name: PR Checks

on:
  pull_request:
    types:
      - opened
      - synchronize
      - reopened
      - ready_for_review

concurrency:
  group: pr-checks-${{ github.event.pull_request.number }}
  cancel-in-progress: true

permissions:
  contents: read

jobs:
  static_analysis:
    name: static analysis
    runs-on: ubuntu-latest

    steps:
      - name: Checkout
        uses: actions/checkout@v6
        with:
          persist-credentials: false

      - uses: ./.github/actions/install-node-dependencies

      - name: Lint
        run: pnpm exec oxlint --format github

      - name: Check styled scrollbars
        run: pnpm check:styled-scrollbars

      - name: Check reliability gate manifest
        run: pnpm run check:reliability-gates

      - name: Enforce max-lines ratchet
        run: pnpm run check:max-lines-ratchet

      - name: Verify bundled skill guides
        run: pnpm run verify:bundled-skill-guides

      - name: Verify skill freshness manifest
        run: pnpm run verify:skill-bundle-manifest

      - name: Guard against project-owned .d.ts in preload/shared
        run: |
          matches=$(find src/preload src/shared -name '*.d.ts' 2>/dev/null || true)
          if [ -n "$matches" ]; then
            echo "::error::Project-owned .d.ts files are not allowed under src/preload or src/shared."
            echo "Move type declarations into a .ts file so skipLibCheck does not hide errors."
            echo "See docs/preload-typecheck-hole.md."
            echo "Found:"
            echo "$matches"
            exit 1
          fi

      - name: Check feature wall asset budget
        run: pnpm check:feature-wall-assets

      - name: Verify macOS entitlements
        run: pnpm verify:macos-entitlements

  typecheck:
    runs-on: ubuntu-latest

    steps:
      - name: Checkout
        uses: actions/checkout@v6
        with:
          persist-credentials: false

      - uses: ./.github/actions/install-node-dependencies

      - run: pnpm typecheck

  git_compatibility:
    name: Git compatibility
    runs-on: ubuntu-latest

    steps:
      - name: Checkout
        uses: actions/checkout@v6
        with:
          persist-credentials: false

      - uses: ./.github/actions/install-node-dependencies

      - name: Verify Git binary compatibility matrix
        run: |
          pids=()
          (
            archive="$RUNNER_TEMP/git-2.25.5.tar.gz"
            source="$RUNNER_TEMP/git-2.25.5"
            curl -fsSL https://www.kernel.org/pub/software/scm/git/git-2.25.5.tar.gz -o "$archive"
            echo "41662c52fc16fec4963bfc41075e71f8ead6b5e386797eb6f9a1111ff95a8ddf  $archive" \
              | sha256sum --check
            mkdir -p "$source"
            tar -xzf "$archive" -C "$source" --strip-components=1
            make -C "$source" -j"$(nproc)" \
              NO_GETTEXT=YesPlease NO_TCLTK=YesPlease NO_PYTHON=YesPlease git
            ORCA_GIT_COMPAT_BINARY="$source/git" ORCA_GIT_COMPAT_VERSION="2.25.5" \
              pnpm exec vitest run --config config/vitest.config.ts \
              src/shared/git-binary-compatibility.test.ts
          ) &
          pids+=("$!")

          for spec in \
            "alpine/git:edge-2.38.1|2.38.1" \
            "alpine/git:v2.49.1|2.49.1"; do
            (
              image="${spec%%|*}"
              version="${spec#*|}"
              ORCA_GIT_COMPAT_IMAGE="$image" ORCA_GIT_COMPAT_VERSION="$version" \
                pnpm exec vitest run --config config/vitest.config.ts \
                src/shared/git-binary-compatibility.test.ts
            ) &
            pids+=("$!")
          done

          status=0
          for pid in "${pids[@]}"; do
            wait "$pid" || status=1
          done
          exit "$status"

  shell_contracts:
    name: shell contracts
    runs-on: ubuntu-latest

    steps:
      - name: Checkout
        uses: actions/checkout@v6
        with:
          persist-credentials: false

      - name: Install zsh
        run: sudo apt-get update && sudo apt-get install -y zsh

      - uses: ./.github/actions/install-node-dependencies
        with:
          native-runtime: node

      - name: Test real shell contracts
        run: |
          pnpm exec vitest run --config config/vitest.config.ts \
            src/main/daemon/shell-ready.test.ts \
            src/main/daemon/node-pty-fd-leak.test.ts \
            src/main/providers/local-pty-shell-ready.test.ts \
            src/main/providers/__tests__/shell-ready-framework-example.test.ts \
            src/main/pty/omp-shell-wrapper.node-pty.test.ts \
            src/shared/posix-command-path-lookup.test.ts

  test:
    name: tests ${{ matrix.shard }}/${{ strategy.job-total }}
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        shard: [1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16]

    steps:
      - name: Checkout
        uses: actions/checkout@v6
        with:
          persist-credentials: false

      - uses: ./.github/actions/install-node-dependencies
        with:
          native-runtime: node

      - name: Install Electron package binary for tests
        run: node config/scripts/install-electron-package-binary.mjs

      - name: Test shard
        run: |
          pnpm exec vitest run --config config/vitest.config.ts \
            --exclude=src/main/daemon/shell-ready.test.ts \
            --exclude=src/main/daemon/node-pty-fd-leak.test.ts \
            --exclude=src/main/providers/local-pty-shell-ready.test.ts \
            --exclude=src/main/providers/__tests__/shell-ready-framework-example.test.ts \
            --exclude=src/main/pty/omp-shell-wrapper.node-pty.test.ts \
            --exclude=src/shared/posix-command-path-lookup.test.ts \
            --shard=${{ matrix.shard }}/${{ strategy.job-total }}

  package:
    name: package
    runs-on: ubuntu-latest

    steps:
      - name: Checkout
        uses: actions/checkout@v6
        with:
          persist-credentials: false

      - name: Cache electron-builder downloads
        uses: actions/cache@v5
        with:
          path: |
            ~/.cache/electron
            ~/.cache/electron-builder
          key: electron-builder-linux-${{ hashFiles('pnpm-lock.yaml') }}
          restore-keys: |
            electron-builder-linux-

      - uses: ./.github/actions/install-node-dependencies
        with:
          native-runtime: electron

      - name: Build package inputs
        run: |
          status=0
          pnpm run build:cli || status=1

          scripts=(build:relay build:electron-vite:parallel)
          pids=()
          for script in "${scripts[@]}"; do
            pnpm run "$script" &
            pids+=("$!")
          done

          for pid in "${pids[@]}"; do
            wait "$pid" || status=1
          done
          exit "$status"

      - name: Project web client from renderer build
        run: pnpm run build:web-from-renderer

      - name: Build native components
        run: pnpm run build:native

      - name: Package unpacked app
        env:
          ORCA_REUSE_PREPARED_NATIVE_RUNTIME: '1'
        run: pnpm exec electron-builder --config config/electron-builder.config.cjs --dir

      - name: Smoke packaged CLI
        run: node config/scripts/smoke-packaged-cli.mjs --app-dir=dist/linux-unpacked

  verify:
    if: always()
    needs:
      - static_analysis
      - typecheck
      - git_compatibility
      - shell_contracts
      - test
      - package
    runs-on: ubuntu-latest

    steps:
      - name: Require successful checks
        env:
          STATIC_ANALYSIS: ${{ needs.static_analysis.result }}
          TYPECHECK: ${{ needs.typecheck.result }}
          GIT_COMPATIBILITY: ${{ needs.git_compatibility.result }}
          SHELL_CONTRACTS: ${{ needs.shell_contracts.result }}
          TEST: ${{ needs.test.result }}
          PACKAGE: ${{ needs.package.result }}
        run: |
          for result in \
            "$STATIC_ANALYSIS" \
            "$TYPECHECK" \
            "$GIT_COMPATIBILITY" \
            "$SHELL_CONTRACTS" \
            "$TEST" \
            "$PACKAGE"; do
            if [ "$result" != "success" ]; then
              exit 1
            fi
          done