ci.yml

name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: read
  # required by go-ci.yml's gosec SARIF upload
  security-events: write

jobs:
  # ─── Go Build & Test ────────────────────────────────────────────────
  # test, lint, verify and security now come from the shared workflow. It
  # probes for Makefile targets per step and falls back to the plain go
  # commands these jobs used to run inline.
  ci:
    uses: xraph/workflows/.github/workflows/go-ci.yml@v1
    with:
      go-versions: '["1.26"]'
      os: '["ubuntu-latest"]'

  # ─── Format Check ──────────────────────────────────────────────────
  format:
    name: Format
    runs-on: ubuntu-latest

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Set up Go
        uses: actions/setup-go@v6
        with:
          go-version-file: go.mod
          cache: true
          cache-dependency-path: go.sum

      - name: Install goimports
        run: go install golang.org/x/tools/cmd/goimports@latest

      - name: Check formatting (goimports)
        run: |
          OUTPUT=$(goimports -l -local github.com/xraph/cortex .)
          if [ -n "$OUTPUT" ]; then
            echo "::error::The following files need goimports formatting:"
            echo "$OUTPUT"
            exit 1
          fi

  # ─── Sub-modules ────────────────────────────────────────────────────
  # The root module is the agent engine on its own. Everything that drags
  # in a heavy dependency lives in its own module so a consumer can take
  # the engine without forge or fabriq. Each one still has to build
  # and test, and its go.mod has to already be tidy.
  submodules:
    name: Sub-module (${{ matrix.module }})
    runs-on: ubuntu-latest

    strategy:
      fail-fast: false
      matrix:
        module:
          - api
          - sentinel
          - extension
          - integrations/fabriq

    defaults:
      run:
        working-directory: ${{ matrix.module }}

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Set up Go
        uses: actions/setup-go@v6
        with:
          go-version-file: ${{ matrix.module }}/go.mod
          cache: true
          cache-dependency-path: ${{ matrix.module }}/go.sum

      - name: Verify tidy
        run: |
          go mod download
          go mod tidy
          git diff --exit-code go.mod go.sum

      - name: Build
        run: go build ./...

      - name: Test
        run: go test -race -count=1 ./...

  # ─── Docs ───────────────────────────────────────────────────────────
  docs:
    name: Docs
    runs-on: ubuntu-latest

    defaults:
      run:
        working-directory: docs

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Set up Node.js
        uses: actions/setup-node@v6
        with:
          node-version: 22

      - name: Install pnpm
        uses: pnpm/action-setup@v4
        with:
          version: 10

      - name: Get pnpm store directory
        shell: bash
        run: echo "STORE_PATH=$(pnpm store path --silent)" >> "$GITHUB_ENV"

      - name: Cache pnpm
        uses: actions/cache@v4
        with:
          path: ${{ env.STORE_PATH }}
          key: ${{ runner.os }}-pnpm-${{ hashFiles('docs/pnpm-lock.yaml') }}
          restore-keys: |
            ${{ runner.os }}-pnpm-

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Type check
        run: pnpm types:check

      - name: Lint
        run: pnpm lint

      - name: Build
        run: pnpm build