test.yml

name: Test

on:
  workflow_dispatch:
    inputs:
      linux-runner:
        description: 'Linux runner label (custom image or vanilla fallback)'
        required: false
        default: 'blacksmith-4vcpu-ubuntu-2404'
        type: choice
        options:
          - blacksmith-4vcpu-ubuntu-2404
          - blacksmith-4vcpu-ubuntu-2404-mt
      dep-audit:
        description: 'Run the per-platform dependency audit matrix (TASK-369.3)'
        required: false
        default: false
        type: boolean
  pull_request:
    paths:
      - 'crates/**'
      - 'app/**'
      - 'Cargo.*'
      - 'taskfiles/**'
      - '.github/**'

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

env:
  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true

jobs:
  rust:
    name: Rust Lint, Format, and Test
    runs-on: [macOS, ARM64]
    timeout-minutes: 20
    env:
      CARGO_INCREMENTAL: 1
      CARGO_TERM_COLOR: always

    steps:
      - uses: actions/checkout@v6

      - name: Setup Tauri build environment
        uses: ./.github/actions/setup-tauri-build
        with:
          mode: test

      # tauri-build needs the externalBin file to exist; an empty stand-in keeps
      # Zig off this job's critical path (see docs/builds.md#sidecar-packaging).
      - name: Stage placeholder sidecar
        run: task zig:stage-placeholder TARGET=aarch64-apple-darwin

      - name: Cargo fmt check
        run: cargo fmt --all -- --check

      - name: Check mt-core desktop dependency boundary
        run: |
          dependencies=$(cargo tree --locked -p mt-core --all-features --target all \
            --edges normal,build,dev --prefix none --format '{p}')
          if echo "$dependencies" | grep -E '^(tauri([ -]|$)|tao |wry |webkit[^ ]* |objc2([ -]|$))'; then
            echo "::error::mt-core must not depend on the desktop framework (including transitively)"
            exit 1
          fi

      - name: Cargo clippy
        run: cargo clippy --workspace --all-features -- -D warnings

      - name: Run Rust tests
        # The parity tests spawn the real sidecar; the shadow-diff job runs them.
        run: cargo nextest run --workspace -E 'not test(/shadow_diff_parity_test::/)'

  deno-lint:
    name: Deno Lint and Format Check
    runs-on: blacksmith-4vcpu-ubuntu-2404
    timeout-minutes: 10

    steps:
      - uses: actions/checkout@v6

      - name: Install Deno
        uses: denoland/setup-deno@v2
        with:
          deno-version: v2.x

      - name: Check Deno formatting
        run: deno fmt --check

      - name: Run Deno lint
        run: deno lint

  # Independent of the rust job, but build/playwright/shadow-diff wait on it so
  # a Zig lint/test failure stops the expensive jobs from running.
  zig:
    name: Zig Lint, Test, and Build
    runs-on: blacksmith-4vcpu-ubuntu-2404
    timeout-minutes: 10

    steps:
      - uses: actions/checkout@v6

      - name: Read pinned Zig toolchain from .tool-versions
        id: zig-version
        shell: bash
        run: |
          version=$(grep '^zig ' .tool-versions | awk '{print $2}')
          echo "toolchain=${version}" >> "$GITHUB_OUTPUT"

      - name: Restore Zig build cache
        uses: actions/cache@v4
        with:
          path: |
            zig-core/.zig-cache
            zig-core/zig-out
          key: zig-build-${{ runner.os }}-${{ steps.zig-version.outputs.toolchain }}-${{ hashFiles('zig-core/build.zig', 'zig-core/build.zig.zon', 'zig-core/src/**/*.zig', 'zig-core/vendor/**', '.tool-versions') }}

      - name: Install Zig
        uses: mlugg/setup-zig@v2
        with:
          version: ${{ steps.zig-version.outputs.toolchain }}

      - name: Install Task
        uses: go-task/setup-task@v1

      - name: Zig format check
        run: task zig:lint

      - name: Zig tests
        run: task zig:test

      - name: Zig build
        run: task zig:build

  # Shadow-diff parity between the Rust library_get_all and its Zig port
  # (TASK-355.5 AC#6). Not in any other job's `needs`, and continue-on-error,
  # so a divergence is reported on the PR without blocking an unrelated
  # change: the harness compares two implementations of the same query rather
  # than verifying either against a spec, and it needs both the Rust and Zig
  # toolchains plus a staged sidecar, which the rust job intentionally does
  # not carry. Waits on zig so a broken Zig build skips this 25-minute job.
  shadow-diff:
    name: Rust/Zig Shadow-Diff Parity
    needs: [zig]
    runs-on: blacksmith-4vcpu-ubuntu-2404
    timeout-minutes: 25

    steps:
      - uses: actions/checkout@v6

      - name: Setup Tauri build environment
        uses: ./.github/actions/setup-tauri-build
        with:
          mode: test

      - name: Read pinned Zig toolchain from .tool-versions
        id: zig-version
        shell: bash
        run: |
          version=$(grep '^zig ' .tool-versions | awk '{print $2}')
          echo "toolchain=${version}" >> "$GITHUB_OUTPUT"

      - name: Install Zig
        uses: mlugg/setup-zig@v2
        with:
          version: ${{ steps.zig-version.outputs.toolchain }}

      - name: Install Task
        uses: go-task/setup-task@v1

      - name: Run shadow-diff parity harness
        continue-on-error: true
        run: task ci:shadow-diff TARGET=x86_64-unknown-linux-gnu

  # On-demand dependency audit (TASK-369.3): runs the unused-deps fallback
  # lints (task ci:unused-deps) per platform x feature on native runners.
  # cargo::unused_dependencies does not fire on mt-tauri's target shapes, and
  # a dep unused on one platform or feature set can be load-bearing elsewhere,
  # so trustworthy results need the full matrix on clean checkouts (a warm
  # local target/ replays stale freshness). Dispatch-only: keeps ordinary PR
  # runs free, rerun it whenever deps change or before a re-audit.
  # See docs/builds.md#dependency-audit.
  dep-audit:
    name: Dep Audit (${{ matrix.platform }}/${{ matrix.feature }})
    if: ${{ github.event.inputs.dep-audit == 'true' }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - platform: macos
            os: [macOS, ARM64]
            target: aarch64-apple-darwin
            feature: default
          - platform: macos
            os: [macOS, ARM64]
            target: aarch64-apple-darwin
            feature: agent
          - platform: macos
            os: [macOS, ARM64]
            target: aarch64-apple-darwin
            feature: mcp
          - platform: macos
            os: [macOS, ARM64]
            target: aarch64-apple-darwin
            feature: devtools
          - platform: linux
            os: ${{ inputs.linux-runner || 'blacksmith-4vcpu-ubuntu-2404' }}
            target: x86_64-unknown-linux-gnu
            feature: default
          - platform: linux
            os: ${{ inputs.linux-runner || 'blacksmith-4vcpu-ubuntu-2404' }}
            target: x86_64-unknown-linux-gnu
            feature: agent
          - platform: linux
            os: ${{ inputs.linux-runner || 'blacksmith-4vcpu-ubuntu-2404' }}
            target: x86_64-unknown-linux-gnu
            feature: mcp
          - platform: linux
            os: ${{ inputs.linux-runner || 'blacksmith-4vcpu-ubuntu-2404' }}
            target: x86_64-unknown-linux-gnu
            feature: devtools
          - platform: windows
            os: blacksmith-4vcpu-windows-2025
            target: x86_64-pc-windows-msvc
            feature: default
          - platform: windows
            os: blacksmith-4vcpu-windows-2025
            target: x86_64-pc-windows-msvc
            feature: agent
          - platform: windows
            os: blacksmith-4vcpu-windows-2025
            target: x86_64-pc-windows-msvc
            feature: mcp
          - platform: windows
            os: blacksmith-4vcpu-windows-2025
            target: x86_64-pc-windows-msvc
            feature: devtools
    runs-on: ${{ matrix.os }}
    timeout-minutes: 30

    steps:
      - uses: actions/checkout@v6

      - name: Setup Tauri build environment
        uses: ./.github/actions/setup-tauri-build
        with:
          mode: check

      - name: Audit (${{ matrix.feature }})
        if: runner.os != 'Windows'
        shell: bash
        run: task ci:unused-deps TARGET=${{ matrix.target }} FEATURE=${{ matrix.feature }}

      - name: Audit (${{ matrix.feature }}) (Windows)
        if: runner.os == 'Windows'
        shell: pwsh
        run: task ci:unused-deps TARGET=${{ matrix.target }} FEATURE=${{ matrix.feature }}

  build:
    name: Build (${{ matrix.platform }})
    # Gated on the fast jobs so a failed lint/format/test run skips the
    # build matrix (see docs/builds.md#test-workflow-dependency-graph).
    needs: [deno-lint, rust, vitest-tests, zig]
    if: ${{ !failure() && !cancelled() }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - platform: macos
            os: [macOS, ARM64]
            target: aarch64-apple-darwin
          - platform: linux
            os: ${{ inputs.linux-runner || 'blacksmith-4vcpu-ubuntu-2404' }}
            target: x86_64-unknown-linux-gnu
          - platform: windows
            os: blacksmith-4vcpu-windows-2025
            target: x86_64-pc-windows-msvc
    runs-on: ${{ matrix.os }}
    timeout-minutes: 30

    steps:
      - uses: actions/checkout@v6

      # Linux: skip Docker build when cargo-check inputs haven't changed.
      # Hash covers everything the Dockerfile check target copies:
      # Cargo manifests, lockfile, Rust source, cargo config, and the
      # Dockerfile itself.  Cache hit means cargo check already passed
      # for these exact inputs — no need to spin up Docker at all.
      - name: Check cargo-check cache (Linux)
        if: runner.os == 'Linux'
        id: cargo-check-cache
        uses: actions/cache@v4
        with:
          path: .cargo-check-sentinel
          key: linux-cargo-check-${{ hashFiles('Cargo.toml', 'Cargo.lock', 'crates/**/*.rs', 'crates/**/Cargo.toml', 'crates/**/.cargo/**', 'docker/linux/Dockerfile') }}

      - name: Skip notice (Linux)
        if: runner.os == 'Linux' && steps.cargo-check-cache.outputs.cache-hit == 'true'
        run: echo "cargo check inputs unchanged — skipping Docker build"

      # Linux: containerized cargo check with Blacksmith Docker layer caching
      - name: Setup Docker builder (Linux)
        if: runner.os == 'Linux' && steps.cargo-check-cache.outputs.cache-hit != 'true'
        uses: useblacksmith/setup-docker-builder@v1

      - name: Cargo check (Linux)
        if: runner.os == 'Linux' && steps.cargo-check-cache.outputs.cache-hit != 'true'
        uses: useblacksmith/build-push-action@v2
        with:
          context: .
          file: docker/linux/Dockerfile
          target: check
          push: false

      - name: Write cargo-check sentinel (Linux)
        if: runner.os == 'Linux' && steps.cargo-check-cache.outputs.cache-hit != 'true'
        run: date -u > .cargo-check-sentinel

      # macOS/Windows: bare-metal setup + cargo check
      - name: Setup Tauri build environment
        if: runner.os != 'Linux'
        uses: ./.github/actions/setup-tauri-build
        with:
          mode: check

      - name: Cargo check (macOS)
        if: runner.os == 'macOS'
        shell: bash
        env:
          GITHUB_TOKEN: ${{ github.token }}
        run: task ci:check TARGET=${{ matrix.target }}

      - name: Cargo check (Windows)
        if: runner.os == 'Windows'
        shell: pwsh
        env:
          GITHUB_TOKEN: ${{ github.token }}
        run: task ci:check TARGET=${{ matrix.target }}

  vitest-tests:
    name: Vitest Unit Tests
    runs-on: blacksmith-4vcpu-ubuntu-2404
    timeout-minutes: 10

    steps:
      - uses: actions/checkout@v6

      - name: Setup frontend
        uses: ./.github/actions/setup-frontend
        with:
          cache: 'npm'
          cache-dependency-path: app/frontend/package-lock.json

      - name: Run Vitest with coverage
        working-directory: ./app/frontend
        run: npm run test:coverage

      - name: Upload coverage report
        if: always()
        continue-on-error: true
        uses: actions/upload-artifact@v7
        with:
          name: vitest-coverage
          path: app/frontend/coverage/
          retention-days: 30

  # Detect frontend changes for conditional Playwright execution
  changes:
    name: Detect Changes
    runs-on: blacksmith-4vcpu-ubuntu-2404
    timeout-minutes: 2
    outputs:
      frontend: ${{ steps.filter.outputs.frontend }}
    steps:
      - uses: actions/checkout@v6
      - uses: dorny/paths-filter@v4
        id: filter
        with:
          filters: |
            frontend:
              - 'app/frontend/**'

  playwright-tests:
    name: Playwright E2E Tests
    # Runs against a Vite preview build with mocked IPC -- no Tauri/Rust
    # artifact dependency. Gated on the fast jobs so a failed lint/format/test
    # run skips it, plus the change filter.
    needs: [changes, deno-lint, rust, vitest-tests, zig]
    if: ${{ !failure() && !cancelled() && (needs.changes.outputs.frontend == 'true' || github.event_name == 'workflow_dispatch') }}
    runs-on: [macOS, ARM64]
    timeout-minutes: 20

    steps:
      - uses: actions/checkout@v6

      - name: Setup frontend
        uses: ./.github/actions/setup-frontend

      - name: Install Playwright browsers
        working-directory: ./app/frontend
        run: npx playwright install --with-deps webkit

      - name: Kill stale dev server on port 5173
        run: lsof -ti:5173 | xargs kill -9 2>/dev/null || true

      - name: Run Playwright tests
        working-directory: ./app/frontend
        run: npx playwright test
        env:
          CI: true

      - name: Upload Playwright report
        if: always()
        continue-on-error: true
        uses: actions/upload-artifact@v7
        with:
          name: playwright-report
          path: playwright-report/
          retention-days: 30

      - name: Upload test results
        if: always()
        continue-on-error: true
        uses: actions/upload-artifact@v7
        with:
          name: playwright-results
          path: test-results/
          retention-days: 30