ci.yml

name: CI

on:
  push:
    branches: [ master, main ]
  pull_request:
  workflow_dispatch:

jobs:
  # Fast PR validation: format, vet, build, and the plain (non-integration,
  # non-stress) unit tests, across every OS a developer or CI consumer is
  # actually expected to run Go on. These three legs are independent and
  # run in parallel; none of them needs: another.
  #
  # `demo` and `demo-agents` are excluded from vet/build/test everywhere
  # below because they are WASM-only packages (import syscall/js) that only
  # compile under GOOS=js GOARCH=wasm; see .github/workflows/deploy-demo.yml
  # for how they're actually built. `bindings/main` (cgo) is additionally
  # excluded on the Windows leg only; see the comment on the "go vet" step
  # below for why.
  #
  # Go version: the project pins one exact toolchain version in go.mod
  # (currently 1.26.8, for CVE remediation, see CHANGELOG.md) rather than
  # supporting a range, so this matrix intentionally does not add a Go
  # version axis; `go-version-file: go.mod` picks up that pinned version on
  # every OS.
  #
  # Architecture: macos-latest already runs on Apple Silicon (arm64), which
  # gives real arm64 coverage for free. The core engine has no
  # architecture-specific assembly, SIMD intrinsics, or cgo in the packages
  # this job tests (checked: no *_amd64.go/*_arm64.go files, no "unsafe"
  # outside bindings/main), so an additional explicit arm64 Linux or Windows
  # runner would not currently exercise any code path that ubuntu-latest and
  # macos-latest don't already cover, and is left out to keep CI cost and
  # maintenance proportional to what the project actually needs.
  sanity:
    name: Sanity (vet + fmt + build + unit tests)
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, macos-latest, windows-latest]
    runs-on: ${{ matrix.os }}
    timeout-minutes: 15
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup Go
        uses: actions/setup-go@v5
        with:
          go-version-file: go.mod

      - name: gofmt check
        shell: bash
        run: |
          set -euo pipefail
          unformatted=$(gofmt -l . | grep -v vendor || true)
          if [ -n "$unformatted" ]; then
            echo "Files need gofmt:"
            echo "$unformatted"
            exit 1
          fi

      # bindings/main uses cgo (import "C") to build the shared libraries
      # consumed by the Python and C# packages. Linux and macOS runners ship
      # a working C compiler out of the box, so cgo builds there natively.
      # Windows does not reliably ship one; the release pipeline
      # (release.yml) already handles Windows binaries for this package by
      # cross-compiling from ubuntu-latest with gcc-mingw-w64, not by
      # building natively on a Windows runner, so this job follows the same
      # split rather than guessing at whatever mingw happens to be
      # preinstalled on windows-latest.
      - name: go vet
        shell: bash
        run: |
          set -euo pipefail
          exclude='/demo$|/demo-agents$'
          if [ "${{ matrix.os }}" = "windows-latest" ]; then
            exclude="$exclude|/bindings/main$"
          fi
          go vet $(go list ./... 2>/dev/null | grep -Ev "$exclude")

      - name: Build all packages
        shell: bash
        run: |
          set -euo pipefail
          exclude='/demo$|/demo-agents$'
          if [ "${{ matrix.os }}" = "windows-latest" ]; then
            exclude="$exclude|/bindings/main$"
          fi
          go build $(go list ./... 2>/dev/null | grep -Ev "$exclude")

      - name: Unit tests (no integration/stress tags, no external services)
        shell: bash
        run: |
          set -euo pipefail
          go test -timeout 20m ./inmemory ./btree ./common ./cache ./encoding ./database

  # Heavier validation that needs Redis and Cassandra as GitHub Actions
  # `services:` containers. That keyword only runs a Docker daemon on
  # Linux-hosted runners (macos-latest has no Docker daemon at all, and
  # windows-latest does not support the `services:` container keyword), so
  # this job intentionally stays Linux-only rather than faking coverage on
  # platforms that cannot run it. It waits on the full cross-platform sanity
  # matrix so an expensive Cassandra/Redis run is never wasted on a commit
  # that fails to even build on one OS.
  build-and-test:
    name: Build & Test (public + integration)
    needs: sanity
    runs-on: ubuntu-latest
    timeout-minutes: 30
    services:
      redis:
        image: redis:7
        ports:
          - 6379:6379
        options: >-
          --health-cmd "redis-cli ping || exit 1"
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5
      cassandra:
        image: cassandra:4
        ports:
          - 9042:9042
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup Go
        uses: actions/setup-go@v5
        with:
          go-version-file: go.mod

      - name: Cache Go modules
        uses: actions/cache@v4
        with:
          path: |
            ~/go/pkg/mod
            ~/.cache/go-build
          key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
          restore-keys: |
            ${{ runner.os }}-go-

      - name: Wait for Redis
        shell: bash
        run: |
          set -euo pipefail
          echo "Waiting for Redis..."
          for i in {1..60}; do
            (echo > /dev/tcp/127.0.0.1/6379) && break || sleep 2
          done
          echo "Redis reachable."

      - name: Wait for Cassandra
        shell: bash
        run: |
          set -euo pipefail
          echo "Waiting for Cassandra..."
          for i in {1..60}; do
            (echo > /dev/tcp/127.0.0.1/9042) && break || sleep 2
          done
          echo "Cassandra reachable."

      - name: Prepare datapath
        shell: bash
        env:
          datapath: ${{ github.workspace }}/.sop_data
        run: |
          set -euo pipefail
          mkdir -p "$datapath"
          echo "datapath prepared at: $datapath"

      - name: Run unit tests
        shell: bash
        env:
          datapath: ${{ github.workspace }}/.sop_data
        run: |
          set -euo pipefail
          echo "Running unit tests"
          go test -timeout 30m -v -count=1 ./inmemory ./infs ./btree ./common

      - name: Verify AI Knowledge Compiler
        shell: bash
        run: |
          set -euo pipefail
          echo "Compiling SOP Knowledge Base JSON..."
          cd ai
          go run cmd/knowledge_compiler/main.go cmd/knowledge_compiler/normalize.go
          git diff --exit-code sop_base_knowledge.json || (echo "AI Knowledge Base (sop_base_knowledge.json) is outdated. Please run 'cd ai && go run cmd/knowledge_compiler/main.go cmd/knowledge_compiler/normalize.go' and commit the result." && exit 1)

      - name: Run infs integration tests
        shell: bash
        env:
          datapath: ${{ github.workspace }}/.sop_data
        run: |
          set -euo pipefail
          echo "Running infs integration tests"
          go test -timeout 30m -v -tags=integration -count=1 ./infs/integrationtests/...

      - name: Run incfs integration tests
        shell: bash
        env:
          datapath: ${{ github.workspace }}/.sop_data
          SOP_RUN_INCFS_IT: 1
        run: |
          set -euo pipefail
          echo "Running incfs integration tests"
          go test -timeout 30m -v -tags=integration -count=1 ./incfs/integrationtests/...