ci.yml

name: CI

on:
  push:
    branches: [master]
  pull_request:

permissions:
  contents: read

concurrency:
  group: codexui-ci-${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true

env:
  CMAKE_BUILD_PARALLEL_LEVEL: 8
  # Accepted elapsed-time overruns are reported; correctness/work-count gates remain mandatory.
  CODEXUI_TIMING_POLICY: report

jobs:
  gcc-15-debug:
    runs-on: ubuntu-24.04
    container:
      image: gcc:15.3.0-trixie
      options: --cap-add=NET_ADMIN --sysctl net.ipv6.conf.all.disable_ipv6=0
    timeout-minutes: 45

    steps:
      - name: Check out exact CodexUI head
        uses: actions/checkout@v5
        with:
          fetch-depth: 0
          ref: >-
            ${{ github.event_name == 'pull_request' &&
                github.event.pull_request.head.sha || github.sha }}

      - name: Check out SNode.C head
        uses: actions/checkout@v5
        with:
          repository: SNodeC/snode.c
          ref: master
          path: _deps/snodec

      - name: Check out AISuite master
        uses: actions/checkout@v5
        with:
          repository: SNodeC/AISuite
          ref: master
          path: _deps/aisuite

      - name: Install build dependencies
        run: |
          apt-get update
          apt-get install -y \
            cmake \
            iproute2 \
            libbluetooth-dev \
            libgit2-dev \
            libmagic-dev \
            libssl-dev \
            ninja-build \
            nlohmann-json3-dev \
            pkg-config \
            qt6-base-dev
          git config --global --add safe.directory "$GITHUB_WORKSPACE"
          git config --global --add safe.directory "$GITHUB_WORKSPACE/_deps/snodec"
          git config --global --add safe.directory "$GITHUB_WORKSPACE/_deps/aisuite"
          getent group snodec >/dev/null || groupadd --system snodec

      - name: Enable IPv6 transport coverage
        run: |
          ip link add codexui-ci-v6 type dummy
          ip link set codexui-ci-v6 up
          ip -6 address add fd00::1/128 dev codexui-ci-v6
          ip -6 address show dev codexui-ci-v6
          getent ahostsv6 ::1

      - name: Verify CodexUI source revision
        shell: bash
        env:
          CODEXUI_EXPECTED_HEAD: >-
            ${{ github.event_name == 'pull_request' &&
                github.event.pull_request.head.sha || github.sha }}
        run: |
          set -euo pipefail
          test "$(git rev-parse HEAD)" = "$CODEXUI_EXPECTED_HEAD"

      - name: Build and install SNode.C
        run: |
          cmake -S _deps/snodec -B _build/snodec -G Ninja \
            -DCMAKE_BUILD_TYPE=Debug \
            -DCMAKE_INSTALL_PREFIX="$GITHUB_WORKSPACE/_stage/snodec" \
            -DSNODEC_BUILD_TESTS=OFF \
            -DSNODEC_BUILD_APPS=OFF
          cmake --build _build/snodec --target all
          cmake --install _build/snodec

      - name: Build, test, and install AISuite Codex
        run: |
          cmake -S _deps/aisuite -B _build/aisuite -G Ninja \
            -DCMAKE_BUILD_TYPE=Debug \
            -DCMAKE_INSTALL_PREFIX="$GITHUB_WORKSPACE/_stage/aisuite" \
            -DCMAKE_PREFIX_PATH="$GITHUB_WORKSPACE/_stage/snodec" \
            -DAISUITE_BUILD_CODEX_TESTS=ON \
            -DAISUITE_BUILD_APPS=ON
          cmake --build _build/aisuite --target all --parallel 2
          install -d -m 0770 -g snodec \
            /etc/snode.c \
            /var/log/snode.c \
            /var/run/snode.c
          LD_LIBRARY_PATH="$GITHUB_WORKSPACE/_stage/snodec/lib" \
            ctest --test-dir _build/aisuite --output-on-failure
          cmake --install _build/aisuite

      - name: Configure CodexUI
        run: |
          cmake -S . -B build -G Ninja \
            -DCMAKE_BUILD_TYPE=Debug \
            -DCMAKE_PREFIX_PATH="$GITHUB_WORKSPACE/_stage/aisuite;$GITHUB_WORKSPACE/_stage/snodec" \
            -DCODEXUI_INSTALL_WEB=OFF

      - name: Build CodexUI
        run: cmake --build build --target all

      - name: Test CodexUI
        run: |
          LD_LIBRARY_PATH="$GITHUB_WORKSPACE/_stage/aisuite/lib:$GITHUB_WORKSPACE/_stage/snodec/lib" \
            ctest --test-dir build --output-on-failure --verbose

      - name: Check changed lines
        shell: bash
        env:
          CODEXUI_BASE_SHA: ${{ github.event.pull_request.base.sha }}
        run: |
          set -euo pipefail
          if [[ "${{ github.event_name }}" == "pull_request" ]]
          then
            git diff --check "$CODEXUI_BASE_SHA...HEAD"
          else
            git diff --check HEAD^ HEAD
          fi

  web:
    runs-on: ubuntu-24.04
    timeout-minutes: 15

    steps:
      - name: Check out exact CodexUI head
        uses: actions/checkout@v5
        with:
          fetch-depth: 0
          ref: >-
            ${{ github.event_name == 'pull_request' &&
                github.event.pull_request.head.sha || github.sha }}
          path: CodexUI/codexui

      - name: Check out AISuite master frontend SDK
        uses: actions/checkout@v5
        with:
          repository: SNodeC/AISuite
          ref: master
          path: AISuite-extraction/AISuite-final

      - name: Set up Node.js
        uses: actions/setup-node@v4
        with:
          node-version: 22
          cache: npm
          cache-dependency-path: |
            AISuite-extraction/AISuite-final/packages/codex-frontend/package-lock.json
            CodexUI/codexui/web/package-lock.json

      - name: Test the frontend SDK
        working-directory: AISuite-extraction/AISuite-final/packages/codex-frontend
        run: |
          npm ci
          npm test
          npm pack --dry-run

      - name: Verify CodexWebUI on Node.js 22
        working-directory: CodexUI/codexui
        run: |
          npm ci --prefix web
          npm test --prefix web

      - name: Select the qualified performance runtime
        uses: actions/setup-node@v4
        with:
          node-version: 24.20.0

      - name: Select the qualified browser runtime
        shell: bash
        run: |
          set -euo pipefail
          curl --fail --location --retry 3 \
            https://storage.googleapis.com/chrome-for-testing-public/152.0.7977.82/linux64/chrome-linux64.zip \
            --output "$RUNNER_TEMP/codexui-chrome.zip"
          echo "0704631fb3e4f741092e08f55272f90abc3e307f991f05f332924364415b02e0  $RUNNER_TEMP/codexui-chrome.zip" | sha256sum --check
          unzip -q "$RUNNER_TEMP/codexui-chrome.zip" -d "$RUNNER_TEMP/codexui-browser"
          echo "CHROME_BIN=$RUNNER_TEMP/codexui-browser/chrome-linux64/chrome" >> "$GITHUB_ENV"
          "$RUNNER_TEMP/codexui-browser/chrome-linux64/chrome" --version

      - name: Test CodexWebUI on the qualification runtime
        working-directory: CodexUI/codexui
        run: |
          npm ci --prefix web
          npm test --prefix web

      - name: Profile the presentation model
        id: web-model-profile
        if: ${{ !cancelled() }}
        working-directory: CodexUI/codexui
        run: npm run profile --prefix web

      - name: Build and verify the production browser artifact
        id: web-artifact
        if: ${{ !cancelled() }}
        working-directory: CodexUI/codexui
        run: |
          npm run build:app --prefix web
          npm run verify:artifact --prefix web

      - name: Qualify the production browser application
        id: web-browser
        if: ${{ !cancelled() && steps.web-artifact.outcome == 'success' }}
        working-directory: CodexUI/codexui
        run: npm run qualify:browser --prefix web

      - name: Capture failed web timing diagnostics
        if: ${{ !cancelled() && (steps.web-model-profile.outcome == 'failure' || steps.web-browser.outcome == 'failure') }}
        working-directory: CodexUI/codexui
        run: |
          lscpu
          free -m
          mkdir -p _build/web-profiles
          # Profiled retries are diagnostic only; the mandatory gates above remain failed.
          node --cpu-prof --cpu-prof-interval=100 --cpu-prof-dir=_build/web-profiles web/tools/profile-presentation.mjs || true
          CODEXUI_BROWSER_CPU_PROFILE=_build/web-profiles/browser.cpuprofile node web/tools/qualify-browser.mjs || true

      - name: Upload failed web timing diagnostics
        if: ${{ !cancelled() && (steps.web-model-profile.outcome == 'failure' || steps.web-browser.outcome == 'failure') }}
        uses: actions/upload-artifact@v4
        with:
          name: web-timing-diagnostics
          path: CodexUI/codexui/_build/web-profiles

      - name: Stage and verify the CodexWebUI install
        if: ${{ !cancelled() && steps.web-artifact.outcome == 'success' }}
        working-directory: CodexUI/codexui
        run: |
          cmake -S web -B _build/web-package \
            -DCMAKE_INSTALL_PREFIX="$PWD/_stage/web"
          cmake --build _build/web-package --target codexui-web-artifact
          cmake --install _build/web-package --component CodexWebUI
          test -s _stage/web/share/codexui/web/index.html
          test -n "$(find _stage/web/share/codexui/web/assets -type f -print -quit)"

      - name: Upload CodexWebUI production artifact
        uses: actions/upload-artifact@v4
        with:
          name: codexui-web
          path: CodexUI/codexui/_stage/web/share/codexui/web
          if-no-files-found: error