ci.yml

name: CI Pipeline

on:
  push:
    branches: [main, develop, 'feature/**']
  pull_request:
    branches: [main, develop]
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: ci-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

env:
  NODE_VERSION: '22'

jobs:
  lint:
    name: Lint
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: 'npm'
      - run: npm ci --prefer-offline --no-audit --no-fund
      - run: npm run lint

  typecheck:
    name: Type Check
    runs-on: ubuntu-latest
    needs: lint
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: 'npm'
      - run: npm ci --prefer-offline --no-audit --no-fund
      - run: npm run typecheck

  build:
    name: Build
    runs-on: ubuntu-latest
    needs: [lint, typecheck]
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: 'npm'
      - run: npm ci --prefer-offline --no-audit --no-fund
      - run: npm run build
      - uses: actions/upload-artifact@v7
        with:
          name: dist
          path: dist/
          retention-days: 7

  test:
    name: Tests
    runs-on: ubuntu-latest
    needs: build
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: 'npm'
      # Verification runs each command inside an OS sandbox and fails closed
      # when it cannot get one. On Linux that sandbox is bubblewrap, which the
      # runner image does not ship, so without this every verify test reports
      # "OS verification sandbox is unavailable". macOS uses built-in
      # sandbox-exec and needs no install.
      - uses: ./.github/actions/install-bubblewrap
      - name: Lift the AppArmor user-namespace restriction
        run: |
          # ubuntu-24.04 images restrict unprivileged user namespaces through
          # AppArmor; without lifting it bwrap cannot set up the network
          # namespace and every sandboxed command dies with
          # "loopback: Failed RTM_NEWADDR: Operation not permitted".
          sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0 || true
          bwrap --ro-bind / / --unshare-net --dev /dev --proc /proc -- /bin/sh -lc 'echo sandbox-ok'
      - run: npm ci --prefer-offline --no-audit --no-fund
      # Coverage thresholds live in vitest.config.ts (ratcheted floor below the
      # measured baseline — see that file's comment). Previously `npm test` had
      # no --coverage flag anywhere in CI, so the threshold was configured but
      # never actually enforced.
      - run: npm run test:coverage

  windows-process-tree:
    # POSIX process groups cannot exercise the Windows ownership contract. This
    # integration test proves the Job Object kills supervised descendants while
    # an outside sibling remains alive, guarding against PID-reuse regressions.
    name: Windows process-tree ownership
    runs-on: windows-latest
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: 'npm'
      - run: npm ci --prefer-offline --no-audit --no-fund
      - run: npm test -- --run src/adapters/processTree.windows.test.ts

  loc-gate:
    name: LOC Warning (800 lines)
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
      - uses: actions/checkout@v4
      - name: Check file sizes
        run: |
          for file in $(find src -name "*.ts" -type f); do
            lines=$(wc -l < "$file")
            if [ "$lines" -gt 800 ]; then
              echo "::warning file=$file::File exceeds 800 lines ($lines)"
            fi
          done

  verify-sandbox:
    # Deterministic verification refuses to run without an OS sandbox, and
    # whether one is available is a property of the runner, not of our code — no
    # unit test can answer it. This job asserts the recipe the README gives
    # operators, so that recipe cannot go stale silently. (INT-3103)
    #
    # Measured on ubuntu-latest 2026-08-01: unprivileged_userns_clone=1 and
    # user.max_user_namespaces=63838, but apparmor_restrict_unprivileged_userns=1,
    # and with that set even `bwrap --unshare-user` fails at "setting up uid map:
    # Permission denied". Installing bubblewrap alone is NOT enough there.
    name: Verify sandbox (ubuntu-latest)
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
      - uses: actions/checkout@v4
      - uses: ./.github/actions/install-bubblewrap
      - name: Bubblewrap alone must not be assumed sufficient
        run: |
          set -uo pipefail
          if bwrap --ro-bind / / --unshare-net --dev /dev --proc /proc -- /usr/bin/true 2>/dev/null; then
            echo "::warning::The sandbox now works without lifting the AppArmor restriction — the README's sysctl step may be obsolete on this image"
          else
            echo "Confirmed: installing bubblewrap alone does not give a working sandbox on this runner"
          fi
      - name: The documented recipe must work
        run: |
          set -euo pipefail
          sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0
          # The same namespaces src/verify/runner.ts sets up. Probing a subset
          # would pass on a host that denies one of the others.
          bwrap --ro-bind / / --unshare-net --dev /dev --proc /proc -- /usr/bin/true
          echo "OS verification sandbox is available on ubuntu-latest with bubblewrap + the AppArmor sysctl"