ci.yml

name: CI

on:
  push:
    branches:
      - main
  pull_request:

permissions:
  contents: read

# Cancel superseded runs on the same ref. When you push three commits to a PR
# in a row, only the newest needs to be green — don't tie up a 10x macOS runner
# finishing builds for commits nobody will look at. (Scoped to PRs so we never
# cancel an in-flight build of `main`.)
concurrency:
  group: ci-${{ github.ref }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

env:
  CARGO_TERM_COLOR: always
  # Incremental compilation only pays off across edits on one machine; in CI it
  # adds I/O and bloats the cache for no reuse. Off is the standard CI choice.
  CARGO_INCREMENTAL: "0"
  RUST_BACKTRACE: "1"
  # The two integration tests that need real UDP sockets / a running Miniflare
  # relay self-skip on these. Set them explicitly so the suite is deterministic
  # on Linux (and never hangs 30s waiting on loopback ICE).
  ATTN_SKIP_WEBRTC_E2E: "1"
  ATTN_SKIP_CONFORMANCE: "1"

jobs:
  # ---------------------------------------------------------------------------
  # Lints + the full Rust test suite + a Linux build, all on a 1x-cost Ubuntu
  # runner. No #[test] function in the tree is macOS-gated (the macOS-only code
  # in screenshot.rs / watcher.rs / main.rs is cfg'd out and has no tests), so
  # this runs exactly the tests the old macOS job ran. This single job replaces
  # both the old macOS "Rust Quality" clippy+test steps AND the separate Linux
  # build job — `cargo test` + `cargo build` here prove the crate compiles,
  # links, and passes on Linux.
  # ---------------------------------------------------------------------------
  rust-quality:
    name: Rust Quality (Linux)
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Install system dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y libgtk-3-dev libwebkit2gtk-4.1-dev libayatana-appindicator3-dev

      - name: Setup Node
        uses: actions/setup-node@v4
        with:
          node-version: "20"
          cache: npm
          cache-dependency-path: web/package-lock.json

      # Produce web/dist/index.html up front. build.rs embeds this file; when it
      # already exists, build.rs is a one-line copy. When it's absent (the old
      # CI only ran `npm ci`), build.rs re-runs `npm ci` + the Vite build itself
      # inside OUT_DIR — once per cargo profile, uncached. Building it once here
      # collapses that repeated frontend build into a copy.
      - name: Build frontend
        run: |
          cd web
          npm ci
          npm run build

      - name: Setup Rust
        uses: dtolnay/rust-toolchain@stable
        with:
          components: clippy, rustfmt

      - name: Cache Rust
        uses: Swatinem/rust-cache@v2
        with:
          shared-key: rust-quality-linux

      - name: Check formatting
        run: cargo fmt --check

      # No separate `cargo clippy --release`: it costs a full second
      # release-mode compile (~2.5 min) whose artifacts the size-gate build
      # cannot reuse, because clippy goes through RUSTC_WORKSPACE_WRAPPER and
      # its fingerprints differ from rustc's. The size-gate job's release build
      # still compile-checks release-cfg code.
      - name: Clippy
        run: cargo clippy --all-targets -- -D warnings

      - name: Test
        run: cargo test --locked

      - name: Build (debug)
        run: cargo build --locked

  # ---------------------------------------------------------------------------
  # The shipped artifact is the macOS release binary, and the 30 MiB budget is
  # calibrated against it (fat-LTO + strip — see planning/collab/amendments.md
  # §Decision #1). This is the only job that genuinely needs macOS. It lives in
  # its own job so it runs in PARALLEL with the quality job above instead of
  # queueing behind ~8 min of clippy + tests. The fat-LTO link is inherently
  # serial and rust-cache can't cache the workspace crate, so this build can't
  # be made much faster without changing what the gate measures — the win is
  # not waiting on everything else first.
  # ---------------------------------------------------------------------------
  size-gate:
    name: Binary Size Gate (macOS)
    runs-on: macos-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup Node
        uses: actions/setup-node@v4
        with:
          node-version: "20"
          cache: npm
          cache-dependency-path: web/package-lock.json

      - name: Build frontend
        run: |
          cd web
          npm ci
          npm run build

      - name: Setup Rust
        uses: dtolnay/rust-toolchain@stable

      - name: Cache Rust
        uses: Swatinem/rust-cache@v2
        with:
          shared-key: size-gate-macos

      # Binary-size gate — enforces the 40 MiB target from
      # planning/collab/amendments.md §Decision #1 (webrtc-rs is the main risk).
      # Emergency bypass via env: ATTN_SIZE_BUDGET_WAIVER=1 (also accepts
      # BINARY_SIZE_WAIVER=1). See CLAUDE.md §"Binary-size gate".
      - name: Build release
        env:
          ATTN_DEFAULT_RELAY_URL: https://relay.attn.sh
          ATTN_DEFAULT_BROWSER_REVIEW_URL: https://attn.sh/review
        run: cargo build --release --locked

      - name: Check binary size (30 MiB budget)
        run: scripts/check-binary-size.sh

  web-check:
    name: Web Check (Ubuntu)
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: web
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      # The anchor WASM equivalence test invokes the native Rust example.
      # On Linux, the attn crate links its desktop target dependencies even
      # though the example itself only exercises the canonical parser.
      - name: Install native test dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y libgtk-3-dev libwebkit2gtk-4.1-dev libayatana-appindicator3-dev
        working-directory: .

      - name: Setup Node
        uses: actions/setup-node@v4
        with:
          node-version: "20"
          cache: npm
          cache-dependency-path: web/package-lock.json

      - name: Install dependencies
        run: npm ci

      - name: Typecheck
        run: npm run check

      - name: Unit tests
        run: npm test

      - name: Build
        run: npm run build

      - name: Build hosted browser app
        env:
          VITE_ATTN_RELAY_URL: http://127.0.0.1:8787
        run: npm run build:browser

      # Landing/app entries must never statically preload the editor or
      # room-crypto graphs (attn-7xl.1.1).
      - name: Check hosted route bundle boundaries
        run: npm run check:route-bundles

  relay-tests:
    name: Relay Tests (Ubuntu)
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: relay
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup Node
        uses: actions/setup-node@v4
        with:
          node-version: "20"
          cache: npm
          cache-dependency-path: relay/package-lock.json

      - name: Install dependencies
        run: npm ci

      # The relay is the collab backbone (room auth, caps, PoW, abuse gates),
      # so its vitest-pool-workers suite gates every PR/push. Leaving it to the
      # manual relay-deploy workflow lets the collab path regress unnoticed.
      - name: Typecheck
        run: npm run typecheck

      - name: Test
        run: npm test