ci.yml

name: CI

# docs/ is a BUILD INPUT: docs/embed.go compiles the whole corpus into the binary
# (spec 32), so a doc-only change can ship a broken cross-link inside a release.
# Only files that are genuinely not compiled in may be skipped here.
on:
  push:
    branches: [main]
    paths-ignore: ["README.md", "PROGRESS.md", "LICENSE", "NOTICE"]
  pull_request:
    paths-ignore: ["README.md", "PROGRESS.md", "LICENSE", "NOTICE"]

permissions:
  contents: read

# Cancel superseded runs on the same ref (fail-fast + CI economy).
concurrency:
  group: ci-${{ github.ref }}
  cancel-in-progress: true

env:
  # Single enforced Go toolchain floor (DECISIONS, ARCHITECTURE §7.8).
  GO_VERSION: "1.25"

jobs:
  # One consolidated lane ordered cheap → expensive so a lint/unit failure stops
  # before the costly Docker + cross-compile work. actions/setup-go caches the
  # module + build cache (keyed by go.sum). ubuntu-latest ships Docker, used by
  # the integration + e2e steps.
  ci:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-go@v5
        with:
          go-version: ${{ env.GO_VERSION }}
          check-latest: true
          cache: true # GOMODCACHE + GOCACHE, keyed by go.sum

      # --- cheap, high-signal (fail fast) ---
      - name: gofmt
        run: |
          unformatted=$(gofmt -l .)
          if [ -n "$unformatted" ]; then
            echo "These files are not gofmt-clean:"; echo "$unformatted"; exit 1
          fi
      - name: go vet
        run: go vet ./...
      - name: installer lint (shellcheck + POSIX sh)
        run: |
          shellcheck --severity=warning install.sh
          sh -n install.sh
      - name: build (CGO disabled — static binary invariant)
        run: CGO_ENABLED=0 go build ./...
      - name: unit tests -race
        env:
          CGO_ENABLED: "1" # the race detector requires cgo (see Makefile)
        run: go test -race ./...
      - name: smoke (built binary, end-to-end in an XDG sandbox)
        run: make smoke
      - name: determinism (byte-identical generation)
        run: make determinism

      # --- medium ---
      - name: cross-compile (4 CGO-free release targets)
        env:
          CGO_ENABLED: "0"
        run: |
          for t in linux/amd64 linux/arm64 darwin/amd64 darwin/arm64; do
            echo "→ $t"
            GOOS=${t%/*} GOARCH=${t#*/} go build -o /dev/null ./cmd/devstack
          done
      - name: govulncheck
        run: |
          go install golang.org/x/vuln/cmd/govulncheck@latest
          govulncheck ./...

      # --- expensive, real-daemon (Docker on ubuntu-latest) ---
      - name: docker available
        run: docker version
      - name: integration tests (-tags=integration -race)
        env:
          CGO_ENABLED: "1"
        run: go test -tags=integration -race ./...
      - name: e2e tests (-tags=e2e, real up/down via the CLI)
        env:
          DEVSTACK_E2E: "1" # ephemeral runner: safe to mutate the shared stack
        run: go test -tags=e2e ./tests/e2e/...

  # The full release pipeline (4 CGO-free targets + archives + checksums +
  # .deb/.rpm) — expensive and independent, so it runs in parallel and never
  # gates the fast feedback above. Needs full history for goreleaser's versioning.
  release-dryrun:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - uses: actions/setup-go@v5
        with:
          go-version: ${{ env.GO_VERSION }}
          check-latest: true
          cache: true
      - uses: goreleaser/goreleaser-action@v6
        with:
          version: "~> v2"
          # --skip=sign: the dry-run validates build/archive/package config only.
          # Signing is keyless cosign over GitHub OIDC (release.yml) and cannot run
          # in a PR dry-run (no cosign binary, no id-token) — the real release signs.
          args: release --snapshot --clean --skip=sign

  # Native macOS arm64 lane (G2): proves the darwin/arm64 RUNTIME target — not just
  # the cross-compile on the Linux lane — actually builds and passes its daemon-free
  # tests. Hosted macOS runners have no Docker, so the integration/e2e (daemon)
  # steps stay on the ubuntu `ci` lane; this lane runs build + unit(-race) + a
  # binary preflight. Invoked via `go` directly (not make: hosted macOS ships BSD
  # make, and the Makefile uses GNU features).
  macos:
    runs-on: macos-14
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-go@v5
        with:
          go-version: ${{ env.GO_VERSION }}
          check-latest: true
          cache: true
      - name: build (CGO disabled — static binary invariant)
        run: CGO_ENABLED=0 go build ./...
      - name: unit tests -race
        env:
          CGO_ENABLED: "1" # the race detector requires cgo
        run: go test -race ./...
      - name: binary preflight (runs natively on arm64)
        run: |
          go build -o devstack ./cmd/devstack
          ./devstack version
          ./devstack --help >/dev/null

  # Placeholder lanes wired as their milestones land:
  #  - config-conformance: golden workspace exercising every schema field