ci.yml

name: CI

on:
  workflow_dispatch:
  push:
    branches: [main]
    paths-ignore:
      # Auto-release version bumps (prevent CI → release → CI loop)
      - "pyproject.toml"
      # Documentation & prose
      - "docs/**"
      - "*.md"
      - "!README.md"
      - "LICENSE"
      - "CONTRIBUTORS.md"
      # Runtime state (never committed)
      - ".sdd/**"
      # Non-Python packages & SDKs
      - "sdk/typescript/**"
      - "packages/vscode/**"
      - "packages/cursor-plugin/**"
      - "packaging/**"
      - "Formula/**"
      # Deployment & infra configs
      - "deploy/**"
      - "docker/**"
      - "docker-compose.yaml"
      - "Dockerfile"
      - "action.yml"
      - "action/**"
      # CI tool configs (don't re-run tests for codecov/sonar tweaks)
      - "codecov.yml"
      - "sonar-project.properties"
      # GitHub meta (templates, labels, funding — not ci.yml)
      - ".github/ISSUE_TEMPLATE/**"
      - ".github/FUNDING.yml"
      - ".github/CODEOWNERS"
      - ".github/pull_request_template.md"
      - ".github/dependabot.yml"
      - ".github/labeler.yml"
      - ".github/release-drafter.yml"
      - ".github/copilot-instructions.md"
      - ".github/codeql/**"
      # Non-code project files
      - "marketing/**"
      - "benchmarks/**"
      - "examples/**"
      - "plans/**"
      - "agents/**"
      - "commands/**"
      - "rules/**"
      - ".bernstein/**"
      - ".plugin/**"
      - "scripts/gen_tickets_*.py"
      - "scripts/gen_roadmap_*.py"
      - "scripts/generate_benchmark_docs.py"
  pull_request:
    paths-ignore:
      # Documentation & prose
      - "docs/**"
      - "*.md"
      - "!README.md"
      - "LICENSE"
      - "CONTRIBUTORS.md"
      # Runtime state (never committed)
      - ".sdd/**"
      # Non-Python packages & SDKs
      - "sdk/typescript/**"
      - "packages/vscode/**"
      - "packages/cursor-plugin/**"
      - "packaging/**"
      - "Formula/**"
      # Deployment & infra configs
      - "deploy/**"
      - "docker/**"
      - "docker-compose.yaml"
      - "Dockerfile"
      - "action.yml"
      - "action/**"
      # CI tool configs
      - "codecov.yml"
      - "sonar-project.properties"
      # GitHub meta
      - ".github/ISSUE_TEMPLATE/**"
      - ".github/FUNDING.yml"
      - ".github/CODEOWNERS"
      - ".github/pull_request_template.md"
      - ".github/dependabot.yml"
      - ".github/labeler.yml"
      - ".github/release-drafter.yml"
      - ".github/copilot-instructions.md"
      - ".github/codeql/**"
      # Non-code project files
      - "marketing/**"
      - "benchmarks/**"
      - "examples/**"
      - "plans/**"
      - "agents/**"
      - "commands/**"
      - "rules/**"
      - ".bernstein/**"
      - ".plugin/**"
      - "scripts/gen_tickets_*.py"
      - "scripts/gen_roadmap_*.py"
      - "scripts/generate_benchmark_docs.py"

# New push cancels in-progress run.
concurrency:
  group: ci-${{ github.ref }}
  cancel-in-progress: false

jobs:
  # ─── Fast checks (never cancelled, <2 min each) ───────────────────────

  repo-hygiene:
    name: Repo hygiene
    runs-on: ubuntu-latest
    timeout-minutes: 5
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
      - name: Assert .sdd is not tracked
        run: |
          TRACKED="$(git ls-files '.sdd')"
          if [ -n "$TRACKED" ]; then
            echo "::error::.sdd must never be committed to git"
            printf '%s\n' "$TRACKED"
            exit 1
          fi
      - name: Check for merge conflict markers in source files
        run: |
          CONFLICTS=""
          for f in $(git ls-files -- '*.py' '*.yaml' '*.yml' '*.md' '*.toml'); do
            if grep -qE '^(<{7} |>{7} )' "$f" 2>/dev/null; then
              CONFLICTS="$CONFLICTS $f"
              echo "::error file=$f::Unresolved merge conflict markers in $f"
            fi
          done
          if [ -n "$CONFLICTS" ]; then
            exit 1
          fi
      - name: Check Python syntax in scripts/
        run: |
          ERRORS=""
          for f in scripts/*.py; do
            if ! python3 -m py_compile "$f" 2>/dev/null; then
              ERRORS="$ERRORS $f"
              echo "::error file=$f::Syntax error in $f"
            fi
          done
          if [ -n "$ERRORS" ]; then
            exit 1
          fi

  lint:
    name: Lint
    runs-on: ubuntu-latest
    timeout-minutes: 10
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
      - uses: astral-sh/setup-uv@94527f2e458b27549849d47d273a16bec83a01e9 # v7
        with:
          enable-cache: true
      - run: uv run ruff check src/
      - run: uv run ruff format --check src/

  spelling:
    name: Spelling (typos)
    runs-on: ubuntu-latest
    timeout-minutes: 5
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
      - uses: crate-ci/typos@f06b85043a5ab470afbb0a5592456e733243983a # v1

  actionlint:
    name: Workflow lint
    runs-on: ubuntu-latest
    timeout-minutes: 5
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
      - uses: reviewdog/action-actionlint@e0207a28405ecad11953ba625a95d92f7889572a # v1
        with:
          reporter: github-check

  # ─── Medium checks (cancel old runs, 5-20 min) ────────────────────────

  typecheck:
    name: Type check
    needs: [lint]  # only run if lint passes (fast-fail)
    runs-on: ubuntu-latest
    timeout-minutes: 20
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
      - uses: astral-sh/setup-uv@94527f2e458b27549849d47d273a16bec83a01e9 # v7
        with:
          enable-cache: true
      - name: Run pyright (advisory)
        run: |
          uv run pyright 2>&1 | tail -1 || true
          echo "::notice::Typecheck is advisory while module decomposition shims are being typed"

  dead-code:
    name: Dead code (Vulture)
    runs-on: ubuntu-latest
    timeout-minutes: 10
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
      - uses: astral-sh/setup-uv@94527f2e458b27549849d47d273a16bec83a01e9 # v7
        with:
          enable-cache: true
      - run: uv tool install vulture
      - run: vulture src/ vulture_whitelist.py --min-confidence 80 --exclude "tests,docs"

  dist-size:
    name: Package size check
    runs-on: ubuntu-latest
    timeout-minutes: 10
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
      - uses: astral-sh/setup-uv@94527f2e458b27549849d47d273a16bec83a01e9 # v7
        with:
          enable-cache: true
      - name: Build and check size
        run: |
          uv build
          MAX_SIZE=$((10 * 1024 * 1024))
          for f in dist/*.whl; do
            SIZE=$(stat -c%s "$f" 2>/dev/null || stat -f%z "$f")
            echo "$f: $SIZE bytes"
            if [ "$SIZE" -gt "$MAX_SIZE" ]; then
              echo "::error::Wheel $f exceeds 10MB limit ($SIZE bytes)"
              exit 1
            fi
          done

  # ─── Slow checks (cancel old runs, 15-45 min) ─────────────────────────

  test:
    name: Test (${{ matrix.os }}, Python ${{ matrix.python-version }})
    needs: [lint]  # fast-fail: don't waste 45min if lint fails
    runs-on: ${{ matrix.os }}
    timeout-minutes: 60
    permissions:
      contents: read
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, macos-latest, windows-latest]
        python-version: ["3.12", "3.13"]
        exclude:
          # Coverage/JUnit upload only on ubuntu; skip duplicate slow jobs on macOS/Windows for 3.12
          - os: macos-latest
            python-version: "3.12"
          - os: windows-latest
            python-version: "3.12"
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
      - uses: astral-sh/setup-uv@94527f2e458b27549849d47d273a16bec83a01e9 # v7
        with:
          enable-cache: true
          python-version: ${{ matrix.python-version }}
      - name: Fetch base ref for impacted-test selection
        if: github.event_name == 'pull_request' && runner.os != 'Windows'
        run: |
          git fetch --no-tags --depth=1 origin \
            "refs/heads/${{ github.base_ref }}:refs/remotes/origin/${{ github.base_ref }}"
      - name: Run isolated test suite (Linux/macOS)
        if: runner.os != 'Windows'
        run: |
          if [ "${{ github.event_name }}" = "pull_request" ] && \
             git rev-parse --verify "refs/remotes/origin/${{ github.base_ref }}" >/dev/null 2>&1; then
            uv run python scripts/run_tests.py --parallel 4 --affected "refs/remotes/origin/${{ github.base_ref }}"
          else
            uv run python scripts/run_tests.py --parallel 4
          fi
      - name: Run isolated test suite (Windows)
        if: runner.os == 'Windows'
        continue-on-error: true  # Windows has Unix-only tests (chmod, SIGKILL) that are skipped but some may remain
        shell: pwsh
        run: uv run python scripts/run_tests.py -x --parallel 4
      - name: Generate coverage and JUnit reports (ubuntu, 3.13 only)
        if: matrix.os == 'ubuntu-latest' && matrix.python-version == '3.13' && github.event_name == 'push'
        continue-on-error: true
        timeout-minutes: 25
        run: |
          # Run each test file in its own process with coverage to avoid OOM.
          # pytest --cov on 562 files in one process exceeds 7GB runner RAM.
          # JUnit XML is accumulated across all runs via --junitxml append logic.
          uv run python -c "
          import subprocess, sys, os
          from pathlib import Path

          os.environ['COVERAGE_FILE'] = '.coverage'
          test_dir = Path('tests/unit')
          files = sorted(test_dir.glob('test_*.py'))
          failed = 0
          junit_parts = []
          for i, f in enumerate(files):
              junit_part = f'.junit_part_{i}.xml'
              cmd = [
                  sys.executable, '-m', 'coverage', 'run',
                  '--source=src/bernstein', '--parallel-mode',
                  '-m', 'pytest', str(f), '-x', '-q', '--tb=no', '--timeout=120', '-s',
                  '-p', 'no:cacheprovider',
                  f'--junitxml={junit_part}',
                  '-o', 'junit_family=legacy',
              ]
              r = subprocess.run(cmd, capture_output=True, timeout=180)
              if r.returncode != 0:
                  failed += 1
              if Path(junit_part).exists():
                  junit_parts.append(junit_part)
              if (i + 1) % 50 == 0:
                  print(f'  coverage: {i+1}/{len(files)} files done', flush=True)
          print(f'Coverage collected from {len(files)} files ({failed} had failures)')

          # Merge JUnit XML parts into a single junit.xml
          if junit_parts:
              import xml.etree.ElementTree as ET
              root = ET.Element('testsuites')
              for part in junit_parts:
                  try:
                      tree = ET.parse(part)
                      for suite in tree.getroot():
                          root.append(suite)
                  except Exception:
                      pass
              ET.ElementTree(root).write('junit.xml', encoding='unicode', xml_declaration=True)
              print(f'Merged {len(junit_parts)} JUnit XML files into junit.xml')
          "
          uv run python -m coverage combine || true
          uv run python -m coverage xml -o coverage.xml || true
          if [ ! -f coverage.xml ]; then
            echo "::warning::coverage.xml was not generated"
          fi
          if [ ! -f junit.xml ]; then
            echo "::warning::junit.xml was not generated"
          fi
      - name: Upload coverage artifact
        if: matrix.os == 'ubuntu-latest' && matrix.python-version == '3.13' && github.event_name == 'push'
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        with:
          name: coverage-report
          path: |
            coverage.xml
            junit.xml
          if-no-files-found: warn
          retention-days: 1
      - name: Upload coverage to Codecov
        if: matrix.os == 'ubuntu-latest' && matrix.python-version == '3.13' && github.event_name == 'push'
        uses: codecov/codecov-action@57e3a136b779b570ffcdbf80b3bdc90e7fab3de2 # v6
        with:
          files: coverage.xml
          fail_ci_if_error: false
          token: ${{ secrets.CODECOV_TOKEN }}
      - name: Upload test results to Codecov
        if: matrix.os == 'ubuntu-latest' && matrix.python-version == '3.13' && github.event_name == 'push' && !cancelled()
        uses: codecov/test-results-action@0fa95f0e1eeaafde2c782583b36b28ad0d8c77d3 # v1
        with:
          files: junit.xml
          fail_ci_if_error: false
          token: ${{ secrets.CODECOV_TOKEN }}

  sonarcloud:
    name: SonarCloud analysis
    runs-on: ubuntu-latest
    needs: [test]
    continue-on-error: true
    if: github.repository_owner == 'chernistry'
    timeout-minutes: 15
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          fetch-depth: 0
      - name: Download coverage report
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: coverage-report
        continue-on-error: true
      - name: SonarCloud scan
        uses: SonarSource/sonarqube-scan-action@299e4b793aaa83bf2aba7c9c14bedbb485688ec4 # v7
        continue-on-error: true
        env:
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}

  # ─── Post-pipeline (conditional, never cancelled) ──────────────────────

  autofix:
    name: Auto-fix lint
    runs-on: ubuntu-latest
    needs: [lint, repo-hygiene]
    if: github.event_name == 'push' && github.ref == 'refs/heads/main' && github.actor != 'bernstein[bot]' && github.actor != 'bernstein-orchestrator[bot]'
    continue-on-error: true
    timeout-minutes: 15
    permissions:
      contents: write
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          fetch-depth: 5
      - name: Check for autofix loop
        id: loop_check
        run: |
          RECENT=$(git log --oneline -3 --format='%s' | grep -c "style: auto-fix" || true)
          if [ "$RECENT" -ge 3 ]; then
            echo "::warning::Autofix loop detected — last 3 commits are all auto-fix. Skipping."
            echo "skip=true" >> "$GITHUB_OUTPUT"
            exit 0
          fi
      - if: steps.loop_check.outputs.skip != 'true'
        uses: astral-sh/setup-uv@94527f2e458b27549849d47d273a16bec83a01e9 # v7
        with:
          enable-cache: true
      - name: Auto-fix ruff
        if: steps.loop_check.outputs.skip != 'true'
        run: |
          uv run ruff check src/ --fix --unsafe-fixes || true
          uv run ruff format src/
      - name: Purge tracked .sdd files
        if: steps.loop_check.outputs.skip != 'true'
        run: |
          TRACKED="$(git ls-files '.sdd')"
          if [ -n "$TRACKED" ]; then
            echo "$TRACKED" | xargs git rm --cached --
          fi
      - name: Commit and push fixes
        if: steps.loop_check.outputs.skip != 'true'
        run: |
          git add src/ tests/ scripts/
          git diff --cached --quiet && echo "Nothing to fix" && exit 0
          git config user.name "bernstein[bot]"
          git config user.email "bernstein-bot@users.noreply.github.com"
          git commit -m "style: auto-fix ruff lint and format"
          git push

  close-ci-issues:
    name: Close resolved CI issues
    runs-on: ubuntu-latest
    needs: [repo-hygiene, lint, typecheck, test, spelling, dead-code]
    if: >
      success() &&
      github.ref == 'refs/heads/main' &&
      github.event_name == 'push'
    timeout-minutes: 5
    permissions:
      contents: read
      issues: write
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
      - name: Close ci-fix issues
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          ISSUES=$(gh issue list --label ci-fix --state open --json number --jq '.[].number' 2>/dev/null || echo "")
          for NUM in $ISSUES; do
            gh issue close "$NUM" --comment "CI is green again (commit \`${{ github.sha }}\`)." || true
          done

  self-heal:
    name: Self-heal
    runs-on: ubuntu-latest
    needs: [lint, test]
    if: >
      failure() &&
      github.ref == 'refs/heads/main' &&
      github.event_name == 'push'
    timeout-minutes: 5
    permissions:
      contents: read
      issues: write
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
      - name: Create ci-fix issue
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
        run: |
          TITLE="[ci-fix] CI failing on main — run ${{ github.run_id }}"
          BODY="CI failure on commit \`${{ github.sha }}\`. Run: $RUN_URL"
          OPEN=$(gh issue list --label ci-fix --state open --json number --jq length 2>/dev/null || echo 0)
          if [ "$OPEN" = "0" ]; then
            gh issue create --title "$TITLE" --body "$BODY" --label "bug,ci-fix" || true
          fi

  pr-summary:
    name: PR CI summary
    runs-on: ubuntu-latest
    if: github.event_name == 'pull_request'
    needs: [repo-hygiene, lint, typecheck, test, spelling, dead-code, actionlint, dist-size, sonarcloud]
    timeout-minutes: 5
    permissions:
      pull-requests: write
    steps:
      - uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7
        with:
          script: |
            const marker = '<!-- ci-summary -->';
            const jobs = [
              { name: 'Repo hygiene', result: '${{ needs.repo-hygiene.result }}' },
              { name: 'Lint', result: '${{ needs.lint.result }}' },
              { name: 'Type check', result: '${{ needs.typecheck.result }}' },
              { name: 'Tests', result: '${{ needs.test.result }}' },
              { name: 'Spelling', result: '${{ needs.spelling.result }}' },
              { name: 'Dead code', result: '${{ needs.dead-code.result }}' },
              { name: 'Workflow lint', result: '${{ needs.actionlint.result }}' },
              { name: 'Dist size', result: '${{ needs.dist-size.result }}' },
              { name: 'SonarCloud', result: '${{ needs.sonarcloud.result }}' },
            ];
            const icon = (r) => r === 'success' ? '✅' : r === 'failure' ? '❌' : r === 'skipped' ? '⏭️' : '⚠️';
            let body = `${marker}\n### CI Summary\n\n`;
            body += '| Check | Result |\n|-------|--------|\n';
            for (const j of jobs) {
              body += `| ${j.name} | ${icon(j.result)} ${j.result} |\n`;
            }
            body += '\nCoverage and detailed reports are available via Codecov and the Checks tab.';

            const { data: comments } = await github.rest.issues.listComments({
              owner: context.repo.owner,
              repo: context.repo.repo,
              issue_number: context.issue.number,
            });
            const existing = comments.find(c => c.body.includes(marker));
            if (existing) {
              await github.rest.issues.updateComment({
                owner: context.repo.owner,
                repo: context.repo.repo,
                comment_id: existing.id,
                body,
              });
            } else {
              await github.rest.issues.createComment({
                owner: context.repo.owner,
                repo: context.repo.repo,
                issue_number: context.issue.number,
                body,
              });
            }