ci.yml

name: CI

on:
  push:
    branches: [ main, develop ]
  pull_request:
    branches: [ main, develop ]

permissions:
  contents: read
  packages: read

env:
  GOPRIVATE: github.com/GoCodeAlone/*
  GONOSUMCHECK: github.com/GoCodeAlone/*
  # CI runners are ephemeral; the iac/diffcache filesystem cache would
  # cold-miss every job and waste a few ms on disk I/O. Force in-memory
  # mode per the T3.5 rev3 lifecycle constraint — no filesystem writes
  # in containerized runners. Operators running wfctl locally see the
  # default filesystem cache at ~/.cache/wfctl/diff/.
  WFCTL_DIFFCACHE: ":memory:"

jobs:
  test:
    name: Test (Go ${{ matrix.go-version }})
    runs-on: ubuntu-latest
    needs: [go-mod-tidy]
    permissions:
      contents: read
      packages: read
    strategy:
      matrix:
        go-version: ['1.26.4']

    steps:
    - name: Check out code
      uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3

    - name: Set up Go
      uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
      with:
        go-version: ${{ matrix.go-version }}
        cache: false

    - name: Set up Node.js
      uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
      with:
        node-version: '24'
        registry-url: 'https://npm.pkg.github.com'
        cache: 'npm'
        cache-dependency-path: ui/package-lock.json

    - name: Build UI assets
      run: |
        cd ui && npm ci && npm run build
      env:
        NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

    - name: Download dependencies
      run: |
        go mod download
        go mod verify

    - name: Run tests
      run: |
        go test -v -race -coverprofile=coverage.out ./...

    - name: Check Codecov token
      id: codecov-token
      if: always()
      run: |
        if [ -n "$CODECOV_TOKEN" ]; then
          echo "available=true" >> "$GITHUB_OUTPUT"
        else
          echo "available=false" >> "$GITHUB_OUTPUT"
        fi
      env:
        CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}

    - name: Upload coverage reports
      uses: codecov/codecov-action@75cd11691c0faa626561e295848008c8a7dddffe # v5.5.4
      if: always() && steps.codecov-token.outputs.available == 'true'
      with:
        token: ${{ secrets.CODECOV_TOKEN }}
        files: ./coverage.out
        fail_ci_if_error: false

  lint:
    name: Lint
    runs-on: ubuntu-latest
    needs: [go-mod-tidy]
    permissions:
      contents: read
      packages: read

    steps:
    - name: Check out code
      uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3

    - name: Set up Go
      uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
      with:
        go-version: '1.26.4'
        cache: false

    - name: Set up Node.js
      uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
      with:
        node-version: '24'
        registry-url: 'https://npm.pkg.github.com'
        cache: 'npm'
        cache-dependency-path: ui/package-lock.json

    - name: Build UI assets
      run: |
        cd ui && npm ci && npm run build
      env:
        NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

    - name: Run golangci-lint
      uses: golangci/golangci-lint-action@82606bf257cbaff209d206a39f5134f0cfbfd2ee # v9.2.1
      with:
        version: v2.12.0
        args: --timeout=10m

  build:
    name: Build
    runs-on: ubuntu-latest
    needs: [go-mod-tidy]
    permissions:
      contents: read
      packages: read

    steps:
    - name: Check out code
      uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3

    - name: Set up Go
      uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
      with:
        go-version: '1.26.4'
        cache: false

    - name: Set up Node.js
      uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
      with:
        node-version: '24'
        registry-url: 'https://npm.pkg.github.com'
        cache: 'npm'
        cache-dependency-path: ui/package-lock.json

    - name: Build UI assets
      run: |
        cd ui && npm ci && npm run build
      env:
        NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

    - name: Build server binary
      run: go build -v -o /dev/null ./cmd/server

    - name: Build all packages
      run: go build -v ./...

    - name: Upload UI build artifact
      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
      with:
        name: admin-ui-dist
        path: ui/dist/
        retention-days: 3

  build-examples:
    name: Build Examples
    runs-on: ubuntu-latest
    needs: [go-mod-tidy]
    permissions:
      contents: read
      packages: read

    steps:
    - name: Check out code
      uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3

    - name: Set up Go
      uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
      with:
        go-version: '1.26.4'
        cache: false

    - name: Build examples
      run: |
        cd example
        go build -v ./...

  lint-examples:
    name: Lint Examples
    runs-on: ubuntu-latest
    needs: [go-mod-tidy]
    permissions:
      contents: read
      packages: read

    steps:
    - name: Check out code
      uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3

    - name: Set up Go
      uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
      with:
        go-version: '1.26.4'
        cache: false

    - name: Run golangci-lint on examples
      uses: golangci/golangci-lint-action@82606bf257cbaff209d206a39f5134f0cfbfd2ee # v9.2.1
      with:
        version: v2.12.0
        args: --timeout=10m
        working-directory: example

  go-mod-tidy:
    name: Go Mod Tidy
    runs-on: ubuntu-latest
    permissions:
      contents: write
      packages: read

    steps:
    - name: Check out code
      uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
      with:
        token: ${{ secrets.GITHUB_TOKEN }}

    - name: Set up Go
      uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
      with:
        go-version: '1.26.4'
        cache: false

    - name: Run go mod tidy (workflow)
      run: go mod tidy

    - name: Run go mod tidy (examples)
      run: |
        cd example
        go mod tidy

    - name: Commit tidy changes
      if: github.event_name == 'push'
      run: |
        git config user.name "github-actions[bot]"
        git config user.email "github-actions[bot]@users.noreply.github.com"
        git diff --quiet go.mod go.sum example/go.mod example/go.sum || {
          git add go.mod go.sum example/go.mod example/go.sum
          git commit -m "chore: go mod tidy"
          git push
        }

    - name: Fail if go mod tidy produced changes (PR check)
      if: github.event_name == 'pull_request'
      run: |
        git diff --exit-code go.mod go.sum
        git diff --exit-code example/go.mod example/go.sum

  ui-test:
    name: UI Tests
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: read
    defaults:
      run:
        working-directory: ui

    steps:
    - name: Check out code
      uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3

    - name: Set up Node.js
      uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
      with:
        node-version: '24'
        registry-url: 'https://npm.pkg.github.com'
        cache: 'npm'
        cache-dependency-path: ui/package-lock.json

    - name: Install dependencies
      run: npm ci
      env:
        NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

    - name: Lint
      run: npm run lint

    - name: Unit tests
      run: npm test -- --run

  # Validate all example workflow configs at three levels:
  # 1. YAML parsing (can it be loaded?)
  # 2. Schema validation (correct types, required fields, valid references?)
  # 3. Engine loading (can BuildFromConfig produce a working engine?)
  example-configs:
    name: Validate Example Configs
    runs-on: ubuntu-latest
    needs: [go-mod-tidy]
    permissions:
      contents: read
      packages: read

    steps:
    - name: Check out code
      uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3

    - name: Set up Go
      uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
      with:
        go-version: '1.26.4'
        cache: false

    - name: Set up Node.js
      uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
      with:
        node-version: '24'
        registry-url: 'https://npm.pkg.github.com'
        cache: 'npm'
        cache-dependency-path: ui/package-lock.json

    - name: Build UI assets
      run: |
        cd ui && npm ci && npm run build
      env:
        NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

    - name: YAML parsing — all configs loadable
      run: go test -v -run TestExampleConfigsLoad -timeout 60s .

    - name: Schema validation — types, fields, dependencies
      run: go test -v -run TestExampleConfigsValidate -timeout 60s .

    - name: Engine loading — BuildFromConfig + start/stop cycle
      run: go test -v -run TestExampleConfigsBuildFromConfig -timeout 120s .

    - name: Build example runner binary
      run: |
        cd example
        go build -o workflow-example .

    - name: Smoke test — run each config with timeout
      run: |
        cd example
        passed=0
        warned=0
        total=0

        for config in $(find . -name "*.yaml" \
          -not -path "*/configs/*" -not -path "*/seed/*" -not -path "*/observability/*" \
          -not -path "*/spa/*" -not -path "*/components/*" -not -path "*/node_modules/*" \
          -not -path "*/e2e/*" -not -path "*/data/*" -not -path "*/.*" \
          -not -name "docker-compose.yaml" -not -name "docker-compose.yml" | sort); do
          total=$((total + 1))
          echo -n "  $config ... "

          # Run with timeout — exit 124 means timeout (expected for servers)
          if timeout 10s ./workflow-example -config "$config" >/tmp/workflow-example.out 2>&1; then
            echo "OK (exited cleanly)"
            passed=$((passed + 1))
          else
            rc=$?
            if [ "$rc" -eq 124 ]; then
              echo "OK (server timeout — expected)"
              passed=$((passed + 1))
            else
              echo "WARN (exit $rc — may need runtime deps)"
              warned=$((warned + 1))
            fi
          fi
        done

        echo ""
        echo "Results: $total configs, $passed passed, $warned warnings"

  godo-banned:
    name: Verify godo is not imported (issue #617)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
      - name: Grep gate — *.go files must not import godo
        run: |
          ! grep -rn --include="*.go" \
              --exclude-dir=_worktrees \
              --exclude-dir=.worktrees \
              --exclude-dir=.claude \
              --exclude="godo_absent_test.go" \
              "digitalocean/godo" .
      - name: Grep gate — go.mod files must not list godo
        run: |
          ! grep -qH "digitalocean/godo" go.mod example/go.mod

  cloud-sdk-audit:
    name: Cloud-SDK inventory + k8s-backend init() partition + asymmetric graph audit
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
        with:
          go-version-file: go.mod
          cache: false
      - name: Download module deps (needed for `go list -deps`)
        env:
          GOWORK: "off"
        run: go mod download
      - name: Audit cloud-SDK imports + init() partition + Phase C asymmetric gate
        # The script enforces (once .phase-c-complete is armed):
        #   - module/ zero gcp/azure SDK real imports
        #   - build graph: zero Azure/azure-sdk-for-go, zero google.golang.org/api,
        #     zero cloud.google.com/go except compute/metadata (OAuth2 ADC helper
        #     legitimately pulled by provider/gcp's service-account auth).
        run: bash scripts/audit-cloud-symbols.sh --check
      - name: Standalone asymmetric gate — `go list -deps` (mirrors audit script)
        # Independent assertion of the same invariant for clarity in CI failure logs.
        # Any cloud.google.com/go path other than compute/metadata fails the build.
        env:
          GOWORK: "off"
        run: |
          set +e
          DEPS=$(go list -deps ./... 2>&1)
          LIST_EXIT=$?
          set -e
          if [ "$LIST_EXIT" -ne 0 ]; then
            echo "FAIL: \`go list -deps ./...\` exited $LIST_EXIT (gate cannot enforce):"
            echo "$DEPS" | head -10 | sed 's/^/  /'
            exit 1
          fi
          # `|| true` on grep is fine: exit 1 from grep means "no matches" = success.
          UNEXPECTED=$(echo "$DEPS" \
            | grep -E '^(cloud\.google\.com/go|google\.golang\.org/api|github\.com/Azure/azure-sdk-for-go)' \
            | grep -v '^cloud\.google\.com/go/compute/metadata$' \
            || true)
          if [ -n "$UNEXPECTED" ]; then
            echo "FAIL: unexpected gcp/azure/api transitive deps in workflow-core build graph:"
            while IFS= read -r dep; do
              printf '  %s\n' "$dep"
            done <<< "$UNEXPECTED"
            echo
            echo "Only cloud.google.com/go/compute/metadata is allowlisted (OAuth2 ADC helper)."
            echo "Other gcp/azure SDK packages belong in a plugin, not workflow core."
            echo "See docs/migrations/2026-05-15-plugin-modules-on-iac.md (Phase C)."
            exit 1
          fi

  aws-sdk-banned:
    name: Verify removed AWS SDK packages are not imported (issue #653)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
      - name: Grep gate — no *.go file (repo-wide) may import fully-removed AWS service packages
        # Scans the whole repo. service/eks is allowed only in provider/ (ECS/EKS deploy pipeline).
        # platform/providers/aws/ was deleted in Phase 3; provider/aws/ (deploy pipeline) is kept.
        run: |
          ! grep -rn --include="*.go" \
              --exclude-dir=_worktrees \
              --exclude-dir=.worktrees \
              --exclude-dir=.claude \
              --exclude="aws_absent_test.go" \
              --exclude="nosql_dynamodb.go" \
              -e "aws-sdk-go-v2/service/apigatewayv2" \
              -e "aws-sdk-go-v2/service/applicationautoscaling" \
              -e "aws-sdk-go-v2/service/route53" \
              -e "aws-sdk-go-v2/service/codebuild" \
              -e "aws-sdk-go-v2/service/ec2" \
              -e "aws-sdk-go-v2/service/dynamodb" \
              -e "aws-sdk-go-v2/service/elasticloadbalancingv2" \
              -e "aws-sdk-go-v2/service/rds" \
              -e "aws-sdk-go-v2/service/sqs" \
              .
      - name: Grep gate — service/eks must only appear in provider/ (deploy pipeline)
        # platform/providers/aws/ was deleted in Phase 3; only provider/aws/ legitimately uses
        # service/eks for ECS/EKS deploy pipeline. Any new import outside provider/ is a regression.
        run: |
          ! grep -rn --include="*.go" \
              --exclude-dir=_worktrees \
              --exclude-dir=.worktrees \
              --exclude-dir=.claude \
              --exclude="aws_absent_test.go" \
              --exclude-dir="provider" \
              -e "aws-sdk-go-v2/service/eks" \
              .
      - name: Grep gate — go.mod files must not list removed AWS SDK packages
        # service/eks is intentionally omitted from this go.mod gate: provider/aws/ (deploy
        # pipeline) has a legitimate caller. ec2/dynamodb/elb/rds/sqs are added here because
        # platform/providers/aws/ (their only consumer) was deleted in Phase 3.
        run: |
          ! grep -qH \
              -e "aws-sdk-go-v2/service/apigatewayv2" \
              -e "aws-sdk-go-v2/service/applicationautoscaling" \
              -e "aws-sdk-go-v2/service/route53" \
              -e "aws-sdk-go-v2/service/ec2" \
              -e "aws-sdk-go-v2/service/dynamodb" \
              -e "aws-sdk-go-v2/service/elasticloadbalancingv2" \
              -e "aws-sdk-go-v2/service/rds" \
              -e "aws-sdk-go-v2/service/sqs" \
              go.mod example/go.mod