ci.yml

name: CI

on:
  pull_request:
    branches:
      - main
      - next
  push:
    branches:
      - main
      - next

permissions:
  contents: read

# Cancel the superseded run on every PR push; main pushes always run to completion.
concurrency:
  group: ci-${{ github.event.pull_request.number || github.run_id }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

env:
  XCODE_VERSION: 26.6

jobs:
  audit-release-state:
    name: Audit Release Branch State
    runs-on: ubuntu-latest
    permissions:
      contents: read
      issues: read
      pull-requests: read
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          # A PR's merge commit and its base, for the release note audit.
          fetch-depth: 2
          persist-credentials: false

      - name: Setup Node
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
        with:
          node-version: 20

      - name: Audit repository layout
        run: npm run audit:layout

      - name: Reject prerelease metadata on main
        run: node scripts/release-branch-policy.mjs audit

      - name: Require a release note for published source changes
        if: github.event_name == 'pull_request' && github.base_ref == 'main'
        env:
          GH_TOKEN: ${{ github.token }}
          PR_NUMBER: ${{ github.event.pull_request.number }}
        run: |
          # Read labels now, not from the event, so a re-run sees one added later.
          LABELS=$(gh api "repos/$GITHUB_REPOSITORY/issues/$PR_NUMBER/labels" --jq '.[].name')
          if grep -qxF '፦ refactor' <<<"$LABELS"; then
            echo "Release note audit skipped: the PR is labeled ፦ refactor."
            exit 0
          fi
          node scripts/audit-release-notes.mjs HEAD^1

      - name: Setup Bun
        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
        with:
          bun-version: 1.3.13

      - name: Install release test dependencies
        run: bun install --frozen-lockfile --filter openiap-monorepo --ignore-scripts

      - name: Test release automation
        run: >-
          node --test scripts/release-branch-policy.test.mjs
          scripts/audit-release-notes.test.mjs
          scripts/release-openiap.test.mjs
          scripts/audit-release-sync-script.test.mjs
          scripts/npm-publish-authorization.test.mjs
          scripts/verify-npm-release-provenance.test.mjs
          scripts/generate-sbom.test.mjs
          scripts/xml-document.test.mjs

      - name: Audit the release sync script
        run: node scripts/audit-release-sync-script.mjs

      - name: Test Gradle network retry helper
        run: node --test scripts/ci/retry-gradle.test.mjs

  # The test jobs below install with --frozen-lockfile but only run when
  # their path filters match, so a workspace package.json change outside
  # those paths can land with a stale bun.lock. Run the check on every CI
  # run to catch lockfile drift regardless of which paths changed.
  audit-lockfile:
    name: Audit Lockfile Sync
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          persist-credentials: false

      - name: Validate Gradle wrappers
        uses: gradle/actions/wrapper-validation@9c971963bec38e04b3d30dcc455b5382be2fdbfb # v6
        with:
          min-wrapper-count: 7

      - name: Setup Bun
        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
        with:
          bun-version: 1.3.13

      - name: Setup Ruby
        uses: ruby/setup-ruby@14594264cd68ce8a2345dd349bc3d138a4ef85c8 # v1
        with:
          ruby-version: "3.3"
          working-directory: libraries/react-native-iap/example

      - name: Verify bun.lock matches workspace manifests
        run: |
          # Retry bun install up to 3 times to handle transient registry errors
          for i in 1 2 3; do
            bun install --frozen-lockfile && break
            [ $i -eq 3 ] && exit 1
            echo "Attempt $i failed. Retrying..."
            sleep 5
          done

      # This job installs with bun, which accepts an override that npm refuses.
      # Without this step a manifest can ship that breaks every npm and npx
      # command in the repository root.
      - name: Audit npm override compatibility
        run: bun run audit:overrides

      # security/SBOM.md restates the releasable component list for readers.
      # Without this the copy drifts, which is how commerce-protocol shipped an
      # SBOM artifact while the documented matrix said it did not exist.
      - name: Audit SBOM documentation
        run: bun run audit:sbom-docs

      # The godot-iap addon ships prebuilt iOS/macOS frameworks pinned in
      # prebuilt-binaries.sha256. The release gates on the same audit; this
      # re-runs it here so a tampered binary fails on the PR, not at release.
      - name: Audit Godot binary digests
        run: bun run audit:godot-binaries

      - name: Verify independent Bun locks
        run: |
          for directory in \
            libraries/expo-iap \
            libraries/expo-iap/example \
            libraries/expo-iap/example/vega \
            libraries/react-native-iap/example/vega \
            scripts/agent; do
            (cd "$directory" && bun install --frozen-lockfile --ignore-scripts)
          done

      - name: Verify Yarn lock
        working-directory: libraries/react-native-iap
        run: corepack yarn install --immutable --mode=skip-build

      - name: Verify Ruby lock
        working-directory: libraries/react-native-iap/example
        run: BUNDLE_FROZEN=true bundle install

      - name: Test dependency and workflow guards
        run: >-
          node --test scripts/audit-security.test.mjs
          scripts/bun-dependency-snapshot.test.mjs

      - name: Audit workflow security
        run: node scripts/audit-security.mjs workflows

      - name: Install OSV-Scanner v2.5.0
        run: |
          scripts/install-security-tool.sh osv-scanner "$RUNNER_TEMP/osv-scanner"
          echo "$RUNNER_TEMP" >> "$GITHUB_PATH"

      - name: Audit dependency vulnerabilities and exception lifecycle
        run: node scripts/audit-security.mjs dependencies

      - name: Audit all tracked dependency locks with OSV
        run: |
          osv-scanner scan source \
            --lockfile=bun.lock \
            --lockfile=libraries/expo-iap/bun.lock \
            --lockfile=libraries/expo-iap/example/bun.lock \
            --lockfile=libraries/expo-iap/example/vega/bun.lock \
            --lockfile=libraries/react-native-iap/example/vega/bun.lock \
            --lockfile=libraries/react-native-iap/example/Gemfile.lock \
            --lockfile=libraries/react-native-iap/yarn.lock \
            --lockfile=scripts/agent/bun.lock

  # Detect which packages have changes
  changes:
    name: Detect Changes
    runs-on: ubuntu-latest
    outputs:
      gql: ${{ steps.filter.outputs.gql }}
      android: ${{ steps.filter.outputs.android }}
      ios: ${{ steps.filter.outputs.ios }}
      docs: ${{ steps.filter.outputs.docs }}
      web: ${{ steps.filter.outputs.web }}
      cli: ${{ steps.filter.outputs.cli }}
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          persist-credentials: false

      - name: Check for changes
        uses: dorny/paths-filter@ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d # v4
        id: filter
        with:
          # Without this, '!' patterns are OR-ed positives that match nearly everything.
          predicate-quantifier: some-with-excludes
          filters: |
            gql:
              - '.github/workflows/release-openiap.yml'
              - 'specs/client/**'
              - 'packages/conformance/**'
              - 'scripts/**'
              - 'package.json'
              - 'bun.lock'
              - 'openiap-versions.json'
              - '.github/workflows/ci.yml'
              - 'libraries/maui-iap/src/OpenIap.Maui/Types.cs'
              - '!**/*.md'
            android:
              - 'packages/google/**'
              - 'specs/client/**'
              - 'scripts/**'
              - 'openiap-versions.json'
              - '.github/workflows/ci.yml'
              - '!**/*.md'
            ios:
              - 'packages/apple/**'
              - 'specs/client/**'
              - 'scripts/**'
              - 'openiap-versions.json'
              - '.github/workflows/ci.yml'
              - '!**/*.md'
            docs:
              - 'packages/docs/**'
              - 'specs/client/src/generated/**'
              - 'specs/client/generated-sync-manifest.mjs'
              # The docs link to the canonical contract and audit its derived
              # transport constants, so every protocol change must run this job.
              - 'specs/commerce-protocol/**'
              - 'scripts/audit-docs.ts'
              - 'scripts/audit-docs.test.ts'
              - '.github/workflows/ci.yml'
            web:
              - 'packages/docs/**'
              - 'packages/kit/**'
              # The kit server embeds the generated protocol artifacts at build
              # time, so a spec change must rebuild and probe the binary.
              - 'specs/commerce-protocol/**'
              - 'scripts/e2e-web-sites.mjs'
              - 'scripts/audit-commerce-evidence.mjs'
              - 'scripts/audit-commerce-evidence.test.mjs'
              - 'package.json'
              - 'bun.lock'
              - '.github/workflows/ci.yml'
            cli:
              # The suite reads packages/cli/README.md as a contract input, so
              # a README edit has to run it.
              - 'packages/cli/**'
              - 'packages/docs/community-touchpoints.json'
              - 'scripts/release-openiap.mjs'
              - 'scripts/release-openiap.test.mjs'
              - 'scripts/release-branch-policy.mjs'
              - '.github/workflows/release-openiap.yml'
              - '.github/workflows/ci.yml'
              - 'bun.lock'
  test-cli:
    name: Test CLI
    needs: changes
    if: needs.changes.outputs.cli == 'true'
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          persist-credentials: false

      # Exercise the oldest supported Node version.
      - name: Setup Node
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
        with:
          node-version: 20

      - name: Setup Bun
        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
        with:
          bun-version: 1.3.13

      - name: Install CLI dependencies
        run: bun install --frozen-lockfile --filter @hyodotdev/openiap --ignore-scripts

      - name: Run CLI tests
        working-directory: packages/cli
        run: npm test

      # The repository-wide bin/ rule would stop `git add` from tracking the
      # executable at all, so it would be missing from a publish checkout.
      - name: The published tarball carries the executable
        working-directory: packages/cli
        run: |
          npm pack --dry-run --json > pack.json
          node -e "
            const [{files}] = require('./pack.json');
            if (!files.some((one) => one.path === 'bin/openiap.mjs')) {
              throw new Error('bin/openiap.mjs is not in the tarball');
            }
          "
          rm pack.json

      - name: The executable loads
        run: node packages/cli/bin/openiap.mjs --help

      - name: The doctor exits 1 on a project it proves is broken
        run: |
          mkdir -p /tmp/doctor-fixture/android/app
          printf 'openiapStore=play\n' \
            > /tmp/doctor-fixture/android/gradle.properties
          printf 'missingDimensionStrategy "platform", "horizon"\n' \
            > /tmp/doctor-fixture/android/app/build.gradle
          if node packages/cli/bin/openiap.mjs doctor /tmp/doctor-fixture; then
            echo "expected a non-zero exit for a mismatched flavor" >&2
            exit 1
          fi

  test-commerce-protocol:
    name: Test Commerce Protocol
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          persist-credentials: false

      - name: Setup Bun
        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
        with:
          bun-version: 1.3.13

      - name: Install dependencies
        run: |
          for i in 1 2 3; do
            bun install --frozen-lockfile && break
            [ $i -eq 3 ] && exit 1
            echo "Attempt $i failed. Retrying..."
            sleep 5
          done

      # Compiles the canonical SDL and byte-compares every generated artifact,
      # so an SDL edit that was not rebuilt cannot ship stale validators.
      - name: Run spec suite
        working-directory: specs/commerce-protocol
        run: bun run test

      - name: Verify IAPKit conformance
        working-directory: packages/kit
        # The payload conformance proof plus the dual-binding runner pass over
        # the real REST and GraphQL adapters.
        run: bunx vitest run convex/commerce/spec.conformance.test.ts server/api/commerce/

  test-conformance:
    name: Test Conformance Suite
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          persist-credentials: false

      - name: Setup Bun
        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
        with:
          bun-version: 1.3.13

      - name: Install dependencies
        run: |
          for i in 1 2 3; do
            bun install --frozen-lockfile && break
            [ $i -eq 3 ] && exit 1
            echo "Attempt $i failed. Retrying..."
            sleep 5
          done

      - name: Run conformance suite tests
        working-directory: packages/conformance
        run: bun run test

      - name: Verify cross-language behavior ids are in sync
        run: node packages/conformance/scripts/generate-behavior-ids.mjs --check

      - name: Reference conformance report
        run: node packages/conformance/scripts/run-reference-report.mjs

      - name: Ecosystem coverage report
        run: |
          node packages/conformance/scripts/coverage-report.mjs
          node packages/conformance/scripts/coverage-report.mjs --json > conformance-coverage.json
          node packages/conformance/scripts/run-reference-report.mjs --json > conformance-report.json

      - name: Upload conformance report
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: conformance-report
          path: |
            conformance-report.json
            conformance-coverage.json
          if-no-files-found: error

  audit-parity:
    name: Audit SDK Parity
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          persist-credentials: false

      - name: Setup Node
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
        with:
          node-version: 20

      - name: Setup Bun
        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
        with:
          bun-version: 1.3.13

      - name: Install parity audit dependencies
        run: |
          # The root parity scripts use root devDependencies (for example,
          # TypeScript) as well as client-spec workspace tooling. Install both scopes
          # so Node can resolve them without installing unrelated workspaces.
          for i in 1 2 3; do
            bun install --frozen-lockfile \
              --filter openiap-monorepo \
              --filter @hyodotdev/openiap-client-protocol && break
            [ $i -eq 3 ] && exit 1
            echo "Attempt $i failed. Retrying..."
            sleep 5
          done

      - name: Test clean-worktree drift guard
        run: node --test scripts/assert-clean-worktree.test.mjs

      - name: Test review-thread listing
        run: node --test scripts/list-review-threads.test.mjs

      - name: Test review-automation comment sweep
        run: node --test scripts/delete-review-automation-comments.test.mjs

      - name: Test pull request guard
        run: node --test scripts/guard-pull-request.test.mjs

      - name: Sync generated version files
        run: ./scripts/sync-versions.sh

      - name: Verify version and generated synchronization is committed
        run: node scripts/assert-clean-worktree.mjs

      - name: Test community touchpoint audit
        run: node --test scripts/audit-community-touchpoints.test.mjs

      - name: Run non-Godot SDK parity audit
        run: node scripts/audit-non-godot-parity.mjs

      # Unconditional: kit and the spec deploy on separate workflows.
      - name: Test IAPKit spec contract audit
        run: node --test scripts/audit-kit-spec-contract.test.mjs

      - name: Run IAPKit spec contract audit
        run: node scripts/audit-kit-spec-contract.mjs

      - name: Audit CI path filters
        run: npm run audit:ci-paths

      - name: Audit declared facts
        run: npm run audit:facts

      - name: Audit research references
        run: npm run audit:research

      - name: Audit whitepaper freshness
        run: npm run audit:whitepaper

      - name: Test issue-mining script
        run: node --test scripts/mine-iap-issues.test.mjs

      - name: Audit agent surfaces
        run: npm run audit:agents

      - name: Audit sponsor surfaces
        run: npm run audit:sponsors

      - name: Audit orphan release tags
        run: npm run audit:orphan-tags

  test-gql:
    name: Test OpenIAP Client Spec
    runs-on: ubuntu-latest
    needs: changes
    if: needs.changes.outputs.gql == 'true'
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          persist-credentials: false
          # Full history so the schema semver audit compares against the
          # merge base, not the moving base-branch tip.
          fetch-depth: 0

      - name: Setup Bun
        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
        with:
          bun-version: 1.3.13

      - name: Install dependencies
        run: |
          # Retry bun install up to 3 times to handle transient registry errors
          for i in 1 2 3; do
            bun install --frozen-lockfile && break
            [ $i -eq 3 ] && exit 1
            echo "Attempt $i failed. Retrying..."
            sleep 5
          done

      - name: Generate types
        working-directory: specs/client
        run: bun run generate

      - name: Run tests
        working-directory: specs/client
        run: bun run test

      # Breaking-change guard for the schema (knowledge/research backlog R1).
      # PR-only: after merge the base comparison is no longer actionable.
      - name: Audit schema semver claims
        if: github.event_name == 'pull_request'
        working-directory: specs/client
        env:
          BASE_REF: ${{ github.event.pull_request.base.ref }}
        run: bun run audit:schema-semver -- --base "origin/$BASE_REF"

      - name: Verify generated types are committed (no drift)
        run: node scripts/assert-clean-worktree.mjs

  # test-gql owns client-spec regeneration, platform sync, and worktree drift
  # check. Consumer jobs compile the committed copies instead of invoking a
  # second generator path.
  test-android:
    name: Test Android
    runs-on: ubuntu-latest
    needs: changes
    if: needs.changes.outputs.android == 'true'
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          persist-credentials: false

      - name: Setup Java
        uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6.0.1
        with:
          distribution: "temurin"
          java-version: "17"

      - name: Grant execute permission
        working-directory: packages/google
        run: chmod +x gradlew

      - name: Run tests
        working-directory: packages/google
        run: |
          "$GITHUB_WORKSPACE/scripts/ci/retry-gradle.sh" ./gradlew :openiap:test

      - name: Build Play flavor
        working-directory: packages/google
        run: |
          "$GITHUB_WORKSPACE/scripts/ci/retry-gradle.sh" ./gradlew :openiap:assemblePlayDebug

      - name: Build Horizon flavor
        working-directory: packages/google
        run: |
          "$GITHUB_WORKSPACE/scripts/ci/retry-gradle.sh" ./gradlew :openiap:assembleHorizonDebug

      # The audit checks that the Example declares the app id; only the merged
      # manifest shows what the build actually resolved it to. Without this a
      # blank or missing property merges an empty value, which compiles and
      # installs and then throws inside startConnection on a headset.
      - name: Verify Horizon app id resolves in the merged manifest
        working-directory: packages/google
        run: |
          "$GITHUB_WORKSPACE/scripts/ci/retry-gradle.sh" ./gradlew :Example:processHorizonDebugManifest
          node "$GITHUB_WORKSPACE/scripts/verify-horizon-merged-manifest.mjs" \
            Example/build/intermediates/merged_manifests/horizonDebug/processHorizonDebugManifest/AndroidManifest.xml

      - name: Build Fire OS flavor
        working-directory: packages/google
        run: |
          "$GITHUB_WORKSPACE/scripts/ci/retry-gradle.sh" ./gradlew :openiap:assembleAmazonDebug

      - name: Verify Kotlin 2.1 consumer compatibility
        working-directory: packages/google
        run: bash scripts/verify-kotlin-2.1-consumer.sh

      # A wrong store is invisible until the artifact reaches a device, so the
      # selection rule is asserted here rather than on hardware.
      - name: Verify the store resolver
        working-directory: packages/google
        run: bash scripts/verify-store-resolver.sh

      # The plugin carries that rule to apps linking the published artifacts.
      - name: Verify the store plugin
        working-directory: packages/google
        run: bash scripts/verify-store-plugin.sh

      # Nothing above runs R8; an app's release build does.
      - name: Verify minified release builds per store
        working-directory: packages/google
        run: bash scripts/verify-release-consumer.sh

      # Run every store flavor so flavor-specific API-23 regressions cannot
      # bypass lint coverage.
      - name: Lint Android API compatibility
        working-directory: packages/google
        run: |
          "$GITHUB_WORKSPACE/scripts/ci/retry-gradle.sh" ./gradlew \
            :openiap:lintPlayDebug \
            :openiap:lintHorizonDebug \
            :openiap:lintAmazonDebug

  test-ios:
    name: Test iOS
    needs: changes
    if: needs.changes.outputs.ios == 'true'
    runs-on: macos-26
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          persist-credentials: false

      - name: Set up Xcode
        uses: maxim-lobanov/setup-xcode@ed7a3b1fda3918c0306d1b724322adc0b8cc0a90 # v1
        with:
          xcode-version: ${{ env.XCODE_VERSION }}

      - name: Build
        working-directory: packages/apple
        run: swift build

      - name: Run tests
        working-directory: packages/apple
        run: swift test

  test-ios-compiler-boundaries:
    name: Build iOS guard boundary (Xcode ${{ matrix.xcode-version }})
    needs: changes
    if: needs.changes.outputs.ios == 'true'
    strategy:
      fail-fast: false
      matrix:
        include:
          - runner: macos-15
            xcode-version: "16.3"
          - runner: macos-26
            xcode-version: "26.0.1"
          - runner: macos-26
            xcode-version: "26.4.1"
    runs-on: ${{ matrix.runner }}
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          persist-credentials: false

      - name: Set up Xcode
        uses: maxim-lobanov/setup-xcode@ed7a3b1fda3918c0306d1b724322adc0b8cc0a90 # v1
        with:
          xcode-version: ${{ matrix.xcode-version }}

      - name: Build in Swift 5 language mode
        working-directory: packages/apple
        run: swift build -Xswiftc -swift-version -Xswiftc 5

  test-docs:
    name: Test Docs
    runs-on: ubuntu-latest
    needs: changes
    if: needs.changes.outputs.docs == 'true'
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          persist-credentials: false

      - name: Setup Bun
        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
        with:
          bun-version: 1.3.13

      - name: Install dependencies
        run: |
          # Retry bun install up to 3 times to handle transient registry errors
          for i in 1 2 3; do
            bun install --frozen-lockfile && break
            [ $i -eq 3 ] && exit 1
            echo "Attempt $i failed. Retrying..."
            sleep 5
          done

      - name: Type check
        working-directory: packages/docs
        run: bun run typecheck

      - name: Audit docs consistency
        run: |
          bun test scripts/audit-docs.test.ts
          bun run audit:docs

      - name: Check static discovery guards
        working-directory: packages/docs
        run: bun run test:discoverability

      - name: Lint
        working-directory: packages/docs
        run: bun run lint

      - name: Format check
        working-directory: packages/docs
        run: bunx prettier --check "src/**/*.{ts,tsx,css}"

      - name: Build
        working-directory: packages/docs
        run: bun run build

  web-e2e:
    name: Web E2E Quality
    runs-on: ubuntu-latest
    needs: changes
    if: needs.changes.outputs.web == 'true'
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          persist-credentials: false

      - name: Setup Bun
        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
        with:
          bun-version: 1.3.13

      - name: Install dependencies
        run: |
          # Retry bun install up to 3 times to handle transient registry errors
          for i in 1 2 3; do
            bun install --frozen-lockfile && break
            [ $i -eq 3 ] && exit 1
            echo "Attempt $i failed. Retrying..."
            sleep 5
          done

      - name: Install Playwright chromium
        # `--with-deps` runs apt, which fails whenever Google's Chrome
        # repository serves a stale index. Playwright downloads its own
        # chromium, so drop that source first: nothing here needs it.
        run: |
          sudo rm -f /etc/apt/sources.list.d/google-chrome.list \
            /etc/apt/sources.list.d/google-chrome.sources
          bunx playwright install --with-deps chromium

      - name: Build docs site
        working-directory: packages/docs
        run: bun run build

      - name: Build IAPKit site and server
        working-directory: packages/kit
        env:
          VITE_KIT_CONVEX_URL: https://placeholder-build-1.convex.cloud
        run: bun run build:all

      - name: Test the Commerce evidence audit
        run: bun test ./scripts/audit-commerce-evidence.test.mjs

      - name: Report Commerce evidence freshness
        # Advisory: the recorded IAPKit interop stays valid for its recorded
        # revision; drift only means the guide shows older sources than main.
        continue-on-error: true
        run: bun run audit:commerce-evidence

      - name: Run docs and IAPKit web E2E
        env:
          WEB_E2E_DOCS_BASE_URL: http://127.0.0.1:4173
          WEB_E2E_KIT_BASE_URL: http://127.0.0.1:4174
        run: |
          (cd packages/docs && bunx vite preview --host 127.0.0.1 --port 4173) &
          docs_pid=$!
          (cd packages/kit && CONVEX_URL=https://placeholder-build-1.convex.cloud STATIC_ROOT=dist PORT=4174 ./openiap-kit-server) &
          kit_pid=$!
          cleanup() {
            kill "$docs_pid" "$kit_pid" 2>/dev/null || true
          }
          trap cleanup EXIT
          for url in http://127.0.0.1:4173 http://127.0.0.1:4174; do
            for attempt in $(seq 1 60); do
              if curl -fsS "$url" >/dev/null; then
                break
              fi
              if [ "$attempt" -eq 60 ]; then
                echo "::error::$url did not become ready"
                exit 1
              fi
              sleep 1
            done
          done
          bun run e2e:web

  test-agent:
    name: Test Agent Scripts
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          persist-credentials: false

      - name: Setup Bun
        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
        with:
          bun-version: 1.3.13

      - name: Install dependencies
        working-directory: scripts/agent
        run: |
          # Retry bun install up to 3 times to handle transient registry errors
          for i in 1 2 3; do
            bun install --frozen-lockfile && break
            [ $i -eq 3 ] && exit 1
            echo "Attempt $i failed. Retrying..."
            sleep 5
          done

      - name: Type check
        working-directory: scripts/agent
        run: bun run typecheck

      - name: Run tests
        working-directory: scripts/agent
        run: bun test

      - name: Compile generated agent context
        working-directory: scripts/agent
        run: bun run compile:ai

      - name: Verify compiled agent context is committed
        run: node scripts/assert-clean-worktree.mjs