ci.yml

name: CI

on:
  push:
  pull_request:
    branches: [main]
  workflow_dispatch:

permissions:
  contents: read

jobs:
  # Fast, dependency-free checks. Run on every push and PR.
  checks:
    name: Shell checks
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
      - name: shellcheck
        run: shellcheck scripts/*.sh tests/*.sh

  # TypeScript typecheck of the web app. Fast; runs on every push and PR.
  web-typecheck:
    name: Web typecheck
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
      - uses: actions/setup-node@v6
        with:
          node-version: 22

      - name: Fetch wasi-polyfill (sibling dep)
        # web/package.json depends on @tegmentum/wasi-polyfill via
        # file:../../wasi-polyfill, which resolves to a sibling of the repo
        # checkout. The package is published from dist/, so it must be built.
        run: |
          git clone --depth 1 https://github.com/tegmentum/wasi-polyfill.git \
            "$GITHUB_WORKSPACE/../wasi-polyfill"
          cd "$GITHUB_WORKSPACE/../wasi-polyfill"
          npm install
          npm run build

      - name: Typecheck web
        working-directory: web
        run: |
          npm install
          npx tsc --noEmit

  # py-offload reference worker tests (stdlib only). Run on every push and PR.
  reference-worker:
    name: Reference worker tests
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
      - name: Run tests
        working-directory: reference-worker
        run: python3 -m unittest discover -s tests -t .

  # Heavy: full WASI SDK download + CPython wasip2 cross-build (~10 min on a
  # cold cache). Gated to PRs into main and manual dispatch so it does not run
  # on every push. Needs an Apple Silicon runner — fetch-sdk.sh is arm64-macos.
  build:
    name: Build CPython (wasip2) + smoke tests
    if: github.event_name == 'pull_request' || github.event_name == 'workflow_dispatch'
    runs-on: macos-14
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@v6

      - name: Install toolchain
        # wasmtime runs the smoke tests; the GNU tools match what CPython's
        # WASI build detects locally (gsed / ginstall / gmkdir / pkg-config).
        run: brew install wasmtime pkg-config coreutils gnu-sed

      - name: Cache deps (WASI SDK + CPython source + build)
        uses: actions/cache@v5
        with:
          path: deps
          key: deps-${{ runner.os }}-${{ hashFiles('scripts/fetch-sdk.sh', 'scripts/fetch-cpython.sh', 'patches/**', 'Makefile') }}

      - name: Build python.wasm
        run: make build

      - name: Smoke tests
        run: make test

      # Componentize-python plan (docs/componentize-python.md) — Phase 0/1/2 gates.
      # Each step verifies one of the plan's architectural invariants on every
      # PR / dispatch so regressions to the component build are caught early.
      - name: Phase 0 — python.wasm is a wasi-p2 component
        run: make python-component-verify

      - name: Install wac + wit-bindgen (compose + binding generation)
        run: |
          cargo install --quiet --locked wac-cli || true
          cargo install --quiet --locked wit-bindgen-cli || true

      - name: Clone sibling capability components
        run: |
          # The compose step needs the prebuilt multiplexer wasms. They live in
          # sibling repos under ~/git/ in the dev environment; CI clones them
          # alongside the workspace.
          mkdir -p "$GITHUB_WORKSPACE/../"
          for r in compression-multiplexer crypto-hash-multiplexer hashing-multiplexer; do
              if [ ! -d "$GITHUB_WORKSPACE/../$r" ]; then
                  git clone --depth 1 "https://github.com/tegmentum/$r.git" \
                      "$GITHUB_WORKSPACE/../$r"
              fi
              # Build the multiplexer (cargo component build, release).
              if [ ! -f "$GITHUB_WORKSPACE/../$r/target/wasm32-wasip2/release/$(echo "$r" | tr - _).wasm" ]; then
                  (cd "$GITHUB_WORKSPACE/../$r" && cargo component build --target wasm32-wasip2 --release)
              fi
          done

      - name: Phase 1 — compose + _compression extension end-to-end
        env:
          COMPRESSION_MULTIPLEXER_WASM: ${{ github.workspace }}/../compression-multiplexer/target/wasm32-wasip2/release/compression_multiplexer.wasm
          CRYPTO_HASH_MULTIPLEXER_WASM: ${{ github.workspace }}/../crypto-hash-multiplexer/target/wasm32-wasip2/release/crypto_hash_multiplexer.wasm
          HASHING_MULTIPLEXER_WASM:     ${{ github.workspace }}/../hashing-multiplexer/target/wasm32-wasip2/release/hashing_multiplexer.wasm
        run: make test-compression-extension

      - name: Phase 2 — _crypto_hash + _xxhash end-to-end (9 + 5 vectors)
        env:
          COMPRESSION_MULTIPLEXER_WASM: ${{ github.workspace }}/../compression-multiplexer/target/wasm32-wasip2/release/compression_multiplexer.wasm
          CRYPTO_HASH_MULTIPLEXER_WASM: ${{ github.workspace }}/../crypto-hash-multiplexer/target/wasm32-wasip2/release/crypto_hash_multiplexer.wasm
          HASHING_MULTIPLEXER_WASM:     ${{ github.workspace }}/../hashing-multiplexer/target/wasm32-wasip2/release/hashing_multiplexer.wasm
        run: make test-hash-extensions