ci.yml

name: CI

on:
  push:
    branches: ["main", "codex/**"]
  pull_request:

concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true

permissions:
  contents: read

env:
  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
  MODEL_URL: https://github.com/thedavidweng/openkara-models/releases/download/model-v2.0.1/htdemucs.onnx
  MODEL_SHA256: 8fa3dab679c59aeb049dd229f57a212c9339b3fc17ebf50541daad9e799364a1

jobs:
  prepare-model:
    name: Prepare separation model
    runs-on: ubuntu-24.04
    timeout-minutes: 10

    steps:
      - name: Checkout
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false

      - name: Setup Node.js
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version: 24
          package-manager-cache: false

      - name: Restore separation model cache
        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
        with:
          path: src-tauri/models/htdemucs.onnx
          key: separation-model-${{ env.MODEL_SHA256 }}
          enableCrossOsArchive: true

      - name: Download and verify separation model
        run: |
          if echo "$MODEL_SHA256  src-tauri/models/htdemucs.onnx" | sha256sum -c --status 2>/dev/null; then
            echo "Model already present and verified"
            exit 0
          fi
          mkdir -p src-tauri/models
          curl -L --fail "$MODEL_URL" -o src-tauri/models/htdemucs.onnx
          echo "$MODEL_SHA256  src-tauri/models/htdemucs.onnx" | sha256sum -c

      - name: Upload separation model
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: separation-model
          path: src-tauri/models/htdemucs.onnx
          if-no-files-found: error
          retention-days: 1

  conventional-commits:
    name: Conventional commits
    if: github.event_name == 'pull_request'
    runs-on: ubuntu-24.04
    timeout-minutes: 5

    steps:
      - name: Enforce conventional PR title
        uses: amannn/action-semantic-pull-request@48f256284bd46cdaab1048c3721360e808335d50 # v6.1.1
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  cargo-deny:
    name: Cargo deny
    runs-on: ubuntu-24.04
    timeout-minutes: 10

    steps:
      - name: Checkout
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false

      - name: Check Rust dependencies
        uses: EmbarkStudios/cargo-deny-action@bb137d7af7e4fb67e5f82a49c4fce4fad40782fe # v2.0.20
        with:
          manifest-path: src-tauri/Cargo.toml

  workflow-lint:
    name: Workflow lint
    runs-on: ubuntu-24.04
    timeout-minutes: 5

    permissions:
      contents: read
      security-events: write # Needed by zizmor-action to upload SARIF results.

    steps:
      - name: Checkout
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false

      - name: actionlint
        uses: reviewdog/action-actionlint@6fb7acc99f4a1008869fa8a0f09cfca740837d9d # v1.72.0
        with:
          actionlint_flags: ""

      - name: zizmor
        uses: zizmorcore/zizmor-action@192e21d79ab29983730a13d1382995c2307fbcaa # v0.5.7
        with:
          persona: pedantic
          min-severity: low

  frontend:
    name: Frontend quality / build / test
    runs-on: ubuntu-24.04
    timeout-minutes: 15

    permissions:
      contents: read
      pull-requests: write # Needed by vitest-coverage-report-action to comment coverage on PRs.

    steps:
      - name: Checkout
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false

      - name: Setup pnpm
        uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
        with:
          version: 11.13.0

      - name: Setup Node.js
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version: 24
          cache: pnpm
          cache-dependency-path: pnpm-lock.yaml

      - name: Install JavaScript dependencies
        run: pnpm install --frozen-lockfile

      - name: Audit dependencies
        run: pnpm audit --audit-level=high

      - name: Verify formatting
        run: node --run format

      - name: Lint frontend
        run: node --run lint

      - name: Check i18n keys
        run: node --run check:i18n

      - name: Check db-schema drift
        run: |
          pnpm generate:db-schema
          git diff --exit-code docs/references/generated/db-schema.md

      - name: knip (unused exports / dependencies)
        run: pnpm knip --no-progress

      - name: Build frontend
        run: node --run build

      - name: Typecheck landing page
        run: pnpm tsc --noEmit --project website/tsconfig.json

      - name: Build landing page
        run: node --run docs:build

      - name: Typecheck with tsgo
        run: pnpm tsgo --noEmit --project tsconfig.json
        continue-on-error: true

      - name: Run frontend tests with coverage
        run: node --run test -- --coverage --reporter=junit --outputFile=test-results.junit.xml

      - name: Upload test results to Codecov
        if: always()
        uses: codecov/test-results-action@0fa95f0e1eeaafde2c782583b36b28ad0d8c77d3 # v1
        with:
          token: ${{ secrets.CODECOV_TOKEN }}
          fail_ci_if_error: false

      - name: Test metrics summary
        if: always()
        run: |
          {
            echo "## Frontend Test Metrics"
            echo ""

            # Parse coverage from json-summary if available
            if [ -f coverage/coverage-summary.json ]; then
              BRANCHES=$(jq '.total.branches.pct' coverage/coverage-summary.json)
              FUNCTIONS=$(jq '.total.functions.pct' coverage/coverage-summary.json)
              LINES=$(jq '.total.lines.pct' coverage/coverage-summary.json)
              STATEMENTS=$(jq '.total.statements.pct' coverage/coverage-summary.json)

              echo "### Coverage"
              echo "| Metric | Percentage |"
              echo "|--------|------------|"
              echo "| Branches | ${BRANCHES}% |"
              echo "| Functions | ${FUNCTIONS}% |"
              echo "| Lines | ${LINES}% |"
              echo "| Statements | ${STATEMENTS}% |"
              echo ""
            fi
          } >> "$GITHUB_STEP_SUMMARY"

      - name: Upload coverage reports
        if: always()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: frontend-coverage
          path: coverage/
          retention-days: 14

      - name: Report coverage on PR
        if: always() && github.event_name == 'pull_request'
        uses: davelosert/vitest-coverage-report-action@02f3c2e641286b7fa308cd3e430783103ce6103b # v2.12.0
        with:
          json-summary-path: ./coverage/coverage-summary.json
          vite-config-path: ./vite.config.ts

      - name: Upload coverage to Codecov
        if: always()
        uses: codecov/codecov-action@0fb7174895f61a3b6b78fc075e0cd60383518dac # v5.5.5
        with:
          token: ${{ secrets.CODECOV_TOKEN }}
          directory: coverage
          flags: frontend
          fail_ci_if_error: false

  dependency-checks:
    name: Dependency surface checks
    runs-on: ubuntu-24.04
    timeout-minutes: 10

    steps:
      - name: Checkout
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false

      - name: Setup Rust
        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 # v1
        with:
          toolchain: stable

      - name: cargo-shear (unused Cargo dependencies)
        working-directory: src-tauri
        run: |
          cargo install cargo-shear --version 1.12.4 --locked
          cargo shear --deny-warnings --locked

  rust-test:
    name: Rust tests (${{ matrix.name }})
    runs-on: ${{ matrix.os }}
    timeout-minutes: 30
    needs: prepare-model
    strategy:
      fail-fast: false
      matrix:
        include:
          - name: macOS
            os: macos-14
            ort_target: aarch64-apple-darwin
          - name: Linux
            os: ubuntu-22.04
            ort_target: x86_64-unknown-linux-gnu

    steps:
      - name: Checkout
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false

      - name: Setup Node.js
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version: 24
          package-manager-cache: false

      - name: Verify Cargo is not broken
        if: runner.os == 'macOS'
        run: |
          if cargo --version 2>&1 | grep -qi "rustup-init"; then
            echo "Broken cargo detected, reinstalling toolchain..."
            rm -rf "$HOME/.cargo"
          fi

      - name: Setup Rust
        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 # v1
        with:
          toolchain: stable

      - name: Verify Rust toolchain (macOS)
        if: runner.os == 'macOS'
        run: |
          cargo --version
          rustc --version

      - name: Restore Rust cache
        uses: swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
        with:
          shared-key: ${{ github.workflow }}-${{ matrix.os }}-debug
          workspaces: ./src-tauri -> target
          cache-bin: false
          key: ${{ matrix.os }}-debug

      - name: Install Linux test dependencies
        if: runner.os == 'Linux'
        run: |
          sudo apt-get update
          sudo apt-get install -y \
            build-essential \
            curl \
            libasound2-dev \
            libayatana-appindicator3-dev \
            librsvg2-dev \
            libssl-dev \
            libwebkit2gtk-4.1-dev \
            libxdo-dev

      - name: Download separation model
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: separation-model
          path: src-tauri/models

      - name: Restore ONNX Runtime cache
        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
        with:
          path: src-tauri/generated/onnxruntime
          key: onnxruntime-${{ matrix.ort_target }}-${{ hashFiles('scripts/prepare-onnx-runtime.mjs') }}

      - name: Prepare ONNX Runtime
        env:
          ORT_TARGET: ${{ matrix.ort_target }}
        shell: bash
        run: node scripts/prepare-onnx-runtime.mjs --target "${ORT_TARGET}"

      - name: Verify Rust formatting
        working-directory: src-tauri
        run: cargo fmt --check

      - name: Clippy
        working-directory: src-tauri
        run: cargo clippy --all-targets -- -D warnings

      - name: Install nextest
        uses: taiki-e/install-action@7a562dfa955aa2e4d5b0fd6ebd57ff9715c07b0b # v2.73.0
        with:
          tool: nextest

      - name: Run Rust tests
        working-directory: src-tauri
        env:
          # Parallel rust-lld of many heavy Tauri integration-test binaries has
          # hit SIGBUS (Bus error) on GitHub Linux runners. Cap build jobs so
          # concurrent linkers do not collide under memory pressure.
          CARGO_BUILD_JOBS: "2"
        run: |
          if [ "$RUNNER_OS" = "Linux" ]; then
            cargo nextest run --no-fail-fast
          else
            # phase5_perf asserts fixed latency thresholds for fixture audio. GitHub's
            # macOS runners have noisy cold metadata probes; Linux remains the CI
            # baseline, while macOS still runs the functional Rust suite.
            cargo nextest run --no-fail-fast -E '!test(phase5_perf)'
          fi
        shell: bash

  rust-test-windows-compile:
    name: Rust tests (Windows compile)
    runs-on: windows-latest
    timeout-minutes: 30
    steps:
      - name: Checkout
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false

      - name: Setup Rust
        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 # v1
        with:
          toolchain: stable

      - name: Restore Rust cache
        uses: swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
        with:
          shared-key: ${{ github.workflow }}-windows-latest-debug
          workspaces: ./src-tauri -> target
          cache-bin: false
          key: windows-latest-debug

      - name: Restore ONNX Runtime cache
        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
        with:
          path: src-tauri/generated/onnxruntime
          key: onnxruntime-x86_64-pc-windows-msvc-${{ hashFiles('scripts/prepare-onnx-runtime.mjs') }}

      - name: Prepare ONNX Runtime
        run: node scripts/prepare-onnx-runtime.mjs --target x86_64-pc-windows-msvc

      - name: Compile test binaries only
        working-directory: src-tauri
        run: cargo test -q --no-run

      - name: Verify execution-provider platform contract
        working-directory: src-tauri
        shell: pwsh
        run: |
          $env:PATH = "$env:GITHUB_WORKSPACE\src-tauri\generated\onnxruntime;$env:PATH"
          cargo test -q --lib execution_provider

  tauri-build:
    name: Tauri build (${{ matrix.name }})
    runs-on: ${{ matrix.os }}
    timeout-minutes: 60
    needs:
      - frontend
      - rust-test
      - cargo-deny
    strategy:
      fail-fast: false
      matrix:
        include:
          - name: macOS
            os: macos-14
            ort_target: aarch64-apple-darwin
          - name: Windows
            os: windows-latest
            ort_target: x86_64-pc-windows-msvc
          - name: Linux
            os: ubuntu-22.04
            ort_target: x86_64-unknown-linux-gnu

    steps:
      - name: Checkout
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false

      - name: Setup pnpm
        uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
        with:
          version: 11.13.0

      - name: Setup Node.js
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version: 24
          cache: pnpm
          cache-dependency-path: pnpm-lock.yaml

      - name: Verify Cargo is not broken
        if: runner.os == 'macOS'
        run: |
          # Some macOS runner images ship with a broken toolchain where
          # $HOME/.cargo/bin/cargo dispatches to rustup-init. Detect and
          # repair without a full reinstall every time.
          if cargo --version 2>&1 | grep -qi "rustup-init"; then
            echo "Broken cargo detected, reinstalling toolchain..."
            rm -rf "$HOME/.cargo"
          fi

      - name: Setup Rust
        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 # v1
        with:
          toolchain: stable

      - name: Repair toolchain if still broken
        if: runner.os == 'macOS'
        run: |
          # rustup can leave cargo pointing to rustup-init if the
          # proxy links got clobbered. Re-run the toolchain installer
          # so it repairs the bin symlinks.
          if cargo --version 2>&1 | grep -qi "rustup-init"; then
            rustup update stable --force
          fi

      - name: Restore Rust cache
        uses: swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
        with:
          shared-key: ${{ github.workflow }}-${{ matrix.os }}-release
          workspaces: ./src-tauri -> target
          cache-bin: false
          key: ${{ matrix.os }}-release

      - name: Install Linux build dependencies
        if: runner.os == 'Linux'
        run: |
          sudo apt-get update
          sudo apt-get install -y \
            build-essential \
            binutils \
            curl \
            file \
            patchelf \
            libasound2-dev \
            libayatana-appindicator3-dev \
            librsvg2-dev \
            libssl-dev \
            libwebkit2gtk-4.1-dev \
            libxdo-dev \
            wget

      - name: Install JavaScript dependencies
        run: pnpm install --frozen-lockfile

      - name: Audit dependencies
        run: pnpm audit --audit-level=high

      - name: Restore ONNX Runtime cache
        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
        with:
          path: src-tauri/generated/onnxruntime
          key: onnxruntime-${{ matrix.ort_target }}-${{ hashFiles('scripts/prepare-onnx-runtime.mjs') }}

      - name: Prepare ONNX Runtime
        env:
          ORT_TARGET: ${{ matrix.ort_target }}
        shell: bash
        run: node scripts/prepare-onnx-runtime.mjs --target "${ORT_TARGET}"

      - name: Validate Tauri build
        env:
          OPENKARA_GOOGLE_DRIVE_OAUTH_CLIENT_JSON: ${{ secrets.OPENKARA_GOOGLE_DRIVE_OAUTH_CLIENT_JSON }}
          OPENKARA_DROPBOX_APP_KEY: ${{ secrets.OPENKARA_DROPBOX_APP_KEY }}
          OPENKARA_DROPBOX_APP_SECRET: ${{ secrets.OPENKARA_DROPBOX_APP_SECRET }}
        run: |
          if [ "$RUNNER_OS" = "Linux" ]; then
            pnpm tauri build --ci --bundles deb
          else
            pnpm tauri build --debug --no-bundle --ci
          fi
        shell: bash

      - name: Verify Linux glibc floor
        if: runner.os == 'Linux'
        shell: bash
        run: |
          set -euo pipefail

          find_one() {
            local pattern="$1"
            find src-tauri/target/release -path "$pattern" -print -quit
          }

          max_glibc_version() {
            local binary="$1"
            # Exclude weak undefined symbols -- Rust's stdlib weak-imports
            # glibc helpers like pidfd_spawnp / pidfd_getpid that gracefully
            # fall back at runtime and do not create a hard dependency.
            # objdump -T flags field: "  w   DF" for weak, "      DF" for strong.
            objdump -T "$binary" \
              | awk '
                  /  w  .* \*UND\*/ { next }
                  match($0, /GLIBC_[0-9.]+/) {
                    print substr($0, RSTART + 6, RLENGTH - 6)
                  }
                ' \
              | sort -V \
              | tail -1
          }

          assert_glibc_floor() {
            local binary="$1"
            local max_version
            max_version="$(max_glibc_version "$binary")"
            if [ -z "$max_version" ]; then
              echo "No GLIBC symbols found in $binary"
              return
            fi

            echo "$binary: highest strong GLIBC requirement is $max_version"

            if [ "$(printf '%s\n%s\n' "$max_version" "2.35" | sort -V | tail -1)" != "2.35" ]; then
              echo "::error::$binary requires GLIBC_$max_version, which exceeds Ubuntu 22.04's GLIBC_2.35 baseline"
              objdump -T "$binary" | grep "GLIBC_$max_version" | head -5
              exit 1
            fi
          }

          app_binary="$(find_one '*/bundle/deb/*/usr/bin/openkara')"
          test -n "$app_binary"

          assert_glibc_floor "$app_binary"

  playwright-ui-smoke:
    name: Playwright UI smoke
    runs-on: ubuntu-24.04
    timeout-minutes: 15

    steps:
      - name: Checkout
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false

      - name: Setup pnpm
        uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
        with:
          version: 11.13.0

      - name: Setup Node.js
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version: 24
          cache: pnpm
          cache-dependency-path: pnpm-lock.yaml

      - name: Install JavaScript dependencies
        run: pnpm install --frozen-lockfile

      - name: Install Playwright browsers
        run: pnpm exec playwright install chromium webkit --with-deps

      - name: Run Playwright UI smoke tests
        run: node --run test:ui-smoke

      - name: Upload Playwright report
        if: always()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: playwright-report
          path: playwright-report/
          retention-days: 7