apes-sidebar/.github/workflows/ci.yml

name: CI

on:
  push:
    branches: [main]
  pull_request:
  workflow_dispatch:

# Cancel a superseded PR run (it is on a stale commit); never cancel a
# push run — it is already producing the post-merge signal. The mount job
# boots a real DSH + Chromium, so the savings matter there most.
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

jobs:
  ci:
    runs-on: ubuntu-latest
    timeout-minutes: 20
    steps:
      - uses: actions/checkout@v7
        with:
          # Tests run git log against this repository and need the full history.
          fetch-depth: 0
      # pnpm version is pinned via packageManager in package.json; the action
      # reads it from there (specifying both makes action-setup fail on
      # purpose with ERR_PNPM_BAD_PM_VERSION).
      - uses: pnpm/action-setup@v6
      - uses: actions/setup-node@v7
        with:
          node-version: 22
          cache: pnpm
      # The plugin's git revert/cherry-pick spawn git without setting an
      # identity (deliberate, see tests/smoke.spec.ts) and rely on ambient
      # config; the runner has none by default.
      - name: Configure git identity for tests
        run: |
          git config --global user.name "dsh-better-sidebar-ci"
          git config --global user.email "ci@dsh.invalid"
      - name: Install dependencies
        run: pnpm install --frozen-lockfile
      - name: Typecheck
        run: pnpm typecheck
      - name: Lint
        run: pnpm lint
      - name: Test
        run: pnpm test
      - name: Build
        run: pnpm build
      # The consumer-facing declaration surface guard: a browser-only plugin
      # (no @types/node, skipLibCheck: false) must type-check against the
      # shipped lib/types. Runs AFTER build (it reads the built output).
      - name: Check consumer type surface
        run: pnpm check:consumer-types

  # Windows parity lane for the pure-logic suite. The codebase carries real
  # win32 branches (shell parsing, WSL path projection, the PowerShell
  # installer) that mock-injection tests alone cannot validate — this lane
  # runs the same typecheck / test / build / consumer-type-surface steps on
  # a real Windows runtime. The plugin-mount lane (real DSH + Playwright
  # Chromium) stays ubuntu-only and is deliberately NOT mirrored here.
  ci-windows:
    runs-on: windows-latest
    timeout-minutes: 30
    defaults:
      run:
        # The runner ships Git Bash: multi-line steps and
        # scripts/check-consumer-types.sh work verbatim.
        shell: bash
    steps:
      - uses: actions/checkout@v7
        with:
          # Tests run git log against this repository and need the full history.
          fetch-depth: 0
      # pnpm version is pinned via packageManager in package.json; the action
      # reads it from there (specifying both makes action-setup fail on
      # purpose with ERR_PNPM_BAD_PM_VERSION).
      - uses: pnpm/action-setup@v6
      - uses: actions/setup-node@v7
        with:
          node-version: 22
          cache: pnpm
      # Same rationale as the ci job: smoke tests spawn git without an
      # identity and rely on ambient config, which the runner lacks.
      - name: Configure git identity for tests
        run: |
          git config --global user.name "dsh-better-sidebar-ci"
          git config --global user.email "ci@dsh.invalid"
      - name: Install dependencies
        run: pnpm install --frozen-lockfile
      - name: Typecheck
        run: pnpm typecheck
      - name: Lint
        run: pnpm lint
      # `test:windows` caps the fork pool at 2 instead of `pnpm test`'s
      # unbounded default. Five specs in this suite really start processes
      # (tests/agent-pty, pty-deps, pty-helpers, install-powershell,
      # smoke): node-pty's ConPTY helper and a cold `powershell.exe` are
      # both console-bound, and this 2-core runner made parallel spawning
      # the amplifier behind every red `Test` step in the 2026-09-09/10
      # window — six real 5000 ms timeouts (agent-pty `:71`/`:106`,
      # install-powershell `:105`, the latter measuring 12.1 s) and two
      # silent vitest worker deaths. The test bodies now carry their own
      # explicit timeouts as well; this just stops them starving each other.
      - name: Test
        run: pnpm test:windows
      - name: Build
        run: pnpm build
      - name: Check consumer type surface
        run: pnpm check:consumer-types

  # Pack the plugin as an npm tarball, mount it into a REAL DSH instance
  # through the official `dsh plugin --profile web add` channel, and render
  # the DSH web UI headlessly (Playwright Chromium) to prove the plugin
  # mounts without crashing the shell. Drives `pnpm test:mount`, which boots
  # a keyless `dsh web` against a scratch profile and sweeps every built-in
  # sidebar tab. No API key needed — the whole lane is deterministic.
  plugin-mount:
    runs-on: ubuntu-latest
    timeout-minutes: 30
    # CI runs must never report to the production telemetry endpoint baked
    # into the DSH composition (same guard DSH's own CI uses).
    env:
      DSH_TELEMETRY_DISABLED: '1'
    steps:
      - uses: actions/checkout@v7

      # pnpm version is pinned via packageManager in package.json; the action
      # reads it from there (specifying both makes action-setup fail on
      # purpose with ERR_PNPM_BAD_PM_VERSION).
      - uses: pnpm/action-setup@v6

      - uses: actions/setup-node@v7
        with:
          node-version: 22
          cache: pnpm

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      # Pin the DSH CLI the lane mounts into; the profile's bundle stack
      # (dsh-base / dsh-web-app) resolves from this installation. Keep in
      # step with the plugin's @deepseek-ai/* peer range when bumping.
      # DSH 0.1.5-rc.2 is the `next` dist-tag on npm (`latest` still points
      # at rc.1); the lanes speak the slash-only RPC dialect
      # (tests/e2e/host-protocol.ts).
      #
      # `--legacy-peer-deps` + the larger heap are the fix for the two ways
      # this step used to die (runs 34492160123 / 34491256626 / 34490912649
      # and 34363627184): the pinned version's TRANSITIVES are declared as
      # floating `^` ranges, so while upstream publishes a prerelease in
      # stages (0.1.5-rc.2 went out 14:43-14:57 on 2026-09-10) npm resolved a
      # mixed rc.1/rc.2 peer graph — 3062 ERESOLVE lines, then "Ineffective
      # mark-compacts near heap limit" (exit 134), or a hard ETARGET on a
      # sibling package that only appeared minutes later. Skipping peer
      # negotiation keeps the install deterministic; the accumulated heap
      # covers npm's worst case for this ~520-package tree. Mounting a
      # version-mismatched bundle tree is not silent here: the mount smoke
      # below boots the real shell and would fail loudly.
      - name: Install dsh CLI (pinned)
        env:
          NODE_OPTIONS: --max-old-space-size=4096
        run: npm install -g --legacy-peer-deps @deepseek-ai/dsh@0.1.5-rc.2

      # lib/ is gitignored; the tarball is produced from this build.
      - name: Build and pack the npm tarball
        run: pnpm build && pnpm pack

      - name: Install Playwright Chromium
        run: pnpm exec playwright install --with-deps chromium

      - name: Mount + headless-render smoke
        run: pnpm test:mount

      # Aggregate double-mount regression: a fixture aggregate bundle mounts
      # dsh-better-sidebar under its own entry id BEFORE the plugin's bundle
      # row; the plugin must back off (no duplicate /sidebar/api, boot OK).
      # Uses the pinned DSH CLI installed above.
      - name: Aggregate double-mount regression
        env:
          DSH_CMD: dsh
        run: pnpm test:mount:aggregate

      - name: Upload Playwright report on failure
        if: failure()
        uses: actions/upload-artifact@v4
        with:
          name: playwright-report
          path: |
            playwright-report/
            test-results/
          if-no-files-found: ignore