ci.yml

name: CI

# Three layers:
#  - test: hermetic, runs on every push/PR — typecheck, build, unit tests, the
#    offline fixture MCP round-trip (synthetic parquet, IWAC_OFFLINE=1), and the
#    token budget gate (always-on tool-definition footprint against a committed
#    baseline, plus worst-case response sizes against inflated fixtures).
#  - runtime-floor: builds on the Node 24 toolchain, then runs the finished
#    bundle and offline suite on the runtime floor read from manifest.json.
#    This catches runtime API drift that esbuild's target cannot.
#  - live-smoke: weekly (and on demand) — the full smoke test against the real
#    Hugging Face dataset. Its pinned counts (smoke-test.mjs EXPECTED block) are
#    the dataset-drift alarm, so a red weekly run usually means the dataset
#    changed, not the code.

on:
  push:
    branches: [main]
  pull_request:
  schedule:
    - cron: "17 5 * * 1" # Mondays 05:17 UTC — weekly live smoke
  workflow_dispatch:

jobs:
  test:
    if: github.event_name == 'push' || github.event_name == 'pull_request'
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: mcpb
    steps:
      - name: Checkout
        uses: actions/checkout@v7

      - name: Set up Node
        uses: actions/setup-node@v7
        with:
          node-version: 24
          cache: npm
          cache-dependency-path: mcpb/package-lock.json

      - name: Install dependencies
        run: npm ci

      - name: Check version consistency (package.json, manifest.json, CITATION.cff, README citation)
        run: |
          node -e '
            const fs = require("fs");
            const pkg = JSON.parse(fs.readFileSync("package.json", "utf8")).version;
            const fail = (what, got) => {
              console.error(`version mismatch: package.json ${pkg} vs ${what} ${got}`);
              process.exit(1);
            };
            const man = JSON.parse(fs.readFileSync("manifest.json", "utf8")).version;
            if (man !== pkg) fail("manifest.json", man);

            // A stale version in the citation metadata is worse than none, so the
            // CITATION.cff field and both versions quoted in the README "How to
            // cite" block are checked here too.
            const cff = fs.readFileSync("../CITATION.cff", "utf8");
            const cffVersion = cff.match(/^version:\s*"?([^"\s]+)"?\s*$/m)?.[1];
            if (cffVersion !== pkg) fail("CITATION.cff", cffVersion);

            const readme = fs.readFileSync("../README.md", "utf8");
            const cited = [
              ["README (APA)", readme.match(/\(Version ([\d.]+)\) \[Computer software\]/)?.[1]],
              ["README (BibTeX)", readme.match(/^\s*version\s*=\s*\{([\d.]+)\},?\s*$/m)?.[1]],
            ];
            for (const [what, got] of cited) if (got !== pkg) fail(what, got);
          '

      - name: Typecheck
        run: npm run typecheck

      - name: Lint
        run: npm run lint

      - name: Build server bundle
        run: npm run build

      - name: Unit tests
        run: npm run test:unit

      - name: Fixture MCP round-trip (offline)
        run: npm run test:fixture

      - name: MCP App bundle (offline)
        run: npm run test:app

      - name: HTTP transport round-trip (offline)
        run: npm run test:http

      # Prints the per-tool breakdown either way, so a PR that adds a tool shows
      # what it costs in the log rather than only when it trips the gate.
      - name: Token budget (offline)
        run: npm run test:tokens

  runtime-floor:
    if: github.event_name == 'push' || github.event_name == 'pull_request'
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: mcpb
    steps:
      - name: Checkout
        uses: actions/checkout@v7

      - name: Set up build toolchain
        uses: actions/setup-node@v7
        with:
          node-version: 24
          cache: npm
          cache-dependency-path: mcpb/package-lock.json

      - name: Install dependencies and build
        run: |
          npm ci
          npm run build

      - name: Read declared runtime floor
        id: runtime
        run: |
          major=$(node -e '
            const manifest = require("./manifest.json");
            const range = manifest.compatibility?.runtimes?.node;
            const match = typeof range === "string" && /^>=\s*(\d+)(?:\.|$)/.exec(range);
            if (!match) throw new Error(`invalid compatibility.runtimes.node: ${range}`);
            process.stdout.write(match[1]);
          ')
          echo "major=$major" >> "$GITHUB_OUTPUT"

      - name: Set up declared runtime floor
        uses: actions/setup-node@v7
        with:
          node-version: ${{ steps.runtime.outputs.major }}

      - name: Test built bundle at declared floor
        run: |
          node --version
          npm test

  live-smoke:
    if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: mcpb
    steps:
      - name: Checkout
        uses: actions/checkout@v7

      - name: Set up Node
        uses: actions/setup-node@v7
        with:
          node-version: 24
          cache: npm
          cache-dependency-path: mcpb/package-lock.json

      # Keyed by month: a per-run key (the old scheme) could never hit exactly,
      # so every weekly run uploaded a fresh ~250 MB cache entry. A monthly key
      # re-uses one entry per month (the server refreshes stale parquet at
      # runtime anyway) and old months age out of the cache quota naturally.
      - name: Compute cache month
        id: month
        run: echo "month=$(date -u +%Y-%m)" >> "$GITHUB_OUTPUT"

      - name: Restore HF parquet cache (~250 MB)
        uses: actions/cache@v6
        with:
          path: ~/.iwac-mcp/cache
          key: iwac-hf-parquet-${{ steps.month.outputs.month }}
          restore-keys: |
            iwac-hf-parquet-

      - name: Install dependencies
        run: npm ci

      - name: Build server bundle
        run: npm run build

      - name: Live smoke test (real dataset)
        run: node smoke-test.mjs