ci.yml

# The acceptance gate, on GitHub Actions (PLAN.md §13.7, M12c).
#
#   verify          the TypeScript workspace: build, typecheck, tests, schemas/ drift
#   java            the Spoon extractor's own suite
#   java-native     the GraalVM binary — ONE JOB PER OS, because native-image
#                   drives the host linker and cannot cross-compile the way
#                   `dotnet publish -r <rid>` can. Each job builds AND smoke-tests
#                   on its own runner, so the matrix is five jobs, not 5+5
#   csharp-test     the Roslyn extractor's own suite (per-line schema validation included)
#   csharp-publish  one self-contained single-file binary per RID, from ONE Linux host
#   csharp-smoke    each binary runs on a runner of ITS OWN OS and must reproduce
#                   the committed fixture snapshot byte for byte — the cross-OS gate
#                   the plan could only delegate to a laptop under GitLab
#   typescript-smoke the bundled TypeScript extractor on a runner of each OS must
#                   reproduce its fixture snapshot byte for byte (PLAN.md §14.7):
#                   Windows paths, CRLF checkouts, case-insensitive walks
#   release         on a v* tag, the five binaries attached to a GitHub Release,
#                   and the TypeScript extractor published to npm when NPM_TOKEN is set
#
# `test.sh` and `build.sh` are the same gate on a developer machine; CI calls
# them where it can so the two cannot disagree about what "green" means.

name: ci

on:
  push:
    branches: [main]
    tags: ["v*"]
  pull_request:

permissions:
  contents: read

env:
  DOTNET_CLI_TELEMETRY_OPTOUT: "1"
  DOTNET_NOLOGO: "1"
  DOTNET_SKIP_FIRST_TIME_EXPERIENCE: "1"

jobs:
  verify:
    name: typescript workspace
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: pnpm/action-setup@v4
        with:
          run_install: false
      - uses: actions/setup-node@v4
        with:
          node-version: 22
          cache: pnpm
      - run: pnpm install --frozen-lockfile
      - run: pnpm -r build
      - run: pnpm -r typecheck
      - run: pnpm -r test
      # schemas/ is a committed artifact: regenerating must be a no-op.
      - run: pnpm run gen:schemas
      - run: git diff --exit-code schemas/ || (echo "schemas/ is stale — run pnpm run gen:schemas and commit" && exit 1)

  # The website — the landing page at / and the documentation at /docs/, one
  # Hugo site (Hextra vendored as a git submodule) — built with the same pinned
  # Hugo version a developer runs locally. Independent of the Node toolchain.
  website:
    name: website (hugo)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          submodules: recursive
          fetch-depth: 1
      - uses: peaceiris/actions-hugo@v3
        with:
          hugo-version: "0.165.0"
          extended: true
      - run: cd website && hugo --minify --gc
      - uses: actions/upload-artifact@v4
        with:
          name: website
          path: website/public
          retention-days: 7

  java:
    name: java extractor
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-java@v4
        with:
          distribution: temurin
          java-version: 21
          cache: maven
      - run: cd extractors/java && ./mvnw -B test

  # native-image is an AOT compiler plus the host's linker: a macOS binary needs a
  # macOS runner. That is the whole reason this matrix is shaped differently from
  # csharp-publish/csharp-smoke — there is no build-once-ship-five here, so each
  # job builds its own RID and immediately proves it on the OS it was built for.
  java-native:
    name: java native ${{ matrix.rid }}
    needs: java
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - { os: ubuntu-latest,    rid: linux-x64,   exe: codegraph-java }
          - { os: ubuntu-24.04-arm, rid: linux-arm64, exe: codegraph-java }
          - { os: macos-latest,     rid: osx-arm64,   exe: codegraph-java }
          - { os: macos-15-intel,   rid: osx-x64,     exe: codegraph-java }
          - { os: windows-latest,   rid: win-x64,     exe: codegraph-java.exe }
    steps:
      # The snapshot is compared byte for byte, so a Windows checkout must not
      # rewrite line endings.
      - run: git config --global core.autocrlf false
      - uses: actions/checkout@v4
      # Brings native-image AND, on Windows, the MSVC toolchain it links with.
      - uses: graalvm/setup-graalvm@v1
        with:
          java-version: "25"
          distribution: graalvm-community
          github-token: ${{ secrets.GITHUB_TOKEN }}
          cache: maven
      # The same flags a developer's `./build.sh --java --native` uses — one
      # definition of what a released binary is.
      - shell: bash
        run: ./build.sh --java --native --skip-install --no-auto-install
      # The gate: the BINARY, not `java -jar`, re-extracts the fixture corpus and
      # must reproduce the committed snapshot. This is the only check that
      # exercises the image's platform-library path — no java.home, no VM class
      # library, the embedded ct.sym reference.
      #
      # Exactly ONE field is machine-specific: the header's `root`, the absolute
      # path the run was pointed at — `D:\a\codegraph\...` on Windows, where
      # matching a POSIX path found nothing and the whole matrix went red on
      # char 137. So the field is rewritten wherever it points, and a guard first
      # asserts it really named the fixture corpus — matched without naming a
      # separator at all, which is what made the first attempt Windows-blind. Every
      # other byte must match — file paths inside the model are already forced to
      # forward slashes by Anchors.relativize, precisely so this holds.
      - shell: bash
        run: |
          bin="extractors/java/dist/${{ matrix.rid }}/${{ matrix.exe }}"
          chmod +x "$bin"
          "$bin" --help > /dev/null
          "$bin" --src fixtures/java/src --out out.jsonl --progress plain
          head -1 out.jsonl | grep -qE '"root":"[^"]*fixtures[^"]*java[^"]*src"' \
            || { echo "the header's root does not name the fixture corpus"; head -c 200 out.jsonl; exit 1; }
          sed '1s|"root":"[^"]*"|"root":"fixtures/java/src"|' out.jsonl | cmp - fixtures/java/expected/model.jsonl
          echo "the native binary reproduces the snapshot on ${{ matrix.os }}"
      - uses: actions/upload-artifact@v4
        with:
          name: codegraph-java-${{ matrix.rid }}
          path: extractors/java/dist/${{ matrix.rid }}/
          if-no-files-found: error
          retention-days: 14

  csharp-test:
    name: csharp extractor
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-dotnet@v4
        with:
          global-json-file: extractors/csharp/global.json
      - run: cd extractors/csharp && dotnet test -c Release --nologo

  csharp-publish:
    name: publish ${{ matrix.rid }}
    needs: csharp-test
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        rid: [linux-x64, linux-arm64, osx-x64, osx-arm64, win-x64]
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-dotnet@v4
        with:
          global-json-file: extractors/csharp/global.json
      # The same flags a developer's `./build.sh --csharp` uses — one definition.
      - run: ./build.sh --csharp --rid ${{ matrix.rid }} --skip-install --no-auto-install
      - uses: actions/upload-artifact@v4
        with:
          name: codegraph-csharp-${{ matrix.rid }}
          path: extractors/csharp/dist/${{ matrix.rid }}/
          if-no-files-found: error
          retention-days: 14

  csharp-smoke:
    name: smoke ${{ matrix.rid }} on ${{ matrix.os }}
    needs: csharp-publish
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - { os: ubuntu-latest,    rid: linux-x64,   exe: codegraph-csharp }
          - { os: ubuntu-24.04-arm, rid: linux-arm64, exe: codegraph-csharp }
          - { os: macos-latest,     rid: osx-arm64,   exe: codegraph-csharp }
          - { os: macos-15-intel,   rid: osx-x64,     exe: codegraph-csharp }
          - { os: windows-latest,   rid: win-x64,     exe: codegraph-csharp.exe }
    steps:
      # The snapshot is compared byte for byte: a Windows checkout must not
      # rewrite its line endings (.gitattributes says so too — belt and braces).
      - run: git config --global core.autocrlf false
      - uses: actions/checkout@v4
      - uses: actions/download-artifact@v4
        with:
          name: codegraph-csharp-${{ matrix.rid }}
          path: bin
      # Nothing is installed on this runner for the extractor: the binary
      # carries the runtime, Roslyn and the BCL. Run from the repo root with
      # the RELATIVE --src the snapshot was made with (the typed path is the
      # header's `root`).
      - shell: bash
        run: |
          chmod +x "bin/${{ matrix.exe }}"
          "bin/${{ matrix.exe }}" --version
          "bin/${{ matrix.exe }}" --src fixtures/csharp/src --out out.jsonl --progress plain
          cmp out.jsonl fixtures/csharp/expected/model.jsonl
          echo "byte-identical on ${{ matrix.os }}"

  typescript-smoke:
    name: typescript extractor on ${{ matrix.os }}
    needs: verify
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, macos-latest, windows-latest]
    steps:
      - run: git config --global core.autocrlf false
      - uses: actions/checkout@v4
      - uses: pnpm/action-setup@v4
        with:
          run_install: false
      - uses: actions/setup-node@v4
        with:
          node-version: 22
          cache: pnpm
      - run: pnpm install --frozen-lockfile
      - run: pnpm --filter codegraph-typescript build
      # The BUILT bundle, from the repo root with the RELATIVE --src the
      # snapshot was made with; `typescript` resolves from the workspace
      # install because the bundle leaves it external (its lib files must sit
      # beside it). `cmp` is the whole cross-OS gate: the model is bytes.
      - shell: bash
        run: |
          node extractors/typescript/dist/cli.js --version
          node extractors/typescript/dist/cli.js --src fixtures/typescript/src --out out.jsonl --progress plain
          cmp out.jsonl fixtures/typescript/expected/model.jsonl
          echo "byte-identical on ${{ matrix.os }}"

  release:
    name: github release
    if: startsWith(github.ref, 'refs/tags/v')
    needs: [verify, java, java-native, csharp-smoke, typescript-smoke]
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - uses: actions/checkout@v4
      - uses: actions/download-artifact@v4
        with:
          pattern: codegraph-*
          path: artifacts
      - name: name each binary after its RID and attach it
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          set -euo pipefail
          mkdir -p release
          for extractor in csharp java; do
            for dir in artifacts/codegraph-$extractor-*; do
              rid="${dir#artifacts/codegraph-$extractor-}"
              for f in "$dir"/codegraph-$extractor*; do
                case "$f" in
                  *.exe) cp "$f" "release/codegraph-$extractor-$rid.exe" ;;
                  *)     cp "$f" "release/codegraph-$extractor-$rid" ;;
                esac
              done
            done
          done
          (cd release && sha256sum * > SHA256SUMS)
          gh release create "${GITHUB_REF_NAME}" --generate-notes --title "codegraph ${GITHUB_REF_NAME}" release/* \
            || gh release upload "${GITHUB_REF_NAME}" release/* --clobber

  npm-publish:
    name: npm publish codegraph-typescript
    if: startsWith(github.ref, 'refs/tags/v')
    needs: [verify, typescript-smoke]
    runs-on: ubuntu-latest
    permissions:
      contents: read
      id-token: write
    steps:
      - uses: actions/checkout@v4
      - uses: pnpm/action-setup@v4
        with:
          run_install: false
      - uses: actions/setup-node@v4
        with:
          node-version: 22
          cache: pnpm
          registry-url: https://registry.npmjs.org
      - run: pnpm install --frozen-lockfile
      - run: pnpm --filter codegraph-typescript build
      # `npx codegraph-typescript` for anyone with Node 22 (PLAN.md §14.7).
      # Skipped, not failed, when the repository holds no NPM_TOKEN: the
      # GitHub release above is the release; npm is the convenience.
      - name: publish with provenance
        if: env.NPM_TOKEN != ''
        env:
          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
        run: cd extractors/typescript && pnpm publish --provenance --access public --no-git-checks