# Primary CI: lint, tests, localization, Linux build check, E2E, and native builds (dev).
# Verify matrix steps delegate to Taskfile.yml (task lint, test:frontend, test:lang).
#
# The frontend bundle is built once via the reusable frontend-build workflow and
# downloaded by downstream jobs instead of rebuilding on every runner.
#
# Pinned first-party actions (bump tag and SHA together when upgrading):
#   actions/checkout@v6.0.1            8e8c483db84b4bee98b60c0593521ed34d9990e8
#   actions/setup-python@v6.2.0        a309ff8b426b58ec0e2a45f0f869d46889d02405
#   actions/upload-artifact@v5.0.0     330a01c490aca151604b8cf639adc76d48f6c5d4
#   actions/download-artifact@v5.0.0   634f93cb2916e3fdff6788551b99b062d0335ce0
#   actions/setup-go@v7.0.0            b7ad1dad31e06c5925ef5d2fc7ad053ef454303e

name: CI

on:
    push:
        branches:
            - "**"
    pull_request:
        branches:
            - master
            - dev
    workflow_dispatch:

permissions:
    contents: read

concurrency:
    group: ci-${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
    cancel-in-progress: true

env:
    FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
    NODE_OPTIONS: --max-old-space-size=8192
    PYTHON_VERSION: "3.14"
    NODE_VERSION: "24"
    UV_VERSION: "0.11.15"
    PNPM_VERSION: "11.1.2"
    GO_VERSION: "1.24.x"
    RNS_REQUIRED_SIGNER: e46112d44649266d71fe2193e00a4710

jobs:
    frontend:
        name: Build frontend artifact
        uses: ./.github/workflows/frontend-build.yml
        permissions:
            contents: read
        with:
            artifact_name: meshchatx-frontend-ci-${{ github.run_id }}-${{ github.run_attempt }}
            retention_days: 1

    verify:
        name: ${{ matrix.task.name }}
        runs-on: ubuntu-latest
        timeout-minutes: ${{ matrix.task.timeout }}
        permissions:
            contents: read
        strategy:
            fail-fast: false
            matrix:
                task:
                    - name: Lint
                      id: lint
                      timeout: 45
                    - name: Frontend tests
                      id: frontend-tests
                      timeout: 45
                    - name: Localization tests
                      id: lang-tests
                      timeout: 20

        steps:
            - name: Checkout
              uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8

            - name: Set up development environment
              uses: ./.github/actions/setup-dev-environment
              with:
                  python-version: ${{ env.PYTHON_VERSION }}
                  uv-version: ${{ env.UV_VERSION }}
                  node-version: ${{ env.NODE_VERSION }}
                  pnpm-version: ${{ env.PNPM_VERSION }}

            - name: Run matrix task
              run: |
                  set -euo pipefail
                  case "${{ matrix.task.id }}" in
                    lint)
                      task lint
                      ;;
                    frontend-tests)
                      task test:frontend
                      ;;
                    lang-tests)
                      task test:lang
                      ;;
                    *)
                      echo "Unknown matrix task: ${{ matrix.task.id }}" >&2
                      exit 1
                      ;;
                  esac

            - name: Verify workspace clean
              uses: ./.github/actions/verify-workspace-clean

    visualiser-wasm:
        name: Visualiser WASM (Go)
        runs-on: ubuntu-latest
        timeout-minutes: 15
        permissions:
            contents: read
        steps:
            - name: Checkout
              uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8

            - name: Set up Go
              uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e
              with:
                  go-version: ${{ env.GO_VERSION }}

            - name: Setup Task
              env:
                  GITHUB_TOKEN: ${{ github.token }}
              run: sh scripts/ci/setup-task.sh 3.49.1

            - name: Run visualiser-wasm tests
              run: task test:visualiser-wasm

            - name: Build visualiser-wasm artifacts
              run: task build:visualiser-wasm

            - name: Verify integrity.json stamped
              run: |
                  set -euo pipefail
                  test -f meshchatx/src/frontend/public/vendor/visualiser-wasm/integrity.json
                  python3 - <<'PY'
                  import json
                  from pathlib import Path
                  data = json.loads(Path("meshchatx/src/frontend/public/vendor/visualiser-wasm/integrity.json").read_text())
                  assert data.get("version") == "1.2.0", data
                  assert str(data.get("wasm", "")).startswith("sha384-"), data
                  assert str(data.get("wasmExec", "")).startswith("sha384-"), data
                  print("visualiser-wasm integrity OK", data["version"])
                  PY

    backend-tests:
        name: Backend tests (Python 3.14) - Shard ${{ matrix.shard }} / 4
        runs-on: ubuntu-latest
        timeout-minutes: 20
        permissions:
            contents: read
        strategy:
            fail-fast: false
            matrix:
                shard: [0, 1, 2, 3]
        steps:
            - name: Checkout
              uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8

            - name: Set up development environment
              uses: ./.github/actions/setup-dev-environment
              with:
                  python-version: ${{ env.PYTHON_VERSION }}
                  uv-version: ${{ env.UV_VERSION }}
                  node-version: ${{ env.NODE_VERSION }}
                  pnpm-version: ${{ env.PNPM_VERSION }}

            - name: Run backend tests
              env:
                  PYTEST_SHARD_INDEX: ${{ matrix.shard }}
                  PYTEST_TOTAL_SHARDS: 4
              run: task test:backend

            - name: Verify workspace clean
              uses: ./.github/actions/verify-workspace-clean

    build-check:
        name: Linux build check
        runs-on: ubuntu-latest
        needs: frontend
        timeout-minutes: 60
        permissions:
            contents: read
        env:
            FRONTEND_ARTIFACT_NAME: ${{ needs.frontend.outputs.artifact_name }}
            MESHCHATX_FRONTEND_PREBUILT: "1"
        steps:
            - name: Checkout
              uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8

            - name: Smoke-test package bloat checker
              run: bash scripts/ci/verify-package-contents-smoke.sh

            - name: Set up development environment
              uses: ./.github/actions/setup-dev-environment
              with:
                  python-version: ${{ env.PYTHON_VERSION }}
                  uv-version: ${{ env.UV_VERSION }}
                  node-version: ${{ env.NODE_VERSION }}
                  pnpm-version: ${{ env.PNPM_VERSION }}

            - name: Fetch frontend artifact
              uses: ./.github/actions/fetch-frontend-artifact
              with:
                  artifact-name: ${{ env.FRONTEND_ARTIFACT_NAME }}

            - name: Compile backend sources
              run: task compile

            - name: Build backend (cx_Freeze)
              run: pnpm run build-backend

            - name: Verify bleak bundled in frozen backend
              run: bash scripts/ci/github-verify-frozen-bleak.sh build/exe

            - name: Verify FS sandbox modules bundled in frozen backend
              run: bash scripts/ci/github-verify-frozen-sandbox.sh build/exe

            - name: Verify frozen backend import runtime
              run: bash scripts/ci/github-verify-frozen-runtime.sh build/exe

            - name: Verify frozen pycodec2/libcodec2 layout
              run: bash scripts/ci/github-verify-frozen-codec2.sh build/exe

            - name: Verify frozen backend has no package bloat
              run: bash scripts/ci/verify-package-contents.sh frozen build/exe

            - name: Verify workspace clean
              uses: ./.github/actions/verify-workspace-clean

            - name: Upload Linux build-check artifacts
              uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4
              with:
                  name: meshchatx-linux-build-check-${{ github.ref_name }}-${{ github.run_id }}
                  path: |
                      meshchatx/public/
                      build/exe/
                  if-no-files-found: warn

    validate-build-artifact:
        name: Validate Linux build artifact
        runs-on: ubuntu-latest
        timeout-minutes: 15
        needs: build-check
        permissions:
            contents: read
        steps:
            - name: Checkout
              uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8

            - name: Download Linux build-check artifact
              uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0
              with:
                  pattern: meshchatx-linux-build-check-*-${{ github.run_id }}
                  path: .artifacts/linux-build-check
                  merge-multiple: true

            - name: Validate artifact contents
              run: |
                  set -euo pipefail
                  test -d ".artifacts/linux-build-check/meshchatx/public"
                  test -d ".artifacts/linux-build-check/build/exe"
                  test -n "$(ls -A .artifacts/linux-build-check/meshchatx/public)"
                  test -n "$(ls -A .artifacts/linux-build-check/build/exe)"
                  bash scripts/ci/github-verify-frozen-bleak.sh \
                      .artifacts/linux-build-check/build/exe
                  bash scripts/ci/github-verify-frozen-sandbox.sh \
                      .artifacts/linux-build-check/build/exe
                  bash scripts/ci/github-verify-frozen-runtime.sh \
                      .artifacts/linux-build-check/build/exe
                  bash scripts/ci/github-verify-frozen-codec2.sh \
                      .artifacts/linux-build-check/build/exe
                  bash scripts/ci/verify-package-contents.sh frozen \
                      .artifacts/linux-build-check/build/exe
                  echo "Linux build artifact download + content validation passed."

    native-build:
        name: Native build (${{ matrix.label }})
        if: >-
            github.ref == 'refs/heads/dev' ||
            (github.event_name == 'pull_request' && github.base_ref == 'dev')
        needs: frontend
        permissions:
            contents: read
        strategy:
            fail-fast: false
            matrix:
                include:
                    - os: windows-latest
                      label: windows
                      timeout: 120
                      build_script: scripts/ci/github-build-windows.sh
                    - os: macos-latest
                      label: macos
                      timeout: 180
                      build_script: scripts/ci/github-build-macos.sh
        runs-on: ${{ matrix.os }}
        timeout-minutes: ${{ matrix.timeout }}
        defaults:
            run:
                shell: bash
        env:
            FRONTEND_ARTIFACT_NAME: ${{ needs.frontend.outputs.artifact_name }}
            MESHCHATX_FRONTEND_PREBUILT: "1"
        steps:
            - name: Checkout
              uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8

            - name: Set up Python and UV
              uses: ./.github/actions/setup-python-uv
              with:
                  python-version: ${{ env.PYTHON_VERSION }}
                  uv-version: ${{ env.UV_VERSION }}

            - name: Set up Node and pnpm
              uses: ./.github/actions/setup-node-pnpm
              with:
                  node-version: ${{ env.NODE_VERSION }}
                  pnpm-version: ${{ env.PNPM_VERSION }}

            - name: Install dependencies
              run: bash scripts/ci/github-install-deps.sh

            - name: Install Rosetta (Apple Silicon)
              if: matrix.label == 'macos'
              run: /usr/sbin/softwareupdate --install-rosetta --agree-to-license || true

            - name: Ensure x86_64 Homebrew (/usr/local) for universal slice
              if: matrix.label == 'macos'
              run: bash scripts/ci/github-ensure-macos-x86-64-homebrew.sh

            - name: Set up Python x64 for cx_Freeze universal slice
              id: python_x64
              if: matrix.label == 'macos'
              uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405
              with:
                  python-version: ${{ env.PYTHON_VERSION }}
                  architecture: x64
                  update-environment: false

            - name: Install x86_64 codec2 for pycodec2 (universal slice)
              if: matrix.label == 'macos'
              run: |
                  set -euo pipefail
                  arch -x86_64 /usr/local/bin/brew install codec2

            - name: Install Rust x86_64-apple-darwin target (cbor2 x64 slice)
              if: matrix.label == 'macos'
              run: bash scripts/ci/github-macos-rust-x64-target.sh

            - name: Install project deps into x64 Python (mac universal cx_Freeze)
              if: matrix.label == 'macos'
              env:
                  PY_X64: ${{ steps.python_x64.outputs.python-path }}
              run: bash scripts/ci/github-install-macos-x64-python-deps.sh

            - name: Fetch frontend artifact
              uses: ./.github/actions/fetch-frontend-artifact
              with:
                  artifact-name: ${{ env.FRONTEND_ARTIFACT_NAME }}

            - name: Build distributables
              run: bash "${{ matrix.build_script }}"

    e2e:
        name: E2E smoke
        runs-on: ubuntu-latest
        timeout-minutes: 20
        permissions:
            contents: read
        steps:
            - name: Checkout
              uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8

            - name: Set up development environment
              uses: ./.github/actions/setup-dev-environment
              with:
                  python-version: ${{ env.PYTHON_VERSION }}
                  uv-version: ${{ env.UV_VERSION }}
                  node-version: ${{ env.NODE_VERSION }}
                  pnpm-version: ${{ env.PNPM_VERSION }}

            - name: Run Playwright smoke E2E
              run: bash scripts/ci/github-e2e.sh

    self-check:
        name: Headless Self-Check (${{ matrix.os }})
        runs-on: ${{ matrix.os }}
        timeout-minutes: 15
        strategy:
            fail-fast: false
            matrix:
                os: [ubuntu-latest, macos-latest, windows-latest]
        permissions:
            contents: read
        steps:
            - name: Checkout
              uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8

            - name: Set up development environment
              uses: ./.github/actions/setup-dev-environment
              with:
                  python-version: ${{ env.PYTHON_VERSION }}
                  uv-version: ${{ env.UV_VERSION }}
                  node-version: ${{ env.NODE_VERSION }}
                  pnpm-version: ${{ env.PNPM_VERSION }}
                  install-task: "false"

            - name: Run headless system self-check
              shell: bash
              run: |
                  # Exercises storage_lock_good (native flock/msvcrt + soft ENOSYS
                  # fallback) and the rest of SELF_CHECK_LABELS on each OS.
                  # Overall exit may be non-zero when optional host-local checks
                  # fail (missing Reticulum config, identity fixtures). Gate on
                  # the checks this job cares about via grep.
                  set -o pipefail
                  uv run python -m meshchatx.meshchat --self-check --headless 2>&1 | tee self-check-out.txt || true
                  grep -E '^\[OK\][[:space:]]+Storage Lock' self-check-out.txt
                  grep -E '^\[OK\][[:space:]]+FS Sandbox Modules' self-check-out.txt
                  grep -E '^\[OK\][[:space:]]+HTTP Server Security' self-check-out.txt