not.
      #
      # Keeping it PR-only left a real hole. This cycle's merge trains landed in batches with
      # `--admin`, which bypasses required checks, so three SKILL.md files drifted from the route
      # catalog, rode the release squash into `main`, and the next cycle's sync-back turned them
      # into a base-red that blocked EVERY PR into release/v3.8.50 until #8954. Running it here
      # means a push to `main` catches the drift at the source instead of the next cycle
      # inheriting it.
      - run: npm run check:agent-skills-sync
      # WS1.7 (v3.8.49 plan): Dockerfile lint (hadolint, pinned by digest).
      # failure-threshold=error keeps the 5 pre-existing warnings (DL3008/DL3003/
      # DL3016 version pinning / WORKDIR) visible without blocking; any ERROR fails.
      - name: hadolint (Dockerfile)
        run: docker run --rm -i hadolint/hadolint@sha256:27086352fd5e1907ea2b934eb1023f217c5ae087992eb59fde121dce9c9ff21e hadolint --failure-threshold error - < Dockerfile
      - run: npm run check:lockfile
      - run: npm run check:licenses
      # check:docs-sync is run by the docs-sync-strict job (via check:docs-all) and the
      # husky pre-commit hook; the standalone copy here was redundant (ROI dedup).
      - run: npm run typecheck:core
      # #7033: typecheck:core's curated file allowlist does not cover
      # src/app/(dashboard) TSX (and next.config.mjs sets ignoreBuildErrors:
      # true, so `next build` never type-checks it either) — orphaned
      # identifiers there (see #6625/#6909) were invisible to CI. This gate
      # runs tsc scoped to the dashboard tree against a frozen baseline of
      # pre-existing errors; only NEW errors fail it.
      - run: npm run check:dashboard-typecheck
      # typecheck:noimplicit:core dropped from this job (2026-07 optimize):
      # it was advisory (continue-on-error) and largely subsumed by the blocking
      # check:type-coverage ratchet in quality-gate. Local: npm run typecheck:noimplicit:core.

  quality-gate:
    name: Quality Ratchet
    runs-on: ubuntu-latest
    # needs lint so eslint-results artifact is available (same inventory as the
    # blocking lint step). Allow lint failure so other ratchets still run.
    needs: [changes, test-coverage, lint]
    # Run even when test-coverage was SKIPPED/FAILED (e.g. a single flaky Coverage
    # Shard breaks the shard→coverage→ratchet chain). The DETERMINISTIC ratchets
    # (eslint / complexity / cognitive-complexity / duplication / codeql) do NOT need
    # the coverage artifact and MUST still run so cycle drift is measured on the
    # release PR — otherwise a flake silently skips the whole gate (incident: v3.8.36
    # release PR #4854, where the drift cascade only surfaced post-merge in #5029).
    # The coverage.* metrics degrade gracefully: the download is continue-on-error and
    # the ratchet runs with --allow-missing, so absent coverage is skipped, not failed.
    # Path filter: code-only — pure docs/i18n PRs have nothing for these ratchets to guard.
    if: ${{ !cancelled() && !contains(github.event.pull_request.labels.*.name, 'hotfix') && (github.event_name != 'pull_request' || (github.event.pull_request.draft == false && needs.changes.outputs.code == 'true' && (needs.lint.result == 'success' || needs.lint.result == 'failure'))) }}
    # security-events: read lets the CodeQL ratchet read open code-scanning alerts
    # via `gh api .../code-scanning/alerts`. contents: read keeps checkout working.
    permissions:
      contents: read
      security-events: read
    steps:
      - uses: actions/checkout@v7
        with:
          persist-credentials: false
      - uses: actions/setup-node@v7
        with:
          node-version: ${{ env.CI_NODE_VERSION }}
          cache: npm
      - uses: ./.github/actions/npm-ci-retry
      - name: Restore ESLint file cache
        uses: actions/cache@v6
        with:
          path: |
            .eslintcache
            .eslintcache-complexity
          key: eslint-${{ runner.os }}-${{ hashFiles('eslint.config.mjs', 'eslint.complexity-ratchets.config.mjs', 'config/quality/eslint-suppressions.json', 'package-lock.json') }}
          # No restore-keys fallback on purpose (#11600, P-II.1 of the v3.8.50 postmortem): a
          # cache built under a different suppressions file / lint config / lockfile reports
          # stale per-file verdicts, which is exactly how 215 pre-existing errors stayed
          # invisible for a whole cycle. Exact key or a cold full lint (~13 min) — never a
          # partial cache from another configuration.
      # Coverage mergeada (coverage-summary.json) p/ o ratchet de cobertura.
      # continue-on-error: o artifact pode não existir se a job test-coverage foi
      # SKIPPED (shard flaky). Nesse caso collect-metrics pula coverage.* (ausente sem
      # erro) e o ratchet roda com --allow-missing — as métricas determinísticas
      # (eslint/complexity/cognitive) seguem BLOQUEANTES.
      - uses: actions/download-artifact@v8
        continue-on-error: true
        with:
          name: coverage-report
          path: coverage/
      # Prefer lint job's ESLint JSON (one inventory, two consumers).
      - name: Download ESLint results
        continue-on-error: true
        uses: actions/download-artifact@v8
        with:
          name: eslint-results
          path: .artifacts/
      - run: npm run quality:collect
      # Catraca: falha se qualquer métrica regredir vs quality-baseline.json (commitado).
      # Hoje: contagem de warnings do ESLint. Fase 4 estende com cobertura (lida do
      # coverage mergeado). Tamanho de arquivo e duplicação têm gates dedicados.
      # --allow-missing: pula métricas do baseline ausentes do collect (coverage.* quando
      # o artifact não veio) em vez de falhar — mantém os gates determinísticos ativos.
      - name: Ratchet check
        run: node scripts/quality/check-quality-ratchet.mjs --allow-missing --summary .artifacts/quality-ratchet.md
      # Fase 6A.5: require-tighten — BLOQUEANTE (promovido de advisory no fim do ciclo
      # v3.8.27). Falha quando uma métrica MELHOROU sem o baseline ter sido apertado no
      # mesmo PR (força capturar ganhos permanentes). As métricas coverage.* carregam
      # tightenSlack para o gap anti-flake (CI mergeado > baseline) não disparar falso-
      # positivo. Verificado limpo (exit 0) no tip de release/v3.8.27 com a cobertura
      # mergeada == baseline (ver a nota _require_tighten_flip_blocking em
      # config/quality/quality-baseline.json).
      - name: Require-tighten (blocking)
        run: node scripts/quality/check-quality-ratchet.mjs --allow-missing --require-tighten
      # Catraca de duplicação (jscpd@4 sobre src+open-sse). Roda neste job (paralelo)
      # para não pesar no caminho crítico do lint.
      - name: Duplication ratchet
        run: npm run check:duplication
      # Complexity + cognitive: one ESLint walk, two independent baselines (by ruleId).
      - name: Complexity + cognitive ratchets
        run: npm run check:complexity-ratchets
      # Fase 7 INT: dead-code, type-coverage promovidos de advisory (quality-extended)
      # para BLOQUEANTES aqui. cognitive-complexity is folded into the step above.
      - name: Dead-code ratchet (knip)
        run: npm run check:dead-code
      - name: Type coverage ratchet
        run: npm run check:type-coverage
      - name: Compression budget ratchet (F2.4 / N4)
        run: npm run check:compression-budget
      # CodeQL alerts ratchet — BLOQUEANTE (promovido de advisory na v3.8.26).
      # Lê metrics.codeqlAlerts.value de quality-baseline.json e sai 1 SOMENTE numa
      # regressão real (alertas abertos > baseline). Falha de medição (gh/auth/api)
      # é skip gracioso com exit 0 — security-events:read no job-level permissions.
      - name: CodeQL alerts ratchet (blocking)
        run: npm run check:codeql-ratchet
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      - name: Append summary
        if: always()
        run: cat .artifacts/quality-ratchet.md >> "$GITHUB_STEP_SUMMARY"
      - name: Upload ratchet report
        if: always()
        uses: actions/upload-artifact@v7
        with:
          name: quality-ratchet
          path: .artifacts/quality-ratchet.md
          if-no-files-found: warn

  # Phase 7/8 extended quality gates — MIXED (Etapa 2, v3.8.26). The job no longer
  # carries a job-level continue-on-error: the three ratchet-blocking steps below
  # (Secret scan / Workflow lint / Bundle size, all passing --ratchet) FAIL the job
  # on a measured regression vs config/quality/quality-baseline.json. The remaining
  # steps stay ADVISORY via step-level continue-on-error (scanner install,
  # vuln/osv ratchet, OpenAPI/oasdiff breaking-change, circular-deps/dpdm): they
  # depend on external binaries/state that may legitimately self-skip, so they must
  # never block. The blocking gates themselves SKIP (exit 0) when their binary/plugin
  # is absent — only a measured regression on the SAME metric the baseline froze
  # blocks. The CodeQL ratchet was PROMOTED to the quality-gate job (v3.8.26).
  # SonarQube needs SONAR_TOKEN/SONAR_HOST_URL secrets.
  quality-extended:
    name: Quality Gates (Extended)
    runs-on: ubuntu-latest
    needs: changes
    # P3 (plano mestre): a release-PR viva fica DRAFT o ciclo inteiro — jobs pesados pulam
    # drafts (ciclo v3.8.44: 123 runs pesados re-disparados por merges na release, 88 cancelados).
    # Path filter: code-only (scanners/ratchets target production surface).
    if: ${{ !contains(github.event.pull_request.labels.*.name, 'hotfix') && (github.event_name != 'pull_request' || (github.event.pull_request.draft == false && needs.changes.outputs.code == 'true')) }}
    steps:
      # fetch-depth: 0 — the OpenAPI breaking-change gate (oasdiff) reads the base
      # spec via `git show <base_ref>:docs/openapi.yaml`; a shallow clone
      # would lack the base ref and the gate would self-skip (base-unresolved).
      - uses: actions/checkout@v7
        with:
          persist-credentials: false
          fetch-depth: 0
      - uses: actions/setup-node@v7
        with:
          node-version: ${{ env.CI_NODE_VERSION }}
          cache: npm
      - uses: ./.github/actions/npm-ci-retry
      # Dead-code, cognitive-complexity, type-coverage foram promovidos ao job
      # quality-gate (bloqueante) na Fase 7 INT — não rodam aqui para evitar duplo custo.
      - name: Circular deps (dpdm; advisory)
        continue-on-error: true
        run: npm run check:circular-deps
      # BLOCKING ratchet (Etapa 2): bundleSize must not regress vs the baseline
      # (gzip via @size-limit/file, installed by `npm ci`). --ratchet exits 1 on a
      # measured regression; it SKIPs (exit 0) when the size-limit plugin/build is
      # absent (a non-comparable measurement never blocks).
      - name: Bundle size (ratchet, blocking)
        run: npm run check:bundle-size -- --ratchet
      # CodeQL ratchet foi PROMOVIDO a BLOQUEANTE no job quality-gate (v3.8.26) —
      # não roda aqui para evitar duplo run/duplo report.
      # Install the advisory security scanners so the gates below actually run
      # (they self-skip when the binaries are absent). Robustness lessons baked in:
      #   • `go install …/gitleaks/v8@latest` produces a binary WITHOUT the version
      #     ldflags gitleaks needs (and often fails) — avoided.
      #   • `curl …api.github.com/…/releases/latest` is UNAUTHENTICATED and
      #     rate-limited to 60 req/hr/IP; when throttled it returns an empty body,
      #     so the asset URL resolves to nothing and the install silently no-ops —
      #     every gate then self-skips and the metric is never produced. We instead
      #     use `gh release download`, which is preinstalled on GitHub runners and
      #     authenticated via GITHUB_TOKEN (5000 req/hr) — robust under load.
      #   • actionlint keeps its official download script; zizmor stays on pipx.
      # We `set +e` (no single failure aborts the step), ALWAYS export $GITHUB_PATH
      # at the end, and print diagnostics so the next CI run proves exactly what
      # installed. The job is continue-on-error too, so an install hiccup never
      # blocks the build.
      - name: Install advisory security scanners (gitleaks/osv/actionlint/zizmor)
        continue-on-error: true
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          set +e
          mkdir -p "$HOME/.local/bin"
          # gitleaks — download latest linux x64 tarball via gh (authed), extract binary
          rm -rf /tmp/gl && mkdir -p /tmp/gl
          gh release download --repo gitleaks/gitleaks --pattern '*linux_x64.tar.gz' --dir /tmp/gl
          tar -xzf /tmp/gl/*linux_x64.tar.gz -C "$HOME/.local/bin" gitleaks
          # osv-scanner — download latest linux amd64 bare binary via gh (authed)
          rm -rf /tmp/osv && mkdir -p /tmp/osv
          gh release download --repo google/osv-scanner --pattern '*linux_amd64' --dir /tmp/osv
          install -m 0755 /tmp/osv/*linux_amd64 "$HOME/.local/bin/osv-scanner"
          # actionlint — official download script
          bash <(curl -fsSL https://raw.githubusercontent.com/rhysd/actionlint/main/scripts/download-actionlint.bash) latest "$HOME/.local/bin"
          # zizmor — PyPI (pipx preferred, pip --user fallback); lands in ~/.local/bin.
          # PINNED on purpose. Unpinned, the runner installed whatever PyPI served that day and
          # measured 1 finding MORE than the devbox on the identical commit (190 vs 189) during
          # the v3.8.49 cycle — which cost a second rebaseline push per release, chasing a
          # number that was never the code's. The ratchet compares counts across machines, so
          # the auditor version has to be the same on both. Bump this deliberately, and
          # rebaseline in the same commit: check-workflows.mjs now prints `zizmorVersion=` next
          # to the count so the new number is traceable to the tool that produced it.
          ZIZMOR_VERSION=1.25.2
          pipx install "zizmor==$ZIZMOR_VERSION" || pip install --user "zizmor==$ZIZMOR_VERSION"
          # oasdiff — download latest linux amd64 tarball via gh (authed), extract binary
          rm -rf /tmp/oasd && mkdir -p /tmp/oasd
          gh release download --repo oasdiff/oasdiff --pattern '*linux_amd64.tar.gz' --dir /tmp/oasd
          tar -xzf /tmp/oasd/*linux_amd64.tar.gz -C "$HOME/.local/bin" oasdiff
          # ALWAYS export the bin dir (even if any step above failed)
          echo "$HOME/.local/bin" >> "$GITHUB_PATH"
          # diagnostics — prove what installed on the next CI run
          ls -la "$HOME/.local/bin"
          "$HOME/.local/bin/gitleaks" version || true
          "$HOME/.local/bin/actionlint" -version || true
          "$HOME/.local/bin/osv-scanner" --version || true
          "$HOME/.local/bin/oasdiff" --version || true
          zizmor --version || true
      # BLOCKING ratchet (Etapa 2): secretFindings must not regress vs the baseline.
      # --ratchet exits 1 on a measured regression; it SKIPs (exit 0) when gitleaks
      # is absent (a missing binary never blocks).
      - name: Secret scan (gitleaks, ratchet, blocking)
        run: npm run check:secrets -- --ratchet
      # BLOCKING ratchet (v3.8.27 cycle-end): vulnCount must not regress vs the
      # baseline. --ratchet exits 1 on a measured regression (measured > baseline);
      # it SKIPs (exit 0) when osv-scanner is absent or osv.dev is unreachable (a
      # missing/failed measurement never blocks). See the CVE-variance note in
      # docs/security/SUPPLY_CHAIN.md — a newly-disclosed CVE on an unchanged dep can
      # red this gate; the fix is to bump the dep or re-baseline metrics.vulnCount.
      - name: Vulnerability ratchet (osv-scanner, ratchet, blocking)
        run: npm run check:vuln-ratchet -- --ratchet
      # BLOCKING ratchet (Etapa 2): zizmorFindings must not regress vs the baseline.
      # ONLY zizmor is ratcheted — actionlint findings are reported, not blocking.
      # --ratchet exits 1 on a measured zizmor regression; it SKIPs (exit 0) when
      # zizmor is absent (a missing binary never blocks).
      - name: Workflow lint (actionlint+zizmor, ratchet, blocking)
        run: npm run check:workflows -- --ratchet
      # OpenAPI breaking-change detection (oasdiff). Diffs the PR's public API
      # contract (docs/openapi.yaml) against the base branch's spec.
      # BLOCKING ratchet (Fase 9 Onda 0): reads metrics.openapiBreaking.value and
      # exits 1 ONLY on a measured regression (count > baseline). It SKIPs (exit 0)
      # when oasdiff is absent or the base spec can't be resolved — a missing
      # measurement never blocks. BASE_REF is read by the script from the env
      # (never interpolated into a shell body) — workflow-injection-safe.
      - name: OpenAPI breaking-change (oasdiff, ratchet, blocking)
        env:
          BASE_REF: ${{ github.base_ref }}
        run: npm run check:openapi-breaking -- --ratchet

  docs-sync-strict:
    name: Docs Sync (Strict)
    runs-on: ubuntu-latest
    needs: changes
    # P3 (plano mestre): a release-PR viva fica DRAFT o ciclo inteiro — jobs pesados pulam
    # drafts (ciclo v3.8.44: 123 runs pesados re-disparados por merges na release, 88 cancelados).
    # Run when docs OR code change: API/route code can break doc/OpenAPI contract gates.
    if: ${{ github.event_name != 'pull_request' || (github.event.pull_request.draft == false && (needs.changes.outputs.docs == 'true' || needs.changes.outputs.code == 'true')) }}
    steps:
      - uses: actions/checkout@v7
        with:
          persist-credentials: false
      - uses: actions/setup-node@v7
        with:
          node-version: ${{ env.CI_NODE_VERSION }}
          cache: npm
      - uses: ./.github/actions/npm-ci-retry
      - run: npm run check:docs-all
      # Previously-orphaned contract gates (existed as files, never wired anywhere).
      # All exit 0 today: cli-i18n is a hard gate, openapi-coverage is a ratchet
      # (floor ~36), openapi-security-tiers is advisory (Hard Rules #15/#17).
      - name: CLI i18n consistency
        run: npm run check:cli-i18n
      - name: OpenAPI route coverage (ratchet)
        run: npm run check:openapi-coverage
      - name: OpenAPI security-tier consistency (advisory)
        run: npm run check:openapi-security-tiers
      # One FS inventory of src/app/api for both anti-hallucination directions.
      - name: API docs refs (openapi + prose → routes)
        run: npm run check:api-docs-refs
      - name: i18n translation drift (warn)
        run: node scripts/i18n/check-translation-drift.mjs --warn

  docs-lint:
    name: Docs Lint (prose — advisory)
    runs-on: ubuntu-latest
    needs: changes
    # P3 (plano mestre): a release-PR viva fica DRAFT o ciclo inteiro — jobs pesados pulam
    # drafts (ciclo v3.8.44: 123 runs pesados re-disparados por merges na release, 88 cancelados).
    # Prose/markdown only — skip when the PR has no doc surface.
    if: ${{ github.event_name != 'pull_request' || (github.event.pull_request.draft == false && needs.changes.outputs.docs == 'true') }}
    # Advisory (warning-first): prose/markdown style must not block merges while the
    # existing doc corpus is brought up to style. Promote to blocking once it converges.
    continue-on-error: true
    steps:
      - uses: actions/checkout@v7
        with:
          persist-credentials: false
      - uses: actions/setup-node@v7
        with:
          node-version: ${{ env.CI_NODE_VERSION }}
          cache: npm
      - name: markdownlint (docs + root, advisory)
        run: npx --yes markdownlint-cli2 "docs/**/*.md" "*.md" "!docs/i18n" "!docs/research" || true
      - name: Vale prose lint (Microsoft style, advisory)
        # Non-fatal: a Vale/reviewdog setup error must not turn this advisory job red.
        continue-on-error: true
        uses: errata-ai/vale-action@reviewdog
        with:
          files: docs
          fail_on_error: false
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  i18n-ui-coverage:
    name: i18n UI Coverage
    runs-on: ubuntu-latest
    needs: changes
    # P3 (plano mestre): a release-PR viva fica DRAFT o ciclo inteiro — jobs pesados pulam
    # drafts (ciclo v3.8.44: 123 runs pesados re-disparados por merges na release, 88 cancelados).
    # UI keys move with dashboard code OR message catalogs.
    if: ${{ github.event_name != 'pull_request' || (github.event.pull_request.draft == false && (needs.changes.outputs.i18n == 'true' || needs.changes.outputs.code == 'true')) }}
    steps:
      # fetch-depth: 0 — the value-drift gate diffs en.json against the merge base to
      # find rewritten English strings. On a shallow clone the base ref is missing and
      # the gate self-skips (base-unresolved), so it would never actually run.
      - uses: actions/checkout@v7
        with:
          persist-credentials: false
          fetch-depth: 0
      - uses: actions/setup-node@v7
        with:
          node-version: ${{ env.CI_NODE_VERSION }}
          cache: npm
      - uses: ./.github/actions/npm-ci-retry
      - run: node scripts/i18n/check-ui-keys-coverage.mjs --threshold=65
      # Real-translation ratchet: a leaf copied verbatim from en.json passes key
      # parity above but is still English to the user (es shipped 55% English).
      # Advisory in PR-0; flipped to blocking once the backlog is retranslated (PR-4).
      - name: i18n real-translation ratio (advisory)
        run: node scripts/i18n/check-translation-ratio.mjs --warn
      # #8463: a rewritten English value used to leave its 39 translations behind
      # silently (googleOAuthWarning shipped wrong copy in 39 locales for months).
      # Key parity above cannot see it — a stale translation counts as covered.
      - name: i18n UI value drift (stale translations)
        env:
          BASE_REF: ${{ github.base_ref && format('origin/{0}', github.base_ref) || '' }}
        run: node scripts/i18n/check-ui-value-drift.mjs

  # #8038: cheap glossary/protected-terms consistency gate —
  # complements i18n-ui-coverage (key parity) and the ICU `i18n` job below
  # without needing app-boot/Playwright infra. Same gating as i18n-ui-coverage.
  # ko added after the #8224 ko.json mistranslation cleanup so the fixed
  # terminology cannot silently regress on the next machine-translation run.
  i18n-glossary-zhcn:
    name: i18n Glossary (zh-CN, ko)
    runs-on: ubuntu-latest
    needs: changes
    if: ${{ github.event_name != 'pull_request' || (github.event.pull_request.draft == false && (needs.changes.outputs.i18n == 'true' || needs.changes.outputs.code == 'true')) }}
    steps:
      - uses: actions/checkout@v7
        with:
          persist-credentials: false
      - uses: actions/setup-node@v7
        with:
          node-version: ${{ env.CI_NODE_VERSION }}
          cache: npm
      - uses: ./.github/actions/npm-ci-retry
      - run: node scripts/i18n/check-glossary-consistency.mjs --locale=zh-CN
      - run: node scripts/i18n/check-glossary-consistency.mjs --locale=zh-TW

  # D4 (plano mestre testes+CI): a matrix de ~40 jobs de <1min por idioma saturava sozinha
  # a concorrência de jobs da conta (Free = 20 slots, compartilhados entre TODOS os repos)
  # e pagava spin-up + arredondamento de billing por idioma. Um único job itera os idiomas
  # (mesmo script), com grupo de log por idioma e artifact único de resultados nomeados por
  # idioma (a matrix antiga subia 40 artifacts cujo result.txt colidia no merge-multiple).
  i18n:
    name: i18n Validation (all languages)
    runs-on: ubuntu-latest
    needs: changes
    # P3 (plano mestre): a release-PR viva fica DRAFT o ciclo inteiro — jobs pesados pulam
    # drafts (ciclo v3.8.44: 123 runs pesados re-disparados por merges na release, 88 cancelados).
    # Message-catalog / i18n-tooling only — pure code without i18n surface skips this lane.
    if: ${{ github.event_name != 'pull_request' || (github.event.pull_request.draft == false && needs.changes.outputs.i18n == 'true') }}
    continue-on-error: true
    steps:
      - uses: actions/checkout@v7
        with:
          persist-credentials: false
      - uses: actions/setup-python@v7
        with:
          python-version: "3.12"
      - name: Validate all languages
        run: |
          set -uo pipefail
          mkdir -p i18n-results
          FAIL=0
          for f in src/i18n/messages/*.json; do
            lang=$(basename "$f" .json)
            [ "$lang" = "en" ] && continue
            echo "::group::i18n $lang"
            if python3 scripts/i18n/validate_translation.py quick -l "$lang" > "i18n-results/$lang.txt" 2>&1; then
              echo "OK $lang"
            else
              FAIL=1
              echo "FAIL $lang"
              cat "i18n-results/$lang.txt"
            fi
            echo "::endgroup::"
          done
          exit "$FAIL"
      - name: Upload results
        if: always()
        uses: actions/upload-artifact@v7
        with:
          name: i18n-results
          path: i18n-results/

  pr-test-policy:
    name: PR Test Policy
    if: ${{ github.event_name == 'pull_request' && github.event.pull_request.draft == false }}
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
        with:
          persist-credentials: false
          fetch-depth: 0
      - uses: actions/setup-node@v7
        with:
          node-version: ${{ env.CI_NODE_VERSION }}
      - name: Fetch base branch
        run: git fetch --no-tags origin "${GITHUB_BASE_REF}"
      - name: Validate source changes include tests
        run: node scripts/check/check-pr-test-policy.mjs --summary-file .artifacts/pr-test-policy.md
      # Anti test-masking: flag net assert removal / new assert.ok(true) in changed tests.
      - name: Detect test-masking (weakened assertions)
        run: npm run check:test-masking
      # Evidence-in-PR-body (Hard Rule #18 mechanized): claims of "tests pass" must carry output.
      - name: Require evidence in PR body
        run: npm run check:pr-evidence
        env:
          PR_BODY: ${{ github.event.pull_request.body }}
      - name: Publish PR test policy summary
        if: always()
        run: |
          if [ -f .artifacts/pr-test-policy.md ]; then
            cat .artifacts/pr-test-policy.md >> "$GITHUB_STEP_SUMMARY"
          fi

  build:
    name: Build
    # Dynamic runner: when the release captain flips the USE_VPS_RUNNER repo var to
    # 'true' (scripts/vps/release-runner-up.sh does it after the self-hosted VM is
    # online), the heavy jobs run on the dedicated 32-core VPS runners (label
    # omni-build) instead of queueing on the 20-concurrent-job hosted pool.
    # Safety: fork PRs NEVER reach the self-hosted runner — the expression falls
    # back to ubuntu-latest unless the PR head repo is this repository (push /
    # dispatch events are own-origin by definition). Any failure path (VM down,
    # var unset/false) also falls back to ubuntu-latest.
    runs-on: ${{ (vars.USE_VPS_RUNNER == 'true' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository)) && fromJSON('["self-hosted","omni-build"]') || 'ubuntu-latest' }}
    needs: changes
    # The .113 pool runs ONE next-build with room to spare and two at the edge: the
    # box has 31 GB and a single next-build peaks at 14–16 GB RSS. On 2026-08-28
    # 13:50Z the kernel OOM-killed main's build while a PR build ran beside it
    # (five Build jobs had been queued by a burst of PRs). Two lanes: main keeps
    # its own so a release is never queued behind PR traffic; PR builds serialize
    # among themselves. docker-publish.yml's amd64 leg joins `heavy-build-main`
    # so a :next image build waits beside this artefact instead of becoming the
    # third heavy (#11976). GitHub keeps one running + one pending per group.
    concurrency:
      group: heavy-build-${{ github.ref == 'refs/heads/main' && 'main' || 'pr' }}
      cancel-in-progress: false
    if: ${{ github.event_name != 'pull_request' || (needs.changes.outputs.code == 'true' && github.event.pull_request.draft == false) }}
    steps:
      - uses: actions/checkout@v7
        with:
          persist-credentials: false
      - uses: actions/setup-node@v7
        with:
          node-version: ${{ env.CI_NODE_VERSION }}
          cache: npm
      - uses: ./.github/actions/npm-ci-retry
      - run: npm run check:node-runtime
      # NOTE: the webpack `.build/next/cache` actions/cache step was removed with the
      # Turbopack switch below — Turbopack does not read/write the webpack cache dir
      # (its persistent FS cache is still experimental and intentionally NOT enabled),
      # so restoring the old ~0.5 GB webpack cache would only waste download time.
      # Rolling back to webpack = revert this commit (cache step comes back with it).
      #
      # Turbopack production build (Next 16, stable): benchmarked 1.9× faster than the
      # webpack pass (9min0s vs 17min15s on a 32-core box; multi-core Rust vs webpack's
      # single-threaded compile). Standalone output smoke-validated (server boots,
      # /api/monitoring/health 200). Downstream jobs (e2e ×9, package-artifact,
      # electron-package-smoke) consume this artifact, so a green run here validates
      # the Turbopack artifact end-to-end.
      - run: npm run build
        env:
          OMNIROUTE_USE_TURBOPACK: "1"
      - name: Archive Next.js build for downstream jobs
        # Use tar so the archive preserves paths relative to CWD (.build/next/...).
        # upload-artifact path-stripping is ambiguous when exclude patterns are used;
        # an explicit tar avoids the double-nesting issue (.build/next/next/...).
        # Keep standalone/node_modules intact: package/electron jobs consume the
        # Next-traced standalone tree and must not replace it with root node_modules.
        run: |
          tar -czf "$RUNNER_TEMP/e2e-build.tar.gz" \
            --exclude='.build/next/cache' \
            .build/next
      - name: Upload Next.js build for downstream jobs
        uses: actions/upload-artifact@v7
        with:
          name: next-build
          path: ${{ runner.temp }}/e2e-build.tar.gz
          retention-days: 1

  package-artifact:
    name: Package Artifact
    runs-on: ubuntu-latest
    needs: build
    env:
      JWT_SECRET: ci-build-secret-with-sufficient-length-for-validation
    steps:
      - uses: actions/checkout@v7
        with:
          persist-credentials: false
      - uses: actions/setup-node@v7
        with:
          node-version: ${{ env.CI_NODE_VERSION }}
          cache: npm
      - uses: ./.github/actions/npm-ci-retry
      - run: npm run check:node-runtime
      - name: Download Next.js build artifact
        uses: actions/download-artifact@v8
        with:
          name: next-build
          # Workspace-relative on purpose: the matrix below includes windows-latest, whose
          # default shell is pwsh, where $RUNNER_TEMP is empty (it is $env:RUNNER_TEMP) —
          # #11896's first cut broke the Electron smoke on exactly that. A relative path
          # works in bash and pwsh alike; hosted workspaces are ephemeral.
          path: next-build-artifact
      - name: Extract Next.js build artifact
        run: |
          tar -xzf next-build-artifact/e2e-build.tar.gz
      # build:cli consumes the downloaded .build/next standalone artifact and assembles dist/;
      # it only rebuilds if the downloaded standalone artifact is missing.
      - run: npm run build:cli
      - name: Assert dist/server.js exists
        run: test -f dist/server.js || (echo "dist/server.js missing — build:cli did not assemble correctly" && exit 1)
      # `build:cli` monta dist/ mas NAO grava dist/BUILD_SHA — so `build:release` faz
      # isso, chamando write-build-sha.mjs. O guard de proveniencia do #10427, dentro
      # de check:pack-artifact, rejeita um artefato sem SHA (e rejeita mesmo com
      # OMNIROUTE_ALLOW_CANARY_BUILD=1: o que nao da para identificar nao da para
      # vouchear). Sem este passo o par build+validate deste job e estruturalmente
      # incompativel e falha 100% das vezes.
      - name: Stamp dist/BUILD_SHA for the provenance guard (#10427)
        # O SHA TEM de vir do head da PR, nao de `git rev-parse HEAD`. Este workflow
        # roda em `pull_request`, entao o checkout e o MERGE COMMIT efemero que o
        # GitHub cria — um commit que nao existe em branch nenhuma e portanto nunca e
        # ancestral da release. O guard de proveniencia (#10427) rejeita exatamente
        # isso, e com razao: um artefato carimbado com o merge commit nao pode ser
        # rastreado ate codigo que passou pelos gates.
        env:
          OMNIROUTE_BUILD_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
        run: |
          export OMNIROUTE_BUILD_SHA="${OMNIROUTE_BUILD_SHA:0:7}"
          node scripts/build/write-build-sha.mjs
      # O guard de proveniencia checa ancestralidade contra `origin/main` por padrao.
      # Esse e o ref certo na PUBLICACAO (npm-publish.yml roda em main), mas em
      # `pull_request` e estruturalmente impossivel: enquanto a PR esta aberta o head
      # dela NUNCA e ancestral de main — e o checkout raso nem traz `origin/main` para
      # o grafo local, entao a sonda responde `false` de qualquer jeito. Resultado: o
      # gate falhava 100% das vezes em PR. Pre-merge o unico invariante checavel e "o
      # stamp corresponde a branch sob teste", entao apontamos o ref para o head da PR.
      # Usamos `refs/pull/<N>/head` e nao `head.ref` porque aquele existe no PROPRIO
      # origin mesmo quando a PR vem de um fork; `head.ref` so existe no repo do autor.
      - name: Resolve the provenance ref for the pack gate (#10427)
        id: provenance-ref
        env:
          PR_NUMBER: ${{ github.event.pull_request.number }}
        run: |
          if [ -n "$PR_NUMBER" ]; then
            git fetch --no-tags --depth=50 origin \
              "+refs/pull/$PR_NUMBER/head:refs/remotes/origin/pr-head"
            echo "ref=origin/pr-head" >> "$GITHUB_OUTPUT"
          else
            git fetch --no-tags --depth=50 origin \
              "+refs/heads/$GITHUB_REF_NAME:refs/remotes/origin/$GITHUB_REF_NAME"
            echo "ref=origin/$GITHUB_REF_NAME" >> "$GITHUB_OUTPUT"
          fi
      - run: npm run check:pack-artifact
        env:
          OMNIROUTE_RELEASE_REF: ${{ steps.provenance-ref.outputs.ref }}
      # WS1.2 (#7065 class): pack the real tarball, install it into a clean prefix and
      # BOOT it to a healthy /api/monitoring/health — the gate that structure checks
      # cannot provide (3 releases shipped boot-crashing tarballs with green lists).
      - name: Boot-smoke the packed tarball
        run: npm run check:pack-boot

  electron-package-smoke:
    name: Electron Package Smoke (${{ matrix.os }})
    runs-on: ${{ matrix.os }}
    timeout-minutes: 30
    needs: build
    # WS1.5 (v3.8.49 plan): the Electron native-module path previously executed for
    # the FIRST time on the release tag — the v3.8.48 Windows bug (npx.cmd spawned
    # without shell, CVE-2024-27980 behavior change) could only surface at release.
    # windows-latest runs prepare:bundle (better-sqlite3 prebuild verification since
    # v13 — the node-gyp rebuild is gone) per release PR; ubuntu keeps the full
    # pack + headless smoke.
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, windows-latest]
    env:
      JWT_SECRET: ci-build-secret-with-sufficient-length-for-validation
      CSC_IDENTITY_AUTO_DISCOVERY: "false"
    steps:
      - uses: actions/checkout@v7
        with:
          persist-credentials: false
      - uses: actions/setup-node@v7
        with:
          node-version: ${{ env.CI_NODE_VERSION }}
          cache: npm
      - uses: ./.github/actions/npm-ci-retry
      - run: npm run check:node-runtime
      - name: Download Next.js build artifact
        uses: actions/download-artifact@v8
        with:
          name: next-build
          # Workspace-relative on purpose: the matrix below includes windows-latest, whose
          # default shell is pwsh, where $RUNNER_TEMP is empty (it is $env:RUNNER_TEMP) —
          # #11896's first cut broke the Electron smoke on exactly that. A relative path
          # works in bash and pwsh alike; hosted workspaces are ephemeral.
          path: next-build-artifact
      - name: Extract Next.js build artifact
        run: |
          tar -xzf next-build-artifact/e2e-build.tar.gz
      - name: Install Electron dependencies
        working-directory: electron
        run: npm install --no-audit --no-fund
      - name: Pack Electron app
        if: runner.os == 'Linux'
        working-directory: electron
        run: npm run pack
      # ADVISORY while the new Windows leg matures (repo convention, dast-smoke
      # precedent): its first-ever real run (2026-07-15, run 29457533565) died in
      # 0.7s with the error swallowed by pwsh — bash shell captures stderr and
      # continue-on-error keeps the heavy gate green while we harden it (#7336).
      - name: Prepare Electron standalone (Windows prebuild verification)
        if: runner.os == 'Windows'
        working-directory: electron
        continue-on-error: true
        shell: bash
        run: npm run prepare:bundle 2>&1
      - name: Smoke packaged Electron app
        if: runner.os == 'Linux'
        env:
          ELECTRON_SMOKE_TIMEOUT_MS: 60000
        run: xvfb-run -a npm run electron:smoke:packaged

  test-unit:
    name: Unit Tests (${{ matrix.shard }}/8)
    # Same dynamic-runner rule as Build (own-origin only; fallback ubuntu-latest).
    # PINNED to hosted, deliberately not on the USE_VPS_RUNNER switch (gap 19). One variable
    # governed the build and the test jobs, which want OPPOSITE machines: the build needs the
    # .113's RAM, the tests need the hosted runner's link. Measured on 2026-07-29 —
    # actions/setup-node took 20m06s on .113 with 4 concurrent runners versus 16s hosted (npm
    # cache restore saturating the link), while the tests themselves tied, 2m54 vs 2m31. So
    # self-hosted is strictly worse here and there is nothing to configure.
    runs-on: ubuntu-latest
    timeout-minutes: 25
    # needs: changes (not build) — this job never downloads the next-build artifact;
    # gating it on Build only serialized ~20min of wall-clock for nothing. Jobs that
    # DO consume the artifact (e2e, package-artifact, electron-package-smoke) keep
    # needs: build. The `if` mirrors Build's own skip condition so docs-only PRs
    # still skip the suite.
    needs: changes
    if: ${{ github.event_name != 'pull_request' || (needs.changes.outputs.code == 'true' && github.event.pull_request.draft == false) }}
    strategy:
      fail-fast: false
      matrix:
        shard: [1, 2, 3, 4, 5, 6, 7, 8]
    env:
      JWT_SECRET: ci-test-secret-with-sufficient-length-for-validation
      API_KEY_SECRET: ci-test-api-key-secret-long
      DISABLE_SQLITE_AUTO_BACKUP: "true"
    steps:
      - uses: actions/checkout@v7
        with:
          persist-credentials: false
      - uses: actions/setup-node@v7
        with:
          node-version: ${{ env.CI_NODE_VERSION }}
          cache: npm
      - uses: ./.github/actions/npm-ci-retry
      - run: npm run check:node-runtime
      # QW-d (plano mestre): fonte única — o MESMO npm script dos runs locais (adiciona o
      # setupPolyfill que o comando inline omitia; o glob canônico vive só no package.json).
      # D3 (plano mestre): a coverage é coletada NESTE mesmo run (c8/NODE_V8_COVERAGE propaga
      # aos filhos através do npm) — elimina a matrix Coverage Shard ×8, que re-executava a
      # suíte inteira só para medir o gate. Padrão usado pelo CI do próprio nodejs/node.
      # Heap: os shards rodam sob instrumentacao de cobertura do V8, que retem muito
      # mais memoria que a suite crua. Com o teto antigo de 4096 MB os shards passaram
      # a abortar com SIGABRT (exit 134, "Ineffective mark-compacts near heap limit")
      # ao redor de 4086 MB conforme o catalogo de providers cresceu no ciclo v3.8.50 —
      # todos os testes passavam e o processo morria no fim, o que le como falha de
      # teste sem ser. O teto vive em `test:unit:ci:shard` (package.json) e agora
      # acompanha os 8192 MB ja usados pelas variantes nao-shardadas; os runners
      # GitHub-hosted tem 16 GB.
      - name: Unit tests (shard ${{ matrix.shard }}/8) with V8 coverage
        env:
          TEST_SHARD: ${{ matrix.shard }}/8
          # NODE_OPTIONS (nao so o flag em test:unit:ci:shard) porque quem estoura o
          # heap e o processo `c8` que embrulha a suite — ele agrega ~577 MB de JSON
          # de cobertura bruta. Subir o teto so no node filho deixa o pai no default
          # do V8 (~4 GB) e o OOM continua igual, em ~4083 MB. Mesmo padrao ja usado
          # pelo job de merge de cobertura mais abaixo.
          NODE_OPTIONS: --max-old-space-size=8192
        run: |
          rm -rf coverage-shard coverage-shard-report
          npx c8 \
            --temp-directory=coverage-shard \
            --reports-dir=coverage-shard-report \
            --reporter=json \
            --exclude=tests/** \
            --exclude=**/*.test.* \
            npm run test:unit:ci:shard
      - name: Upload raw shard coverage
        if: always()
        uses: actions/upload-artifact@v7
        with:
          name: coverage-shard-${{ matrix.shard }}
          path: coverage-shard/*.json
          if-no-files-found: error

  test-bun-sqlite:
    name: Bun SQLite Compatibility
    strategy:
      matrix:
        os: [ubuntu-latest, windows-latest]
      fail-fast: false
    runs-on: ${{ matrix.os }}
    continue-on-error: ${{ matrix.os == 'windows-latest' }}
    timeout-minutes: 10
    needs: changes
    if: ${{ github.event_name != 'pull_request' || (needs.changes.outputs.code == 'true' && github.event.pull_request.draft == false) }}
    steps:
      - uses: actions/checkout@v7
        with:
          persist-credentials: false
      - uses: actions/setup-node@v7
        with:
          node-version: ${{ env.CI_NODE_VERSION }}
          cache: npm
      - uses: ./.github/actions/npm-ci-retry
      - name: Install Bun (Windows)
        if: runner.os == 'Windows'
        shell: pwsh
        run: |
          powershell -c "iwr bun.sh/install.ps1 -useb | iex"
          echo "$env:USERPROFILE\.bun\bin" | Out-File -FilePath $env:GITHUB_PATH -Append
      - name: Install Bun (non-Windows)
        if: runner.os != 'Windows'
        run: npm install -g bun
      - run: npm run test:bun:db

  test-vitest:
    name: Vitest (MCP / autoCombo / UI components)
    # Same dynamic-runner rule as Build (own-origin only; fallback ubuntu-latest).
    # PINNED to hosted, deliberately not on the USE_VPS_RUNNER switch (gap 19). One variable
    # governed the build and the test jobs, which want OPPOSITE machines: the build needs the
    # .113's RAM, the tests need the hosted runner's link. Measured on 2026-07-29 —
    # actions/setup-node took 20m06s on .113 with 4 concurrent runners versus 16s hosted (npm
    # cache restore saturating the link), while the tests themselves tied, 2m54 vs 2m31. So
    # self-hosted is strictly worse here and there is nothing to configure.
    runs-on: ubuntu-latest
    timeout-minutes: 15
    # needs: changes (not build) — no artifact consumed; see test-unit note.
    needs: changes
    if: ${{ github.event_name != 'pull_request' || (needs.changes.outputs.code == 'true' && github.event.pull_request.draft == false) }}
    env:
      JWT_SECRET: ci-test-secret-with-sufficient-length-for-validation
      API_KEY_SECRET: ci-test-api-key-secret-long
      DISABLE_SQLITE_AUTO_BACKUP: "true"
    steps:
      - uses: actions/checkout@v7
        with:
          persist-credentials: false
      - uses: actions/setup-node@v7
        with:
          node-version: ${{ env.CI_NODE_VERSION }}
          cache: npm
      - uses: ./.github/actions/npm-ci-retry
      # The second test runner (CLAUDE.md: "Both test runners must pass") — was never
      # wired into CI until the 2026-06-09 quality audit (Fase 6A.2).
      # WS5.2/5.3 (v3.8.49 plan): JUnit output feeds Trunk Flaky Tests (advisory upload
      # below). node:test stays OUT of the first wave (fd1-sensitive reporter stream).
      - run: npm run test:vitest -- --reporter=default --reporter=junit --outputFile.junit=trunk-junit/vitest-mcp.xml
      # vitest:ui went back to 870/870 green in the v3.8.49 quality plan (WS6.1,
      # PR #7127 — 69 fails triaged: matchMedia polyfill, node:test→vitest migration,
      # CompareTab D22 cap). Promoted to BLOCKING per the plan's post-merge step.
      - run: npm run test:vitest:ui -- --reporter=default --reporter=junit --outputFile.junit=trunk-junit/vitest-ui.xml
      # Trunk Flaky Tests upload — advisory (never blocks), own-origin only (fork PRs
      # have no TRUNK_TOKEN). Pinned by SHA (tag v2.1.2).
      - name: Upload test results to Trunk (advisory)
        if: ${{ always() && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) }}
        continue-on-error: true
        uses: trunk-io/analytics-uploader@385f1ccdf345b4532dc4b6c665dd432b702b8e28 # v2.1.2
        with:
          junit-paths: trunk-junit/**/*.xml
          org-slug: omniroute
          token: ${{ secrets.TRUNK_TOKEN }}

  # Node 24/26 compatibility matrices moved to .github/workflows/nightly-compat.yml
  # (plano mestre testes+CI, Eixo D2 — they cost ~28% of every heavy run to catch a
  # failure class that rarely originates in a PR; nightly catches it within 24h and
  # the release gate can still exercise them via workflow_dispatch when needed).
  test-coverage:
    name: Coverage
    runs-on: ubuntu-latest
    # 10min was sized before #7114 added the lcov reporter (Codecov/Sonar need it);
    # merging 8 shard JSONs + text+json+lcov now takes ~10-12min — three consecutive
    # release-tip runs died at exactly 10m as job-timeout "cancelled" (2026-07-15/16).
    # 30, not 20 (2026-08-29): the informational Codecov upload below hung for the rest of
    # the budget on two consecutive main runs (33207760653, 33215115341); the job ended
    # `cancelled` and dragged the whole run's conclusion to `cancelled` although every
    # blocking job was green. The upload step now has its own ceiling; this is headroom.
    timeout-minutes: 30
    needs: test-unit
    if: ${{ !cancelled() && needs.test-unit.result == 'success' && !contains(github.event.pull_request.labels.*.name, 'hotfix') }}
    env:
      JWT_SECRET: ci-test-secret-with-sufficient-length-for-validation
      API_KEY_SECRET: ci-test-api-key-secret-long
    steps:
      - uses: actions/checkout@v7
        with:
          persist-credentials: false
      - uses: actions/setup-node@v7
        with:
          node-version: ${{ env.CI_NODE_VERSION }}
          cache: npm
      - uses: ./.github/actions/npm-ci-retry
      - name: Download all shard coverage
        uses: actions/download-artifact@v8
        with:
          pattern: coverage-shard-*
          path: coverage-shards/
          merge-multiple: true
      - name: Merge + report + gate
        # Merging 8 shards of raw v8 coverage is memory-heavy. `--merge-async`
        # keeps the V8 coverage merge incremental instead of loading every raw
        # JSON blob into one in-memory merge, which avoids Node heap OOMs.
        env:
          NODE_OPTIONS: --max-old-space-size=8192
        run: |
          mkdir -p coverage
          first_coverage_file=""
          if [ -d coverage-shards ]; then
            first_coverage_file="$(find coverage-shards -maxdepth 1 -type f -name '*.json' -print -quit)"
          fi
          if [ -z "$first_coverage_file" ]; then
            echo "::error::No raw coverage shard data was downloaded."
            find . -maxdepth 3 -type f | sort
            exit 1
          fi
          # Gate aligned to the project's local coverage bar: `npm run test:coverage`
          # gates at 60/60/60/60, so CI must match it (the previous CI floor of 40
          # silently undershot the local bar — a real drift). Real merged coverage is
          # ~79/79/82/75, so 60 is a conservative floor with headroom; the Fase-4
          # coverage ratchet (quality-baseline.json) layers "must not drop vs baseline"
          # on top of this floor.
          npx c8 report \
            --temp-directory coverage-shards \
            --reports-dir coverage \
            --merge-async \
            --reporter=text-summary \
            --reporter=json-summary \
            --reporter=lcov \
            --exclude=tests/** \
            --exclude=**/*.test.* \
            --check-coverage \
            --statements 60 --lines 60 --functions 60 --branches 60
      - name: Build coverage summary
        if: always()
        run: |
          mkdir -p coverage
          if [ -f coverage/coverage-summary.json ]; then
            node scripts/check/test-report-summary.mjs \
              --input coverage/coverage-summary.json \
              --output coverage/coverage-report.md \
              --threshold 60
          else
            printf '%s\n' \
              '# Coverage Report' \
              '' \
              'Coverage summary JSON was not generated. Inspect the Coverage job logs.' \
              > coverage/coverage-report.md
          fi
          cat coverage/coverage-report.md >> "$GITHUB_STEP_SUMMARY"
      # WS5.6 (D7, v3.8.49 plan): patch coverage on the PR diff via Codecov —
      # informational during calibration (codecov.yml sets informational: true);
      # promote to blocking only after ~2 weeks without false blocks. The lcov
      # reporter above also fixes coverage/lcov.info being silently absent
      # (if-no-files-found: warn) — Sonar consumes the same file.
      - name: Upload coverage to Codecov (informational)
        if: always()
        # Informational means informational: its own ceiling and continue-on-error, so a
        # stalled upload can neither eat the job's budget nor turn a green job cancelled.
        timeout-minutes: 5
        continue-on-error: true
        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
        with:
          files: coverage/lcov.info
          token: ${{ secrets.CODECOV_TOKEN }}
          fail_ci_if_error: false
      - name: Upload coverage artifacts
        if: always()
        uses: actions/upload-artifact@v7
        with:
          name: coverage-report
          path: |
            coverage/coverage-summary.json
            coverage/coverage-report.md
            coverage/lcov.info
          if-no-files-found: warn

  sonarqube:
    name: SonarQube
    runs-on: ubuntu-latest
    needs: test-coverage
    # Temporarily opt-in: the private project currently has no Sonar quota.
    # Re-enable without another code change by setting the repository Actions
    # variable SONARQUBE_ENABLED=true after quota/project access is restored.
    if: ${{ vars.SONARQUBE_ENABLED == 'true' && !cancelled() && needs.test-coverage.result == 'success' }}
    env:
      SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
      SONAR_HOST_URL: ${{ secrets.SONAR_HOST_URL }}
    steps:
      - uses: actions/checkout@v7
        with:
          persist-credentials: false
          fetch-depth: 0
      # The upload strips the common `coverage/` prefix, so the artifact root holds
      # lcov.info directly — download into coverage/ so it lands at coverage/lcov.info,
      # where sonar.javascript.lcov.reportPaths expects it (path: . left the Sonar
      # new-code coverage at 0% every scan).
      - uses: actions/download-artifact@v8
        with:
          name: coverage-report
          path: coverage/
      - name: Explain SonarQube skip
        if: ${{ github.event_name != 'pull_request' || env.SONAR_TOKEN == '' || env.SONAR_HOST_URL == '' }}
        run: |
          if [ "${{ github.event_name }}" != "pull_request" ]; then
            echo "SonarQube scan skipped on non-PR events to keep main pushes governed by repository CI gates." >> "$GITHUB_STEP_SUMMARY"
          else
            echo "SonarQube scan skipped because SONAR_TOKEN or SONAR_HOST_URL is not configured." >> "$GITHUB_STEP_SUMMARY"
          fi
      - name: Read project version
        if: ${{ github.event_name == 'pull_request' && env.SONAR_TOKEN != '' && env.SONAR_HOST_URL != '' }}
        id: pkg
        run: |
          VERSION="$(node -p "require('./package.json').version")"
          # Harden against output injection: only accept a plain semver-ish string.
          if [[ ! "$VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+([.-][0-9A-Za-z.-]+)?$ ]]; then
            echo "Invalid package.json version: $VERSION" >&2; exit 1
          fi
          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
      - name: SonarQube Scan
        if: ${{ github.event_name == 'pull_request' && env.SONAR_TOKEN != '' && env.SONAR_HOST_URL != '' }}
        uses: SonarSource/sonarqube-scan-action@v8
        env:
          SONAR_TOKEN: ${{ env.SONAR_TOKEN }}
          SONAR_HOST_URL: ${{ env.SONAR_HOST_URL }}
        with:
          # sonar.projectVersion advances the "previous_version" new-code baseline at
          # each release; without it the baseline never moves (it stays pinned to the
          # analysis where the version last changed) and legacy issues pile up as
          # "new code" in the quality gate.
          args: -Dsonar.projectVersion=${{ steps.pkg.outputs.version }}

  coverage-pr-comment:
    name: PR Coverage Comment
    runs-on: ubuntu-latest
    if: ${{ !cancelled() && github.event_name == 'pull_request' && github.event.pull_request.draft == false && github.event.pull_request.head.repo.fork == false && needs.changes.outputs.code == 'true' }}
    needs:
      - changes
      - pr-test-policy
      - test-coverage
    permissions:
      contents: read
      issues: write
      pull-requests: write
    steps:
      - name: Download coverage artifact
        if: ${{ needs.test-coverage.result != 'cancelled' }}
        continue-on-error: true
        uses: actions/download-artifact@v8
        with:
          name: coverage-report
          path: .
      - name: Prepare PR coverage comment
        env:
          COVERAGE_RESULT: ${{ needs.test-coverage.result }}
          POLICY_RESULT: ${{ needs.pr-test-policy.result }}
        run: |
          mkdir -p .artifacts
          {
            echo "<!-- omniroute-coverage-report -->"
            echo "## CI Coverage Report"
            echo ""
            echo "- Coverage job: \`${COVERAGE_RESULT}\`"
            echo "- PR test policy: \`${POLICY_RESULT}\`"
            echo ""
            if [ -f coverage/coverage-report.md ]; then
              cat coverage/coverage-report.md
            else
              echo "Coverage artifact was not available for this run."
            fi
            if [ "${POLICY_RESULT}" = "failure" ]; then
              echo ""
              echo "## PR Test Policy"
              echo ""
              echo "This PR changes production code in \`src/\`, \`open-sse/\`, \`electron/\`, or \`bin/\` without accompanying automated tests."
            fi
          } > .artifacts/pr-coverage-comment.md
      - uses: actions/github-script@v9
        with:
          script: |
            const fs = require("fs");
            const marker = "<!-- omniroute-coverage-report -->";
            const body = fs.readFileSync(".artifacts/pr-coverage-comment.md", "utf8");
            const { owner, repo } = context.repo;
            const issue_number = context.issue.number;

            const comments = await github.paginate(github.rest.issues.listComments, {
              owner,
              repo,
              issue_number,
              per_page: 100,
            });

            const existing = comments.find((comment) => comment.body?.includes(marker));

            if (existing) {
              await github.rest.issues.updateComment({
                owner,
                repo,
                comment_id: existing.id,
                body,
              });
            } else {
              await github.rest.issues.createComment({
                owner,
                repo,
                issue_number,
                body,
              });
            }

  test-e2e:
    name: E2E Tests (${{ matrix.shard }}/9)
    runs-on: ubuntu-latest
    # Build artifact from the `build` job is downloaded instead of rebuilding
    # (~5min saved per shard). 9 shards (up from 6) reduces tests per shard by
    # ~33%. Playwright browser is cached across runs (~1.5min saved per shard).
    # Heavy shard target: ≤20min (was ~40min). Timeout 45min to cover slow runners.
    timeout-minutes: 45
    needs: [build, changes]
    # WS3.1 hotfix fast-lane: the 9-shard E2E matrix is the CI critical path (~25min).
    # It skips for (a) PRs labeled `hotfix` (entry policy in docs/ops/RELEASE_CHECKLIST.md:
    # production-broken only, full-suite evidence from the previous green run linked in the
    # PR) and (b) tests-only diffs outside tests/e2e/ (cannot change the served app).
    if: ${{ needs.changes.outputs.testsOnly != 'true' && !contains(github.event.pull_request.labels.*.name, 'hotfix') }}
    strategy:
      fail-fast: false
      matrix:
        shard: [1, 2, 3, 4, 5, 6, 7, 8, 9]
    env:
      JWT_SECRET: ci-test-secret-with-sufficient-length-for-validation
      API_KEY_SECRET: ci-test-api-key-secret-long
      DISABLE_SQLITE_AUTO_BACKUP: "true"
      OMNIROUTE_PLAYWRIGHT_SKIP_BUILD: "1"
    steps:
      - uses: actions/checkout@v7
        with:
          persist-credentials: false
      - uses: actions/setup-node@v7
        with:
          node-version: ${{ env.CI_NODE_VERSION }}
          cache: npm
      - uses: ./.github/actions/npm-ci-retry
      - run: npm run check:node-runtime
      - name: Cache Playwright browsers
        uses: actions/cache@v6
        with:
          path: ~/.cache/ms-playwright
          key: playwright-chromium-${{ runner.os }}-${{ hashFiles('package-lock.json') }}
          restore-keys: playwright-chromium-${{ runner.os }}-
      - run: npx playwright install --with-deps chromium
      - name: Download Next.js build artifact
        uses: actions/download-artifact@v8
        with:
          name: next-build
          # Workspace-relative on purpose: the matrix below includes windows-latest, whose
          # default shell is pwsh, where $RUNNER_TEMP is empty (it is $env:RUNNER_TEMP) —
          # #11896's first cut broke the Electron smoke on exactly that. A relative path
          # works in bash and pwsh alike; hosted workspaces are ephemeral.
          path: next-build-artifact
      - name: Extract Next.js build artifact
        run: |
          tar -xzf next-build-artifact/e2e-build.tar.gz
      # WS4.1: duration-balanced shards (LPT over config/quality/e2e-timings.json).
      # Measured skew of plain --shard was 14× (24m47s vs 1m47s) — E2E was the CI
      # critical path. The balancer self-verifies completeness and exits non-zero on
      # any inconsistency, falling back to plain --shard (never fewer specs).
      - name: Run E2E tests (duration-balanced shard)
        env:
          SHARD: ${{ matrix.shard }}
          PLAYWRIGHT_JUNIT_OUTPUT_NAME: junit-e2e-results.xml
        run: |
          if FILES=$(node scripts/quality/balance-e2e-shards.mjs "$SHARD" 9); then
            if [ -z "$FILES" ]; then echo "[e2e-balance] shard $SHARD has no files"; exit 0; fi
            echo "[e2e-balance] shard $SHARD runs:"; echo "$FILES"
            # FILES is our own newline-separated path list, so word-splitting is intended
            # shellcheck disable=SC2086,SC2046
            npx playwright test $(echo "$FILES" | tr '\n' ' ') --reporter=line,junit
          else
            echo "[e2e-balance] balancer unavailable — plain --shard fallback"
            npx playwright test tests/e2e/*.spec.ts --shard="$SHARD"/9 --reporter=line,junit
          fi
      # WS5.2/5.3: Trunk Flaky Tests upload — advisory, own-origin only, SHA-pinned.
      - name: Upload test results to Trunk (advisory)
        if: ${{ always() && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) }}
        continue-on-error: true
        uses: trunk-io/analytics-uploader@385f1ccdf345b4532dc4b6c665dd432b702b8e28 # v2.1.2
        with:
          junit-paths: junit-e2e-results.xml
          org-slug: omniroute
          token: ${{ secrets.TRUNK_TOKEN }}

  test-integration:
    name: Integration Tests (${{ matrix.shard }}/2)
    runs-on: ubuntu-latest
    timeout-minutes: 15
    # needs: changes (not build) — no artifact consumed; see test-unit note.
    needs: changes
    if: ${{ github.event_name != 'pull_request' || (needs.changes.outputs.code == 'true' && github.event.pull_request.draft == false) }}
    strategy:
      fail-fast: false
      matrix:
        shard: [1, 2]
    env:
      JWT_SECRET: ci-test-secret-with-sufficient-length-for-validation
      API_KEY_SECRET: ci-test-api-key-secret-long
      INITIAL_PASSWORD: ci-test-password-for-integration
      DATA_DIR: /tmp/omniroute-ci-${{ matrix.shard }}
      DISABLE_SQLITE_AUTO_BACKUP: "true"
    steps:
      - uses: actions/checkout@v7
        with:
          persist-credentials: false
      - uses: actions/setup-node@v7
        with:
          node-version: ${{ env.CI_NODE_VERSION }}
          cache: npm
      - uses: ./.github/actions/npm-ci-retry
      - run: npm run check:node-runtime
      - name: Integration tests (shard ${{ matrix.shard }}/2)
        env:
          TEST_SHARD: ${{ matrix.shard }}/2
        run: npm run test:integration:ci

  test-security:
    name: Security Tests
    runs-on: ubuntu-latest
    # needs: changes (not build) — no artifact consumed; see test-unit note.
    needs: changes
    if: ${{ github.event_name != 'pull_request' || (needs.changes.outputs.code == 'true' && github.event.pull_request.draft == false) }}
    env:
      JWT_SECRET: ci-test-secret-with-sufficient-length-for-validation
      API_KEY_SECRET: ci-test-api-key-secret-long
      DISABLE_SQLITE_AUTO_BACKUP: "true"
    steps:
      - uses: actions/checkout@v7
        with:
          persist-credentials: false
      - uses: actions/setup-node@v7
        with:
          node-version: ${{ env.CI_NODE_VERSION }}
          cache: npm
      - uses: ./.github/actions/npm-ci-retry
      - run: npm run check:node-runtime
      - run: npm run test:security

  # Live-server E2E. Both suites boot a real OmniRoute via their own runner and
  # drive it over HTTP; neither needs provider credentials. They were documented in
  # AGENTS.md's test matrix but wired to NO workflow, and had additionally been
  # unrunnable (vitest.config.ts excluded the very files their runners passed as a
  # positional filter) — so nothing had executed them for as long as that was true.
  test-ecosystem:
    name: Ecosystem E2E (live server)
    runs-on: ubuntu-latest
    timeout-minutes: 20
    # needs: changes (not build) — the runner boots its own dev server.
    needs: changes
    if: ${{ github.event_name != 'pull_request' || (needs.changes.outputs.code == 'true' && github.event.pull_request.draft == false) }}
    env:
      JWT_SECRET: ci-test-secret-with-sufficient-length-for-validation
      API_KEY_SECRET: ci-test-api-key-secret-long
      DISABLE_SQLITE_AUTO_BACKUP: "true"
    steps:
      - uses: actions/checkout@v7
        with:
          persist-credentials: false
      - uses: actions/setup-node@v7
        with:
          node-version: ${{ env.CI_NODE_VERSION }}
          cache: npm
      - uses: ./.github/actions/npm-ci-retry
      - run: npm run check:node-runtime
      - run: npm run test:ecosystem

  test-protocols-e2e:
    name: Protocol Clients E2E (live server, advisory)
    runs-on: ubuntu-latest
    timeout-minutes: 20
    needs: changes
    if: ${{ github.event_name != 'pull_request' || (needs.changes.outputs.code == 'true' && github.event.pull_request.draft == false) }}
    # ADVISORY until #10049 is resolved. Restoring this suite immediately surfaced a
    # real discrepancy that had been invisible while it could not run: GET
    # /api/mcp/audit answers 403 over loopback where the suite expects 200|401. That
    # is a pre-existing contract question, not a defect introduced by wiring the job
    # up, so it must not block every PR in the meantime. Flip to blocking (drop this
    # continue-on-error) the moment #10049 lands.
    continue-on-error: true
    env:
      JWT_SECRET: ci-test-secret-with-sufficient-length-for-validation
      API_KEY_SECRET: ci-test-api-key-secret-long
      DISABLE_SQLITE_AUTO_BACKUP: "true"
    steps:
      - uses: actions/checkout@v7
        with:
          persist-credentials: false
      - uses: actions/setup-node@v7
        with:
          node-version: ${{ env.CI_NODE_VERSION }}
          cache: npm
      - uses: ./.github/actions/npm-ci-retry
      - run: npm run check:node-runtime
      - run: npm run test:protocols:e2e

  ci-summary:
    name: CI Dashboard
    runs-on: ubuntu-latest
    if: ${{ !cancelled() }}
    needs:
      - changes
      - lint
      - docs-sync-strict
      - i18n-ui-coverage
      - i18n-glossary-zhcn
      - i18n
      - pr-test-policy
      - build
      - package-artifact
      - electron-package-smoke
      - test-unit
      - test-coverage
      - sonarqube
      - coverage-pr-comment
      - test-e2e
      - test-integration
      - test-security
      - test-ecosystem
      - test-protocols-e2e
    steps:
      - name: Download i18n results
        continue-on-error: true
        uses: actions/download-artifact@v8
        with:
          pattern: i18n-*
          path: results
          merge-multiple: true

      - name: Generate dashboard
        env:
          EVENT_NAME: ${{ github.event_name }}
          # Workflow-controlled data (job results), not user input — safe to read here.
          NEEDS_JSON: ${{ toJSON(needs) }}
        run: |
          status() {
            case "$1" in
              success) echo "🟢 PASS" ;;
              failure) echo "🔴 FAIL" ;;
              cancelled) echo "⚫ CANCELLED" ;;
              skipped) echo "⚪ SKIPPED" ;;
              *) echo "🟡 UNKNOWN" ;;
            esac
          }

          echo "# 🚀 CI Dashboard" >> "$GITHUB_STEP_SUMMARY"
          echo "" >> "$GITHUB_STEP_SUMMARY"

          # (gap 12) A cancelled job never reported a verdict, and in a long table that reads the
          # same as a green one. `cancel-in-progress` plus incremental fixing cancels jobs on every
          # push, and this cycle the Vitest job was cancelled in rounds 1, 2 and 3 — it only ran to
          # completion in round 4, where it revealed a suite that had been broken the whole cycle
          # plus two production bugs. A gate that never finishes is indistinguishable from one that
          # passes, so name them at the TOP instead of leaving them to be spotted mid-table.
          CANCELLED_JOBS=$(printf '%s' "$NEEDS_JSON" \
            | jq -r 'to_entries | map(select(.value.result == "cancelled")) | .[].key' 2>/dev/null \
            | sort | paste -sd", " -) || CANCELLED_JOBS=""
          if [ -n "$CANCELLED_JOBS" ]; then
            {
              echo "> ### ⚫ Cancelled — no verdict was reported"
              echo ">"
              echo "> \`$CANCELLED_JOBS\`"
              echo ">"
              echo "> These did not fail; they never finished, so nothing was checked. Treat this"
              echo "> run as INCOMPLETE for those gates. If the cancellation came from"
              echo "> \`cancel-in-progress\` on a newer push, the newer run covers it — otherwise"
              echo "> re-run them before reading this dashboard as green."
              echo ""
            } >> "$GITHUB_STEP_SUMMARY"
          fi

          echo "## 🧱 Core Checks" >> "$GITHUB_STEP_SUMMARY"
          echo "| Job | Status |" >> "$GITHUB_STEP_SUMMARY"
          echo "|-----|--------|" >> "$GITHUB_STEP_SUMMARY"
          echo "| Change Classification | $(status '${{ needs.changes.result }}') |" >> "$GITHUB_STEP_SUMMARY"
          echo "| Lint | $(status '${{ needs.lint.result }}') |" >> "$GITHUB_STEP_SUMMARY"
          echo "| Docs Sync (Strict) | $(status '${{ needs.docs-sync-strict.result }}') |" >> "$GITHUB_STEP_SUMMARY"
          echo "| i18n UI Coverage | $(status '${{ needs.i18n-ui-coverage.result }}') |" >> "$GITHUB_STEP_SUMMARY"
          echo "| i18n Glossary (zh-CN, ko) | $(status '${{ needs.i18n-glossary-zhcn.result }}') |" >> "$GITHUB_STEP_SUMMARY"
          echo "| PR Test Policy | $(status '${{ needs.pr-test-policy.result }}') |" >> "$GITHUB_STEP_SUMMARY"
          echo "| SonarQube (opt-in; disabled without SONARQUBE_ENABLED=true) | $(status '${{ needs.sonarqube.result }}') |" >> "$GITHUB_STEP_SUMMARY"

          echo "" >> "$GITHUB_STEP_SUMMARY"
          echo "## 🏗️ Build" >> "$GITHUB_STEP_SUMMARY"
          echo "| Job | Status |" >> "$GITHUB_STEP_SUMMARY"
          echo "|-----|--------|" >> "$GITHUB_STEP_SUMMARY"
          echo "| Build Matrix | $(status '${{ needs.build.result }}') |" >> "$GITHUB_STEP_SUMMARY"
          echo "| Package Artifact | $(status '${{ needs.package-artifact.result }}') |" >> "$GITHUB_STEP_SUMMARY"
          echo "| Electron Package Smoke | $(status '${{ needs.electron-package-smoke.result }}') |" >> "$GITHUB_STEP_SUMMARY"

          echo "" >> "$GITHUB_STEP_SUMMARY"
          echo "## 🧪 Tests" >> "$GITHUB_STEP_SUMMARY"
          echo "| Suite | Status |" >> "$GITHUB_STEP_SUMMARY"
          echo "|-------|--------|" >> "$GITHUB_STEP_SUMMARY"
          echo "| Unit | $(status '${{ needs.test-unit.result }}') |" >> "$GITHUB_STEP_SUMMARY"
          echo "| Coverage | $(status '${{ needs.test-coverage.result }}') |" >> "$GITHUB_STEP_SUMMARY"
          echo "| PR Coverage Comment | $(status '${{ needs.coverage-pr-comment.result }}') |" >> "$GITHUB_STEP_SUMMARY"
          echo "| E2E | $(status '${{ needs.test-e2e.result }}') |" >> "$GITHUB_STEP_SUMMARY"
          echo "| Integration | $(status '${{ needs.test-integration.result }}') |" >> "$GITHUB_STEP_SUMMARY"
          echo "| Security Tests | $(status '${{ needs.test-security.result }}') |" >> "$GITHUB_STEP_SUMMARY"
          echo "| Ecosystem E2E | $(status '${{ needs.test-ecosystem.result }}') |" >> "$GITHUB_STEP_SUMMARY"
          echo "| Protocol Clients E2E (advisory, #10049) | $(status '${{ needs.test-protocols-e2e.result }}') |" >> "$GITHUB_STEP_SUMMARY"

          echo "" >> "$GITHUB_STEP_SUMMARY"
          echo "## 🌍 Translations" >> "$GITHUB_STEP_SUMMARY"

          total=0
          langs=0

          if [ -d results ]; then
            for file in results/*.txt; do
              [ -f "$file" ] || continue
              val=$(sed -r 's/\x1B\[[0-9;]*[mK]//g' "$file" | grep "Untranslated:" | awk '{print $2}')
              val=${val:-0}
              total=$((total + val))
              langs=$((langs + 1))
            done
          fi

          echo "" >> "$GITHUB_STEP_SUMMARY"
          echo "| Metric | Value |" >> "$GITHUB_STEP_SUMMARY"
          echo "|--------|------|" >> "$GITHUB_STEP_SUMMARY"
          echo "| Languages checked | $langs |" >> "$GITHUB_STEP_SUMMARY"
          echo "| Total untranslated | $total |" >> "$GITHUB_STEP_SUMMARY"

          if [ "$total" -gt 0 ]; then
            echo "" >> "$GITHUB_STEP_SUMMARY"
            echo "⚠️ **Translations need attention**" >> "$GITHUB_STEP_SUMMARY"
          else
            echo "" >> "$GITHUB_STEP_SUMMARY"
            echo "✅ **All translations complete**" >> "$GITHUB_STEP_SUMMARY"
          fi