Genarrative/.gitea/workflows/project-ci.yml

name: Project CI

on:
  push:
    branches:
      - master
  pull_request:
  workflow_dispatch:

permissions:
  contents: read

env:
  CI: 'true'
  CARGO_INCREMENTAL: '0'
  CARGO_HTTP_MULTIPLEXING: 'false'
  CARGO_NET_RETRY: '10'
  CARGO_TERM_COLOR: always
  NPM_CONFIG_AUDIT: 'false'
  NPM_CONFIG_FETCH_RETRIES: '10'
  NPM_CONFIG_FETCH_RETRY_FACTOR: '2'
  NPM_CONFIG_FETCH_RETRY_MAXTIMEOUT: '60000'
  NPM_CONFIG_FETCH_RETRY_MINTIMEOUT: '2000'
  NPM_CONFIG_FUND: 'false'
  NPM_CONFIG_PREFER_OFFLINE: 'true'
  RUSTUP_AUTO_INSTALL: '0'
  RUSTC_WRAPPER: ''
  CARGO_BUILD_RUSTC_WRAPPER: ''

jobs:
  repository-checks:
    name: Repository checks
    runs-on: genarrative-ci
    steps:
      - name: Checkout full history from Gitea
        env:
          GENARRATIVE_GITEA_FETCH_DEPTH: '0'
          GENARRATIVE_GITEA_TOKEN: ${{ github.token }}
        run: genarrative-gitea-checkout

      - name: Validate preinstalled CI job image and sandbox
        run: GENARRATIVE_GITEA_CI_CHECK_RUNTIME=1 bash scripts/check-gitea-ci-job-image.sh

      - name: Resolve comparison base
        shell: bash
        run: |
          set -euo pipefail
          base_ref="$(node -e '
            const fs = require("node:fs");
            const event = JSON.parse(fs.readFileSync(process.env.GITHUB_EVENT_PATH, "utf8"));
            process.stdout.write(event.pull_request?.base?.sha ?? event.before ?? "");
          ')"
          if [[ -n "${base_ref}" && ! "${base_ref}" =~ ^0+$ ]]; then
            git cat-file -e "${base_ref}^{commit}" 2>/dev/null || {
              echo "comparison base commit is unavailable: ${base_ref}" >&2
              exit 1
            }
          else
            base_ref="$(git merge-base HEAD origin/master 2>/dev/null || git rev-parse HEAD)"
          fi
          resolved_base_ref="$(git rev-parse --verify "${base_ref}^{commit}" 2>/dev/null || true)"
          head_ref="$(git rev-parse HEAD)"
          if [[ "${resolved_base_ref}" == "${head_ref}" ]]; then
            resolved_base_ref="$(git rev-parse --verify HEAD^ 2>/dev/null || true)"
          fi
          if [[ -z "${resolved_base_ref}" ]]; then
            echo 'comparison base must resolve to a commit distinct from HEAD.' >&2
            exit 1
          fi
          base_ref="${resolved_base_ref}"
          if [[ "${GITHUB_EVENT_NAME:-}" == 'pull_request' ]] \
            && ! git merge-base --is-ancestor "${base_ref}" HEAD; then
            echo 'pull request head does not contain the latest base commit; update the branch and rerun CI.' >&2
            exit 1
          fi
          echo "SPACETIME_SCHEMA_BASE_REF=${base_ref}" >> "${GITHUB_ENV}"

      - name: Install npm dependencies
        run: bash scripts/ci-npm-ci-with-retry.sh

      - name: Run repository checks
        run: npm run check:repository-ci

  frontend-tests:
    name: Frontend tests
    runs-on: genarrative-ci
    steps:
      - name: Checkout source from Gitea
        env:
          GENARRATIVE_GITEA_FETCH_DEPTH: '1'
          GENARRATIVE_GITEA_TOKEN: ${{ github.token }}
        run: genarrative-gitea-checkout

      - name: Validate preinstalled CI job image and sandbox
        run: GENARRATIVE_GITEA_CI_CHECK_RUNTIME=1 bash scripts/check-gitea-ci-job-image.sh

      - name: Install npm dependencies
        run: bash scripts/ci-npm-ci-with-retry.sh

      - name: Run frontend and script tests
        run: npm run test

      - name: Run BgFilter worker smoke harness tests
        run: npm run bgfilter-worker:smoke-test

      - name: Validate production health patrol behavior
        run: npm run check:production-health-patrol

      - name: Validate production API release behavior
        run: npm run check:production-api-release

      - name: Validate production API deploy behavior
        run: npm run check:production-api-deploy

  backend-tests:
    name: Backend tests
    runs-on: genarrative-ci
    steps:
      - name: Checkout full history from Gitea
        env:
          GENARRATIVE_GITEA_FETCH_DEPTH: '0'
          GENARRATIVE_GITEA_TOKEN: ${{ github.token }}
        run: genarrative-gitea-checkout

      - name: Validate preinstalled CI job image and sandbox
        run: GENARRATIVE_GITEA_CI_CHECK_RUNTIME=1 bash scripts/check-gitea-ci-job-image.sh

      - name: Resolve comparison base
        shell: bash
        run: |
          set -euo pipefail
          base_ref="$(node -e '
            const fs = require("node:fs");
            const event = JSON.parse(fs.readFileSync(process.env.GITHUB_EVENT_PATH, "utf8"));
            process.stdout.write(event.pull_request?.base?.sha ?? event.before ?? "");
          ')"
          if [[ -n "${base_ref}" && ! "${base_ref}" =~ ^0+$ ]]; then
            git cat-file -e "${base_ref}^{commit}" 2>/dev/null || {
              echo "comparison base commit is unavailable: ${base_ref}" >&2
              exit 1
            }
          else
            base_ref="$(git merge-base HEAD origin/master 2>/dev/null || git rev-parse HEAD)"
          fi
          resolved_base_ref="$(git rev-parse --verify "${base_ref}^{commit}" 2>/dev/null || true)"
          head_ref="$(git rev-parse HEAD)"
          if [[ "${resolved_base_ref}" == "${head_ref}" ]]; then
            resolved_base_ref="$(git rev-parse --verify HEAD^ 2>/dev/null || true)"
          fi
          if [[ -z "${resolved_base_ref}" ]]; then
            echo 'comparison base must resolve to a commit distinct from HEAD.' >&2
            exit 1
          fi
          base_ref="${resolved_base_ref}"
          if [[ "${GITHUB_EVENT_NAME:-}" == 'pull_request' ]] \
            && ! git merge-base --is-ancestor "${base_ref}" HEAD; then
            echo 'pull request head does not contain the latest base commit; update the branch and rerun CI.' >&2
            exit 1
          fi
          echo "SPACETIME_SCHEMA_BASE_REF=${base_ref}" >> "${GITHUB_ENV}"

      - name: Install npm dependencies
        run: bash scripts/ci-npm-ci-with-retry.sh

      - name: Prepare server-rs Rust dependencies
        shell: bash
        run: |
          set -euo pipefail
          for attempt in $(seq 1 5); do
            if cargo fetch --locked \
              --target x86_64-unknown-linux-gnu \
              --manifest-path server-rs/Cargo.toml; then
              break
            fi
            if [[ "${attempt}" -eq 5 ]]; then
              echo 'server-rs Cargo dependency fetch failed after 5 attempts.' >&2
              exit 1
            fi
            sleep $((attempt * 2))
          done

      - name: Check server-rs boundaries
        run: npm run check:server-rs-ddd

      - name: Run server-rs workspace tests
        run: cargo test --locked --workspace --exclude spacetime-module --no-fail-fast --manifest-path server-rs/Cargo.toml

      - name: Run SpacetimeDB module unit tests
        run: cargo test --locked -p spacetime-module --no-fail-fast --manifest-path server-rs/Cargo.toml

      - name: Check api-server targets
        run: cargo check --locked -p api-server --all-targets --manifest-path server-rs/Cargo.toml

      - name: Check SpacetimeDB module
        run: cargo check --locked -p spacetime-module --manifest-path server-rs/Cargo.toml

  native-shell-tests:
    name: Native shell tests
    runs-on: genarrative-ci
    steps:
      - name: Checkout full history from Gitea
        env:
          GENARRATIVE_GITEA_FETCH_DEPTH: '0'
          GENARRATIVE_GITEA_TOKEN: ${{ github.token }}
        run: genarrative-gitea-checkout

      - name: Validate preinstalled CI job image and sandbox
        run: GENARRATIVE_GITEA_CI_CHECK_RUNTIME=1 bash scripts/check-gitea-ci-job-image.sh

      - name: Install npm dependencies
        run: bash scripts/ci-npm-ci-with-retry.sh

      - name: Prepare native Rust dependencies
        shell: bash
        run: |
          set -euo pipefail
          for manifest_path in \
            server-rs/Cargo.toml \
            apps/desktop-shell/src-tauri/Cargo.toml \
            apps/ai-game-creator-shell/src-tauri/Cargo.toml; do
            for attempt in $(seq 1 5); do
              if cargo fetch --locked \
                --target x86_64-unknown-linux-gnu \
                --manifest-path "${manifest_path}"; then
                break
              fi
              if [[ "${attempt}" -eq 5 ]]; then
                echo "Cargo dependency fetch failed after 5 attempts: ${manifest_path}" >&2
                exit 1
              fi
              sleep $((attempt * 2))
            done
          done

      - name: Prepare standalone Rust crate dependencies
        shell: bash
        run: |
          set -euo pipefail
          # agent-runtime-core / agent-runtime-orchestration 被 server-rs/Cargo.toml 的
          # exclude 排除，不参与上面的 workspace 锁文件，因此上面那次锁定 fetch 覆盖不到它们；
          # 而 check:native-shells 会经 agent-runtime-*:check 用 `cargo test --manifest-path`
          # 单独跑这两个 crate。不在这里预热的话，这两条测试会在测试阶段自己
          # `Updating crates.io index`，crates.io 一抖动整条 native shell 作业就红
          # （见 #327 / PR #316 run 1950）。
          # 两个 crate 都没有提交 Cargo.lock，所以这里只能做不带锁标志的 fetch：
          # 加锁标志会因为缺少锁文件直接失败。生成的 Cargo.lock 落在两个 crate 目录内，
          # 已被各自的 .gitignore 忽略，只留在容器里；随后的测试阶段因此能用锁定版本
          # 解析，不再触碰 registry index。
          for manifest_path in \
            server-rs/crates/agent-runtime-core/Cargo.toml \
            server-rs/crates/agent-runtime-orchestration/Cargo.toml; do
            for attempt in $(seq 1 5); do
              if cargo fetch \
                --target x86_64-unknown-linux-gnu \
                --manifest-path "${manifest_path}"; then
                break
              fi
              if [[ "${attempt}" -eq 5 ]]; then
                echo "standalone crate dependency fetch failed after 5 attempts: ${manifest_path}" >&2
                exit 1
              fi
              sleep $((attempt * 2))
            done
          done

      - name: Run native shell gates
        run: npm run check:native-shells

      - name: Ensure native lockfiles are unchanged
        run: git diff --exit-code -- apps/desktop-shell/src-tauri/Cargo.lock apps/ai-game-creator-shell/src-tauri/Cargo.lock