ci.yml

name: CI

on:
  workflow_dispatch:
  push:
    branches: [ master, main ]
  pull_request:

permissions:
  contents: read

jobs:
  build-and-test:
    runs-on: ubuntu-latest
    timeout-minutes: 15
    defaults:
      run:
        working-directory: universal-refiner
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7

      - name: Setup Node 22
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
        with:
          node-version: '22'

      - name: Install dependencies
        run: npm ci --no-fund

      - name: Rebuild native modules
        run: npm rebuild better-sqlite3

      - name: Build
        run: npm run build

      - name: Run tests
        run: npm run test:coverage

  acceptance:
    runs-on: ubuntu-latest
    timeout-minutes: 15
    defaults:
      run:
        working-directory: universal-refiner
    strategy:
      fail-fast: false
      matrix:
        model-order:
          - primary
          - reversed
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
        with:
          node-version: '22'
          cache: npm
          cache-dependency-path: universal-refiner/package-lock.json
      - run: npm ci --no-fund
      - run: npm rebuild better-sqlite3
      - run: npm run build
      - name: Run all-tool and provider acceptance
        run: npm run test:acceptance
      - name: Run fake-model semantic acceptance
        env:
          PROMPT_REFINER_PRIMARY_MODEL: ${{ matrix.model-order == 'primary' && 'gemma3:12b' || 'gemma3:1b' }}
          PROMPT_REFINER_FALLBACK_MODEL: ${{ matrix.model-order == 'primary' && 'gemma3:1b' || 'gemma3:12b' }}
        run: npm run acceptance:semantic
      - name: Run tracked-turn acceptance
        run: npm run acceptance:tracked-turn
      - name: Run real stdio MCP acceptance
        run: npm run acceptance:stdio-mcp

  dashboard-e2e:
    runs-on: ubuntu-latest
    timeout-minutes: 15
    defaults:
      run:
        working-directory: universal-refiner
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
        with:
          node-version: '22'
          cache: npm
          cache-dependency-path: universal-refiner/package-lock.json
      - run: npm ci --no-fund
      - run: npm rebuild better-sqlite3
      - run: npx playwright install --with-deps chromium
      - run: npm run build
      - name: Run dashboard browser E2E
        run: npm run test:e2e

  stress:
    runs-on: ubuntu-latest
    timeout-minutes: 15
    defaults:
      run:
        working-directory: universal-refiner
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
        with:
          node-version: '22'
          cache: npm
          cache-dependency-path: universal-refiner/package-lock.json
      - run: npm ci --no-fund
      - run: npm rebuild better-sqlite3
      - run: npm run build
      - name: Run restart and in-process concurrency tests
        run: npm run test:stress
      - name: Run multi-process EventStore stress
        env:
          PROMPT_REFINER_STRESS_WORKERS: '4'
          PROMPT_REFINER_STRESS_WRITES: '100'
        run: npm run stress:event-store
      - name: Run abrupt recovery proof
        run: npm run recovery:event-store:abrupt
      - name: Run EventStore soak
        run: npm run stress:event-store:soak

  windows:
    runs-on: windows-latest
    timeout-minutes: 20
    defaults:
      run:
        working-directory: universal-refiner
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
        with:
          node-version: '22'
          cache: npm
          cache-dependency-path: universal-refiner/package-lock.json
      - run: npm ci --no-fund
      - run: npm rebuild better-sqlite3
      - run: npm run build
      - run: npm run test:coverage
      - run: npm run test:acceptance
      - run: npm run acceptance:semantic
      - run: npm run acceptance:tracked-turn
      - run: npm run acceptance:stdio-mcp
      - run: npm run test:stress
      - run: npm run stress:event-store
      - run: npm run recovery:event-store:abrupt
      - run: npm run stress:event-store:soak
      - run: npm run acceptance:package-runtime

  supply-chain:
    runs-on: ubuntu-latest
    timeout-minutes: 15
    defaults:
      run:
        working-directory: universal-refiner
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
        with:
          node-version: '22'
          cache: npm
          cache-dependency-path: universal-refiner/package-lock.json
      - run: npm ci --no-fund
      - run: npm run security:audit
      - run: npm run security:audit:all
      - run: npm run security:secrets
      - run: npm run build
      - run: npm run package:check
      - run: npm run acceptance:package-runtime

  release-gate:
    if: always()
    needs: [build-and-test, acceptance, dashboard-e2e, stress, windows, supply-chain]
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - name: Require every enterprise gate
        env:
          BUILD: ${{ needs['build-and-test'].result }}
          ACCEPTANCE: ${{ needs.acceptance.result }}
          DASHBOARD_E2E: ${{ needs['dashboard-e2e'].result }}
          STRESS: ${{ needs.stress.result }}
          WINDOWS: ${{ needs.windows.result }}
          SUPPLY_CHAIN: ${{ needs['supply-chain'].result }}
        run: |
          test "$BUILD" = "success"
          test "$ACCEPTANCE" = "success"
          test "$DASHBOARD_E2E" = "success"
          test "$STRESS" = "success"
          test "$WINDOWS" = "success"
          test "$SUPPLY_CHAIN" = "success"