codex-proxy-rs/.github/workflows/ci.yml

name: CI

on:
  push:
    branches:
      - main
    paths-ignore:
      - 'release/version.yaml'
      - 'release/notes.md'
  pull_request:
    branches:
      - main

permissions:
  contents: read

concurrency:
  group: ci-${{ github.event.pull_request.head.repo.full_name || github.repository }}-${{ github.head_ref || github.ref_name }}
  cancel-in-progress: true

jobs:
  changes:
    runs-on: ubuntu-26.04
    timeout-minutes: 5
    permissions:
      contents: read
      pull-requests: read
    outputs:
      backend: ${{ steps.filter.outputs.backend }}
      frontend: ${{ steps.filter.outputs.frontend }}
      container: ${{ steps.filter.outputs.container }}
      source: ${{ steps.filter.outputs.source }}
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: ${{ github.event.pull_request.head.sha || github.sha }}
          fetch-depth: 0

      - name: Detect affected checks
        id: filter
        uses: dorny/paths-filter@ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d # v4.0.3
        with:
          # 目录规则取并集，再统一排除说明文档，保留隐藏配置与子模块指针
          predicate-quantifier: some-with-excludes
          filters: |
            backend:
              - '.github/scripts/toolchains.rb'
              - 'deploy/Dockerfile'
              - 'backend/**'
              - 'release/version.yaml'
              - '.github/workflows/ci.yml'
              - '.github/workflows/_quality.yml'
              - '!**/*.md'
            frontend:
              - '.github/scripts/toolchains.rb'
              - 'backend/rust-toolchain.toml'
              - 'deploy/Dockerfile'
              - 'frontend/**'
              - '.github/actions/build-frontend/**'
              - '.github/workflows/ci.yml'
              - '.github/workflows/_quality.yml'
              - '!**/*.md'
            source:
              - '.github/scripts/toolchains.rb'
              - 'backend/rust-toolchain.toml'
              - 'deploy/Dockerfile'
              - '.gitmodules'
              - 'modules/ui'
              - 'modules/plugins'
              - 'frontend/**'
              - 'backend/crates/gateway-plugin/sdk/**'
              - '.github/workflows/ci.yml'
              - '!**/*.md'
            container:
              - 'backend/**'
              - 'frontend/**'
              - 'deploy/**'
              - '.dockerignore'
              - 'release/version.yaml'
              - '.github/actions/verify-container/**'
              - '.github/actions/cargo-cache/**'
              - '.github/workflows/_container.yml'
              - '.github/workflows/ci.yml'
              - '!**/*.md'

  quality:
    needs: changes
    uses: ./.github/workflows/_quality.yml
    with:
      ref: ${{ github.event.pull_request.head.sha || github.sha }}
      run_backend: ${{ needs.changes.outputs.backend == 'true' }}
      run_frontend: ${{ needs.changes.outputs.frontend == 'true' }}

  container:
    needs: changes
    if: needs.changes.outputs.container == 'true'
    permissions:
      contents: read
      security-events: write
    uses: ./.github/workflows/_container.yml
    with:
      ref: ${{ github.event.pull_request.head.sha || github.sha }}

  source-development:
    needs: changes
    if: needs.changes.outputs.source == 'true'
    runs-on: ubuntu-26.04
    timeout-minutes: 20
    steps:
      - name: Checkout with development modules
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: ${{ github.event.pull_request.head.sha || github.sha }}
          submodules: recursive
      - name: Setup pnpm
        uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
        with:
          package_json_file: frontend/package.json
      - name: Read build toolchains
        id: toolchains
        run: ruby .github/scripts/toolchains.rb >> "$GITHUB_OUTPUT"

      - name: Setup Node
        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
        with:
          node-version: ${{ steps.toolchains.outputs.node }}
      - name: Setup Rust
        uses: dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8 # master
        with:
          toolchain: ${{ steps.toolchains.outputs.rust }}
      - name: Check dependency pins
        run: |
          ui_revision="$(git -C modules/ui rev-parse HEAD)"
          for lockfile in frontend/pnpm-lock.yaml modules/plugins/examples/workbench/frontend/pnpm-lock.yaml; do
            locked_revision="$(sed -nE 's@.*codeload.github.com/zyycn/codex-proxy-ui/tar.gz/([a-f0-9]{40}).*@\1@p' "$lockfile" | sort -u)"
            if [ "$locked_revision" != "$ui_revision" ]; then
              echo "::error file=$lockfile::UI dependency must match modules/ui ($ui_revision)"
              exit 1
            fi
          done
      - name: Install development dependencies
        run: |
          pnpm --dir modules/ui install --frozen-lockfile
          pnpm --dir frontend install --frozen-lockfile
          pnpm --dir modules/plugins/examples/workbench/frontend install --frozen-lockfile
      - name: Check UI source integration
        run: |
          pnpm --dir frontend build:source
          pnpm --dir modules/plugins/examples/workbench/frontend build:source
      - name: Check local SDK integration
        env:
          RUST_MIN_STACK: 16777216
          CARGO_TARGET_DIR: ${{ github.workspace }}/backend/target/plugin-development
        run: |
          sdk_check_dir="$RUNNER_TEMP/plugin-source"
          mkdir -p "$sdk_check_dir/backend"
          cp modules/plugins/examples/workbench/backend/Cargo.{toml,lock} "$sdk_check_dir/backend/"
          cp -R modules/plugins/examples/workbench/backend/{src,tests} "$sdk_check_dir/backend/"
          cp modules/plugins/examples/workbench/plugin.json "$sdk_check_dir/"
          cargo test --manifest-path "$sdk_check_dir/backend/Cargo.toml" \
            --config "patch.\"https://github.com/zyycn/codex-proxy-rs.git\".gateway-plugin-sdk.path=\"$GITHUB_WORKSPACE/backend/crates/gateway-plugin/sdk\""
      - name: Ensure source checks preserve lockfiles
        run: |
          git diff --exit-code -- frontend/package.json frontend/pnpm-lock.yaml backend/Cargo.lock
          git -C modules/plugins diff --exit-code -- examples/workbench/frontend/package.json examples/workbench/frontend/pnpm-lock.yaml examples/workbench/backend/Cargo.lock