quality.yml

name: quality

on:
  push:
    branches: [main]
  pull_request:

# Superseded runs for the same branch/PR do not consume another full matrix.
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: read

jobs:
  changes:
    # Linux legs pin Ubuntu 24.04: 26.04 denies the sandbox's nested user namespace (docs/sandbox-profiles.md)
    runs-on: ubuntu-24.04
    outputs:
      run: ${{ steps.paths.outputs.run }}
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - uses: actions/setup-node@v4
        with:
          node-version: 24.16.0
      - name: Detect runtime changes
        id: paths
        env:
          BASE_SHA: ${{ github.event.pull_request.base.sha || github.event.before }}
          HEAD_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
        run: node .github/scripts/changes.mjs

  static-checks:
    needs: changes
    if: needs.changes.outputs.run == 'true'
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-24.04, windows-latest]
    timeout-minutes: 15
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup pnpm
        uses: pnpm/action-setup@v4

      - name: Setup Node
        uses: actions/setup-node@v4
        with:
          node-version: 24.16.0
          cache: pnpm

      - name: Install JavaScript dependencies
        run: pnpm install --frozen-lockfile

      - name: Test CI change classification
        run: node --test .github/scripts/changes.test.mjs
      - name: Lint server and frontend
        run: pnpm lint
      - name: Typecheck all packages
        run: pnpm typecheck
      - name: Check shell scripts
        if: runner.os == 'Linux'
        run: |
          sudo apt-get update
          sudo apt-get install -y shellcheck
          shellcheck -S warning scripts/*.sh scripts/fixtures/*.sh
      - name: Check PowerShell scripts
        if: runner.os == 'Windows'
        shell: pwsh
        run: |
          Install-Module PSScriptAnalyzer -RequiredVersion 1.24.0 -Scope CurrentUser -Force -Repository PSGallery
          $issues = @(Invoke-ScriptAnalyzer -Path scripts -Recurse -Settings .github/PSScriptAnalyzerSettings.psd1)
          $issues | Format-Table -AutoSize
          if ($issues.Count -gt 0) { exit 1 }

  tests:
    needs: changes
    if: needs.changes.outputs.run == 'true'
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        # The real Linux sandbox needs a nested user namespace, and Ubuntu 26.04
        # (ubuntu-latest since 2026-10-27) refuses the gid map write for it:
        # "apply-seccomp: write /proc/self/setgroups ... Permission denied".
        # Pin the image the sandbox is verified on until the runtime supports it.
        os: [ubuntu-24.04, windows-latest]
    # Native process tests remain serialized on Windows to avoid contention.
    timeout-minutes: ${{ matrix.os == 'windows-latest' && 45 || 20 }}
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup pnpm
        uses: pnpm/action-setup@v4

      - name: Setup Node
        uses: actions/setup-node@v4
        with:
          node-version: 24.16.0
          cache: pnpm

      - name: Install required Linux sandbox dependencies
        if: runner.os == 'Linux'
        run: |
          sudo apt-get update
          sudo apt-get install -y bubblewrap socat ripgrep
          # Dedicated ephemeral runner: Bubblewrap requires user namespaces.
          sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0

      - name: Install JavaScript dependencies
        run: pnpm install --frozen-lockfile

      - name: Test native Windows file read boundary
        if: runner.os == 'Windows'
        run: pnpm --filter @pi-science/server exec vitest run src/runtime/sandbox/file-read.test.ts src/runtime/agent/worker/workspace-file-tool.test.ts

      - name: Test environment diagnostics
        run: node --test scripts/doctor.test.mjs scripts/check-http-health.test.mjs scripts/check-linux-sandbox.test.mjs scripts/process-state.test.mjs scripts/ci-runner-pins.test.mjs

      - name: Test Windows process ownership
        if: runner.os == 'Windows'
        run: powershell -NoProfile -File scripts/test-process-identity.ps1

      - name: Test POSIX launcher lifecycle
        if: runner.os != 'Windows'
        run: bash scripts/test-launcher.sh

      - name: Test contracts, control plane, frontend and skills
        if: runner.os != 'Windows'
        # Each suite may use both runner cores. Running frontend and server
        # together also competes with real child workers in the IPC tests.
        run: |
          pnpm --workspace-concurrency=1 --filter @pi-science/contracts --filter @pi-science/server --filter frontend run test --maxWorkers=2
          pnpm test:skills

      - name: Check Windows worker startup before the full IPC suite
        if: runner.os == 'Windows'
        run: node scripts/check-worker-startup.mjs

      # Native process integration tests launch Node, bash and taskkill trees.
      # Serializing server files on the two-core Windows runner prevents unrelated
      # 500 ms/15 s characterization deadlines from competing for process slots.
      - name: Test contracts, serialized control plane, frontend and skills
        if: runner.os == 'Windows'
        shell: pwsh
        run: |
          pnpm --filter @pi-science/contracts test
          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
          pnpm --filter @pi-science/server exec vitest run --fileParallelism=false
          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
          pnpm --filter frontend test
          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
          pnpm test:skills
          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }

  build:
    needs: changes
    if: needs.changes.outputs.run == 'true'
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        # Same nested user namespace requirement as the tests job. The
        # control-plane smoke test starts the sandbox, so it fails on 26.04.
        os: [ubuntu-24.04, windows-latest]
    timeout-minutes: 20
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup pnpm
        uses: pnpm/action-setup@v4

      - name: Setup Node
        uses: actions/setup-node@v4
        with:
          node-version: 24.16.0
          cache: pnpm

      - name: Install required Linux sandbox dependencies
        if: runner.os == 'Linux'
        run: |
          sudo apt-get update
          sudo apt-get install -y bubblewrap socat ripgrep
          # Dedicated ephemeral runner: Bubblewrap requires user namespaces.
          sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0

      - name: Install JavaScript dependencies
        run: pnpm install --frozen-lockfile

      - name: Build all JavaScript packages
        run: pnpm build

      - name: Verify native web tools from the compiled server
        run: node apps/server/scripts/smoke-web-access.mjs

      - name: Enforce Settings backend performance budgets
        if: runner.os == 'Linux'
        run: |
          node scripts/benchmark-settings.mjs > settings-performance.json
          node scripts/benchmark-provider-credentials.mjs > provider-credential-performance.json

      - name: Upload Settings backend performance metrics
        if: always() && runner.os == 'Linux'
        uses: actions/upload-artifact@v4
        with:
          name: settings-backend-performance
          path: |
            settings-performance.json
            provider-credential-performance.json
          if-no-files-found: ignore

      - name: Enforce frontend bundle budget
        run: pnpm --filter frontend test:bundle

      - name: Run control-plane smoke test
        if: runner.os != 'Windows'
        run: bash scripts/smoke-control-plane.sh

      - name: Share the Linux frontend build with browser checks
        if: runner.os == 'Linux'
        uses: actions/upload-artifact@v4
        with:
          name: frontend-dist
          path: frontend/dist
          include-hidden-files: true
          if-no-files-found: error

  browser:
    needs: [changes, build]
    if: needs.changes.outputs.run == 'true'
    runs-on: ubuntu-24.04
    timeout-minutes: 25
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup pnpm
        uses: pnpm/action-setup@v4

      - name: Setup Node
        uses: actions/setup-node@v4
        with:
          node-version: 24.16.0
          cache: pnpm

      - name: Install JavaScript dependencies
        run: pnpm install --frozen-lockfile

      - name: Restore the frontend build
        uses: actions/download-artifact@v4
        with:
          name: frontend-dist
          path: frontend/dist

      # Reuses the build above. The browser-level SSE budget is the only gate on
      # the frontend's subscription lifecycle, so it must not stay local-only.
      - name: Enforce frontend SSE connection budget
        if: runner.os == 'Linux'
        run: pnpm --filter frontend test:sse-budget

      - name: Run frontend accessibility smoke
        if: runner.os == 'Linux'
        run: pnpm --filter frontend exec playwright test --config playwright.visual.config.ts --grep @accessibility

      - name: Run workspace sidebar interaction tests
        if: runner.os == 'Linux'
        run: |
          pnpm --filter frontend exec playwright test --config playwright.visual.config.ts sidebar.spec.ts --project desktop-light --project mobile --project tablet --output tests/visual/.artifacts/sidebar
          pnpm --filter frontend exec playwright test --config playwright.visual.config.ts app-shell.visual.spec.ts --grep "collapsed context panel" --project desktop-light --project desktop-dark --project desktop-lg --project tablet --project wide --update-snapshots=none --output tests/visual/.artifacts/rail-baseline

      - name: Upload workspace sidebar screenshots
        if: always() && runner.os == 'Linux'
        uses: actions/upload-artifact@v4
        with:
          name: workspace-sidebar-interactions
          path: frontend/tests/visual/.artifacts
          if-no-files-found: ignore
          include-hidden-files: true

      - name: Enforce Settings browser performance budgets
        if: runner.os == 'Linux'
        run: pnpm --filter frontend exec playwright test --config playwright.visual.config.ts settings-performance.spec.ts model-selection-performance.spec.ts --project desktop-light --project mobile

      - name: Upload Settings browser performance metrics
        if: always() && runner.os == 'Linux'
        uses: actions/upload-artifact@v4
        with:
          name: settings-browser-performance
          path: frontend/tests/visual/.artifacts
          if-no-files-found: ignore
          include-hidden-files: true

  macos-launcher:
    needs: changes
    if: needs.changes.outputs.run == 'true'
    name: macOS launcher smoke
    runs-on: macos-latest
    timeout-minutes: 15
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup pnpm
        uses: pnpm/action-setup@v4

      - name: Setup Node
        uses: actions/setup-node@v4
        with:
          node-version: 24.16.0
          cache: pnpm

      - name: Install JavaScript dependencies
        run: pnpm install --frozen-lockfile

      - name: Test native macOS file read boundary
        run: pnpm --filter @pi-science/server exec vitest run src/runtime/sandbox/file-read.test.ts src/runtime/agent/worker/workspace-file-tool.test.ts

      - name: Test macOS launcher lifecycle
        run: bash scripts/test-launcher.sh

      - name: Verify native web development and compiled entries on macOS
        run: |
          pnpm --filter @pi-science/contracts build
          pnpm --filter @pi-science/server exec vitest run src/web/tools.test.ts src/web/deepseek.test.ts src/http/routes/settings-web-access.test.ts
          pnpm --filter @pi-science/server build
          node apps/server/scripts/smoke-web-access.mjs

  production-install:
    needs: changes
    if: needs.changes.outputs.run == 'true'
    name: production install (${{ matrix.os }})
    runs-on: ${{ matrix.os }}
    timeout-minutes: 20
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-24.04, windows-latest, macos-latest]
    env:
      PI_SCIENCE_BIN_DIR: ${{ github.workspace }}/work/production-install/pi-science-bin
      PNPM_STORE_DIR: ${{ github.workspace }}/work/production-install/pi-science-store
      PI_SCIENCE_HOME: ${{ github.workspace }}/work/production-install/pi-science-data
      PI_SCIENCE_WORKSPACES: ${{ github.workspace }}/work/production-install/pi-science-workspaces
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: 24.16.0
      - name: Install required Linux sandbox dependencies
        if: runner.os == 'Linux'
        run: |
          sudo apt-get update
          sudo apt-get install -y bubblewrap socat ripgrep
          # Dedicated ephemeral runner: Bubblewrap requires user namespaces.
          sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0

      # Intentionally omit pnpm setup: exercise the pinned bootstrap from npm.
      - name: Install and build (POSIX)
        if: runner.os != 'Windows'
        run: bash scripts/install.sh
      - name: Install and build (Windows PowerShell 5.1)
        if: runner.os == 'Windows'
        run: powershell -NoProfile -ExecutionPolicy Bypass -File scripts/install.ps1
      - name: Test real production lifecycle
        run: node scripts/smoke-production.mjs

  verify:
    name: verify (${{ matrix.os }})
    needs: [changes, static-checks, tests, build, browser, macos-launcher, production-install]
    if: always()
    runs-on: ${{ matrix.os }}
    strategy:
      matrix:
        os: [ubuntu-24.04, windows-latest]
    steps:
      - name: Require all applicable checks to succeed
        shell: bash
        env:
          CHECKS: ${{ toJSON(needs) }}
        run: |
          node -e 'const checks = JSON.parse(process.env.CHECKS); const allowed = checks.changes.outputs.run === "false" ? ["success", "skipped"] : ["success"]; if (checks.changes.result !== "success" || Object.values(checks).some(check => !allowed.includes(check.result))) process.exit(1);'