ci.yml

# Seeded from the socket-wheelhouse CI preset, then owned by this repo:
# edit it here. Fleet CI runs check + test through the LOCAL composite
# actions under .github/actions/, inlined, so there is no cross-repo
# reusable workflow and no first-party `uses:@sha`.
name: ⚡ CI

# PUSH, never pull_request. The fleet takes no outside contributions and
# lands on main directly, so a pull_request trigger adds no coverage a push
# trigger does not already give — and it is the fragile half: GitHub has
# narrowed pull_request defaults for security, and a silently non-firing
# trigger reads as a green repo with no CI at all.
on:
  push:
    branches: [main]
    tags: ['*']
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  # First step of every job is the third-party actions/checkout (GitHub fetches
  # it independently) to populate the workspace so the LOCAL `./.github/actions/*`
  # composites resolve. setup-and-install then re-checks-out — full history
  # (fetch-depth 0) in the check job, since the commit-history checks it runs
  # (AI-attribution, release-boundary) read the default branch's history and
  # refuse a shallow clone rather than false-green; the test matrix stays at
  # the default depth (25 — covers CI's other git operations) and runs the
  # zizmor Actions audit (its own `strategy.job-total < 2` skip runs it in the
  # non-matrix check job, skips it in the test matrix).
  check:
    name: 🔎 Check
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      # First step can't call the local ./.github/actions/fleet/checkout
      # composite (nothing checked out yet); bootstrap the workspace with an
      # inline git-fetch, matching release-reconcile.yml's pattern. The full
      # history this job needs comes from setup-and-install's own
      # checkout-fetch-depth: '0' re-checkout below, so this bootstrap fetch
      # stays shallow.
      - name: Bootstrap checkout
        shell: bash
        env:
          GITHUB_TOKEN: ${{ github.token }}
          SERVER_URL: ${{ github.server_url }}
          REPOSITORY: ${{ github.repository }}
          TRIGGER_REF: ${{ github.ref }}
        run: |
          set -euo pipefail
          git init -q
          git config --local advice.detachedHead false
          git remote remove origin 2>/dev/null || true
          git remote add origin "${SERVER_URL}/${REPOSITORY}"
          FETCH_ARGS=(--no-tags --prune --depth 1 origin "${TRIGGER_REF}")
          if [ -n "${GITHUB_TOKEN}" ]; then
            AUTH_B64="$(printf 'x-access-token:%s' "${GITHUB_TOKEN}" | base64 | tr -d '\n')"
            git -c "http.${SERVER_URL}/.extraheader=AUTHORIZATION: basic ${AUTH_B64}" fetch "${FETCH_ARGS[@]}"
          else
            git fetch "${FETCH_ARGS[@]}"
          fi
          git checkout -q --detach FETCH_HEAD
      - uses: ./.github/actions/fleet/setup-and-install
        with:
          # Authorizes a thin member's bundle download during install. Both
          # stay empty on a member with no payload App, which skips the mint.
          payload-token-client-id: ${{ vars.SOCKET_PAYLOAD_CLIENT_ID }}
          payload-token-private-key: ${{ secrets.SOCKET_PAYLOAD_APP_PRIVATE_KEY }}
          # Full history: the commit-history checks (AI-attribution,
          # release-boundary) read the default branch's history and refuse a
          # shallow clone rather than false-green.
          checkout-fetch-depth: '0'
          socket-api-token: ${{ secrets.SOCKET_API_TOKEN_FOR_CLI_AND_SFW }}
      - uses: ./.github/actions/fleet/run-script
        with:
          main-script: pnpm run check --all

  test:
    name: 🧪 Test
    strategy:
      fail-fast: false
      max-parallel: 4
      matrix:
        # JS/TS tests only need a fast Linux run; cross-platform behavior is
        # covered by unit tests, not the CI matrix.
        os: [ubuntu-latest]
    runs-on: ${{ matrix.os }}
    timeout-minutes: 15
    steps:
      # First step can't call the local ./.github/actions/fleet/checkout
      # composite (nothing checked out yet); bootstrap the workspace with an
      # inline git-fetch, matching release-reconcile.yml's pattern.
      - name: Bootstrap checkout
        shell: bash
        env:
          GITHUB_TOKEN: ${{ github.token }}
          SERVER_URL: ${{ github.server_url }}
          REPOSITORY: ${{ github.repository }}
          TRIGGER_REF: ${{ github.ref }}
        run: |
          set -euo pipefail
          git init -q
          git config --local advice.detachedHead false
          git remote remove origin 2>/dev/null || true
          git remote add origin "${SERVER_URL}/${REPOSITORY}"
          FETCH_ARGS=(--no-tags --prune --depth 1 origin "${TRIGGER_REF}")
          if [ -n "${GITHUB_TOKEN}" ]; then
            AUTH_B64="$(printf 'x-access-token:%s' "${GITHUB_TOKEN}" | base64 | tr -d '\n')"
            git -c "http.${SERVER_URL}/.extraheader=AUTHORIZATION: basic ${AUTH_B64}" fetch "${FETCH_ARGS[@]}"
          else
            git fetch "${FETCH_ARGS[@]}"
          fi
          git checkout -q --detach FETCH_HEAD
      - uses: ./.github/actions/fleet/setup-and-install
        with:
          # Authorizes a thin member's bundle download during install. Both
          # stay empty on a member with no payload App, which skips the mint.
          payload-token-client-id: ${{ vars.SOCKET_PAYLOAD_CLIENT_ID }}
          payload-token-private-key: ${{ secrets.SOCKET_PAYLOAD_APP_PRIVATE_KEY }}
          socket-api-token: ${{ secrets.SOCKET_API_TOKEN_FOR_CLI_AND_SFW }}
      - uses: ./.github/actions/fleet/run-script
        env:
          # Authenticate build-time GitHub API reads (release listings,
          # prebuilt-artifact downloads). Unauthenticated calls share the
          # hosted runner's IP-scoped rate limit and 403 under load.
          GH_TOKEN: ${{ github.token }}
        with:
          setup-script: pnpm run build
          main-script: pnpm test --all