opencode-native-e2e.yml

name: OpenCode installed dual native E2E (qualification required)
on:
  workflow_dispatch:
    inputs:
      plan:
        description: Original qualification plans or seven immutable release recovery cells
        type: choice
        options: [all-eleven, portable-eight, release-recovery]
        default: all-eleven
        required: true
      evidence_url:
        description: 'HTTPS parent evidence tar sealed after exact clean source checkout/build; no SDK copies or grants'
        type: string
        required: false
      evidence_sha256:
        description: 'Reviewed SHA256 of that immutable external evidence tar'
        type: string
        required: true
      recovery_run_id:
        description: 'Original completed v1.48.1 release workflow run with successful builds and canaries'
        type: string
        required: false
      candidate_sha:
        description: 'Exact immutable release source SHA, required only for release-recovery'
        type: string
        required: false
      recovery_cells:
        description: 'Fresh primitive and business evidence scope, only for release-recovery'
        type: choice
        options: [first-linux-amd64-v2, windows-two, all-seven]
        default: first-linux-amd64-v2
        required: true
# Only a newer run for the same PR supersedes its checks.
concurrency:
  group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.event.pull_request.number || github.run_id }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

permissions:
  contents: read
jobs:
  native:
    if: inputs.plan != 'release-recovery'
    name: '${{ matrix.target.platform }}/${{ matrix.target.arch }} ${{ matrix.version }}'
    runs-on: ${{ matrix.target.runner }}
    timeout-minutes: 20
    strategy:
      fail-fast: false
      matrix:
        version: ['1.18.33', '2.0.21']
        target: ${{ fromJSON(inputs.plan == 'portable-eight' && '[{"runner":"ubuntu-22.04-arm","platform":"linux","arch":"arm64"},{"runner":"macos-15","platform":"darwin","arch":"arm64"},{"runner":"macos-15-intel","platform":"darwin","arch":"amd64"},{"runner":"windows-latest","platform":"windows","arch":"amd64"}]' || '[{"runner":"ubuntu-22.04","platform":"linux","arch":"amd64"},{"runner":"ubuntu-22.04-arm","platform":"linux","arch":"arm64"},{"runner":"macos-15","platform":"darwin","arch":"arm64"},{"runner":"macos-15-intel","platform":"darwin","arch":"amd64"},{"runner":"windows-latest","platform":"windows","arch":"amd64"}]') }}
        include: ${{ fromJSON(inputs.plan == 'portable-eight' && '[]' || '[{"version":"1.18.34","target":{"runner":"ubuntu-22.04","platform":"linux","arch":"amd64"}}]') }}
    env:
      AN_EVIDENCE_URL: ${{ inputs.evidence_url }}
      AN_EVIDENCE_SHA256: ${{ inputs.evidence_sha256 }}
      AN_OS: ${{ matrix.target.platform }}
      AN_ARCH: ${{ matrix.target.arch }}
      AN_VERSION: ${{ matrix.version }}
    steps:
      - uses: actions/checkout@v7
        with:
          ref: ${{ github.event.pull_request.head.sha || github.sha }}
          persist-credentials: false
      - uses: actions/setup-go@v7
        with: {go-version: '1.27', cache: false}
      - uses: actions/setup-node@v6
        with: {node-version: '24.21.0'}
      - uses: actions/setup-python@v7
        with: {python-version: '3.12'}
      - name: Initialize unqualified report before any fixture check
        shell: bash
        run: |
          mkdir -p .task-tools/artifacts
          python -c 'import json,pathlib; pathlib.Path(".task-tools/artifacts/native-report.json").write_text(json.dumps({"status":"unqualified","businessPhasesStarted":False,"firstFailedPrerequisite":"fixture_checks_not_completed"})+"\n")'
      - name: Inert fixture parser checks
        run: python -B scripts/testdata/opencode-native-e2e/test_fixture.py
      - name: Linux build and private bus prerequisites
        if: matrix.target.platform == 'linux'
        run: sudo apt-get update && sudo apt-get install -y libasound2-dev dbus iproute2
      - name: Stage immutable external parent artifacts
        id: parent
        shell: bash
        run: python -B scripts/testdata/opencode-native-e2e/ci_inputs.py --stage-evidence
      - name: Verify exact source, clean build and bundle/SDK bytes before any host
        shell: bash
        env:
          AN_MANIFEST: ${{ steps.parent.outputs.manifest }}
          AN_MANIFEST_SHA256: ${{ steps.parent.outputs.sha256 }}
        run: python -B scripts/testdata/opencode-native-e2e/ci_inputs.py
      - name: Preserve managed native and Windows path protocol checks
        shell: bash
        run: |
          set -euo pipefail
          go test -count=1 ./internal/opencodeinstall ./internal/desktopinstall -run 'Test.*(Native|Shortcut|Desktop)'
      - name: Guard and execute exact reviewed installed fixture
        shell: bash
        env:
          AN_MANIFEST: ${{ steps.parent.outputs.manifest }}
          AN_MANIFEST_SHA256: ${{ steps.parent.outputs.sha256 }}
        run: |
          set -euo pipefail
          export AN_SUITE=business
          if [ "$AN_OS/$AN_ARCH" = linux/amd64 ]; then export AN_SUITE=full; fi
          if [ "$AN_OS" = linux ]; then
            sudo --preserve-env=PATH,AN_MANIFEST,AN_MANIFEST_SHA256,AN_OS,AN_ARCH,AN_VERSION,AN_SUITE unshare --net -- bash -c 'ip link set lo up; python -B scripts/testdata/opencode-native-e2e/ci_inputs.py --execute'
          else
            python -B scripts/testdata/opencode-native-e2e/ci_inputs.py --execute
          fi
      - uses: actions/upload-artifact@v7
        if: always()
        with:
          name: opencode-native-${{ matrix.target.platform }}-${{ matrix.target.arch }}-${{ matrix.version }}
          path: .task-tools/artifacts/native-report.json
          if-no-files-found: error
          retention-days: 14
  recovery-inputs:
    if: inputs.plan == 'release-recovery'
    runs-on: ubuntu-22.04
    permissions:
      contents: read
      actions: read
    outputs:
      run_id: ${{ steps.origin.outputs.run_id }}
      candidate_sha: ${{ steps.origin.outputs.candidate_sha }}
      evidence_sha256: ${{ steps.origin.outputs.evidence_sha256 }}
      matrix: ${{ steps.origin.outputs.matrix }}
    steps:
      - uses: actions/checkout@v7
        with:
          ref: ${{ github.sha }}
          persist-credentials: false
      - name: Verify original release source, builds, canaries and artifact identities
        id: origin
        env:
          GH_TOKEN: ${{ github.token }}
          AN_RECOVERY_RUN_ID: ${{ inputs.recovery_run_id }}
          AN_RECOVERY_CANDIDATE_SHA: ${{ inputs.candidate_sha }}
          AN_EVIDENCE_SHA256: ${{ inputs.evidence_sha256 }}
          AN_RECOVERY_CELLS: ${{ inputs.recovery_cells }}
        run: python -B scripts/release-opencode-recovery.py --verify-origin
  release-recovery:
    if: inputs.plan == 'release-recovery'
    needs: recovery-inputs
    name: 'Recover release ${{ matrix.target.platform }}/${{ matrix.target.arch }} ${{ matrix.version }}'
    runs-on: ${{ matrix.target.runner }}
    timeout-minutes: 20
    permissions:
      contents: read
      actions: read
    strategy:
      fail-fast: false
      matrix: ${{ fromJSON(needs.recovery-inputs.outputs.matrix) }}
    defaults:
      run:
        working-directory: source
        shell: bash
    env:
      AN_RECOVERY_RUN_ID: ${{ needs.recovery-inputs.outputs.run_id }}
      AN_RECOVERY_CANDIDATE_SHA: ${{ needs.recovery-inputs.outputs.candidate_sha }}
      SOURCE_COMMIT: ${{ needs.recovery-inputs.outputs.candidate_sha }}
      AN_EVIDENCE_SHA256: ${{ needs.recovery-inputs.outputs.evidence_sha256 }}
      AN_EVIDENCE_ARCHIVE: .task-tools/artifacts/custody/release-opencode-inputs.tar.gz
      AN_OS: ${{ matrix.target.platform }}
      AN_ARCH: ${{ matrix.target.arch }}
      AN_VERSION: ${{ matrix.version }}
    steps:
      - name: Preserve canonical LF Git bytes before both Windows checkouts
        if: runner.os == 'Windows'
        working-directory: ${{ github.workspace }}
        run: |
          git config --global core.autocrlf false
          git config --global core.eol lf
      - uses: actions/checkout@v7
        with:
          ref: ${{ needs.recovery-inputs.outputs.candidate_sha }}
          path: source
          fetch-depth: 0
          persist-credentials: false
      - uses: actions/checkout@v7
        with:
          ref: ${{ github.sha }}
          path: recovery-tools
          persist-credentials: false
      - uses: actions/setup-go@v7
        with: {go-version: '1.27.1', cache: false}
      - uses: actions/setup-node@v6
        with: {node-version: '24.21.0'}
      - uses: actions/setup-python@v7
        with: {python-version: '3.12'}
      - name: Initialize unqualified recovery report
        run: |
          mkdir -p .task-tools/artifacts
          python -c 'import json,pathlib; pathlib.Path(".task-tools/artifacts/native-report.json").write_text(json.dumps({"status":"unqualified","businessPhasesStarted":False,"firstFailedPrerequisite":"recovery_inputs_not_verified"})+"\n")'
      - uses: actions/download-artifact@v8
        with:
          github-token: ${{ github.token }}
          run-id: ${{ needs.recovery-inputs.outputs.run_id }}
          name: binaries-${{ matrix.target.platform }}-${{ matrix.target.arch }}
          path: source/dist
      - uses: actions/download-artifact@v8
        with:
          github-token: ${{ github.token }}
          run-id: ${{ needs.recovery-inputs.outputs.run_id }}
          name: release-opencode-inputs-${{ needs.recovery-inputs.outputs.candidate_sha }}
          path: source/.task-tools/artifacts/custody
      - name: Restore executable mode without changing release binary bytes
        if: runner.os != 'Windows'
        env:
          MAIN_BINARY: ${{ matrix.target.binary }}
        run: chmod +x "dist/$MAIN_BINARY"
      - name: Linux private bus prerequisites
        if: matrix.target.platform == 'linux'
        run: sudo apt-get update && sudo apt-get install -y libasound2-dev dbus iproute2
      - name: Verify and stage original sealed parent archive
        id: parent
        run: python -B scripts/testdata/opencode-native-e2e/ci_inputs.py --stage-evidence
      - name: Verify unchanged source and Go identity, and build original private receiver
        env:
          AN_MANIFEST: ${{ steps.parent.outputs.manifest }}
          AN_MANIFEST_SHA256: ${{ steps.parent.outputs.sha256 }}
        run: |
          python -B ../recovery-tools/scripts/release-opencode-recovery.py --verify-inputs
          python -B scripts/testdata/opencode-native-e2e/ci_inputs.py
      - name: Prefetch pinned tooling and Go dependencies before native isolation
        run: |
          set -euo pipefail
          npm ci --prefix opencode-plugin
          go mod download
      - name: Compile exact-source reader witness offline without any native host
        id: primitives
        env:
          AN_MANIFEST: ${{ steps.parent.outputs.manifest }}
          AN_MANIFEST_SHA256: ${{ steps.parent.outputs.sha256 }}
        run: python -B ../recovery-tools/scripts/release-opencode-recovery.py --prepare-primitives
      - name: Observe fresh primitives and business scenarios with no qualification grants
        env:
          AN_MANIFEST: ${{ steps.parent.outputs.manifest }}
          AN_MANIFEST_SHA256: ${{ steps.parent.outputs.sha256 }}
          AN_CLOCK_TEMP_BASE: ${{ steps.primitives.outputs.clock_temp_base }}
          AN_GO_MODULE_CACHE: ${{ steps.primitives.outputs.go_module_cache }}
        run: |
          set -euo pipefail
          if [ "$AN_OS" = linux ]; then
            export AN_HOST_NETNS="$(readlink /proc/self/ns/net)"
            sudo --preserve-env=PATH,AN_MANIFEST,AN_MANIFEST_SHA256,AN_OS,AN_ARCH,AN_VERSION,AN_RECOVERY_RUN_ID,AN_RECOVERY_CANDIDATE_SHA,AN_EVIDENCE_SHA256,AN_HOST_NETNS,AN_CLOCK_TEMP_BASE,AN_GO_MODULE_CACHE,SOURCE_COMMIT,GITHUB_ACTIONS unshare --net -- bash -c '
              set -euo pipefail
              ip link set lo up
              exec setpriv --reuid "$1" --regid "$2" --init-groups -- env HOME="$3" USER="$4" LOGNAME="$4" python -B ../recovery-tools/scripts/release-opencode-recovery.py --execute
            ' bash "$(id -u)" "$(id -g)" "$HOME" "$(id -un)"
          else
            python -B ../recovery-tools/scripts/release-opencode-recovery.py --execute
          fi
      - uses: actions/upload-artifact@v7
        if: always()
        with:
          name: opencode-release-recovery-${{ matrix.target.platform }}-${{ matrix.target.arch }}-${{ matrix.version }}
          path: |
            source/.task-tools/artifacts/native-report.json
            source/.task-tools/artifacts/native/
            source/.task-tools/artifacts/primitives/
          include-hidden-files: true
          if-no-files-found: error
          retention-days: 14
      - uses: actions/upload-artifact@v7
        if: always() && steps.primitives.outputs.clock_temp_base != ''
        with:
          name: opencode-release-clock-raw-${{ matrix.target.platform }}-${{ matrix.target.arch }}-${{ matrix.version }}
          path: ${{ steps.primitives.outputs.clock_temp_base }}/
          include-hidden-files: true
          if-no-files-found: error
          retention-days: 14
      - uses: actions/upload-artifact@v7
        if: always()
        with:
          name: opencode-release-recovery-summary-${{ matrix.target.platform }}-${{ matrix.target.arch }}-${{ matrix.version }}
          include-hidden-files: true
          path: |
            source/.task-tools/artifacts/native-report.json
            source/.task-tools/artifacts/primitives/clock-report.json
            source/.task-tools/artifacts/primitives/reader-report.json
            source/.task-tools/artifacts/parent-inputs/manifest.json
            source/.task-tools/artifacts/parent-inputs/release-inputs-receipt.json
            source/.task-tools/artifacts/primitives/sealed/
            source/.task-tools/artifacts/windows-acl-preparation.json
            source/.task-tools/artifacts/primitives/TEST-reader-native/reader-private.jsonl
            source/.task-tools/artifacts/primitives/TEST-reader-native/result.json
            source/.task-tools/artifacts/primitives/TEST-reader-build/build-receipt.json
            source/.task-tools/artifacts/primitives/TEST-reader-build/build-metafile.json
            source/.task-tools/artifacts/native/**/native-private.jsonl
            source/.task-tools/artifacts/native/**/provider-redacted.jsonl
            source/.task-tools/artifacts/native/**/desktop-private.jsonl
            source/.task-tools/artifacts/native/**/host-private.log
            source/.task-tools/artifacts/native/**/updated-host-private.log
            source/.task-tools/artifacts/native/**/reinstalled-host-private.log
          if-no-files-found: error
          retention-days: 14
      - uses: actions/upload-artifact@v7
        if: always() && steps.primitives.outputs.clock_temp_base != ''
        with:
          name: opencode-release-clock-summary-${{ matrix.target.platform }}-${{ matrix.target.arch }}-${{ matrix.version }}
          include-hidden-files: true
          path: |
            ${{ steps.primitives.outputs.clock_temp_base }}/**/metadata.json
            ${{ steps.primitives.outputs.clock_temp_base }}/**/samples.private.json
            ${{ steps.primitives.outputs.clock_temp_base }}/**/module-stream-*.private
            ${{ steps.primitives.outputs.clock_temp_base }}/**/helper-*.private
            ${{ steps.primitives.outputs.clock_temp_base }}/**/os-loader-files.private.json
            ${{ steps.primitives.outputs.clock_temp_base }}/**/loader.private.json
            ${{ steps.primitives.outputs.clock_temp_base }}/**/helper-lifecycle.private.json
          if-no-files-found: error
          retention-days: 14