ci-plugins.yml

# Registered by the standalone preview repository.
name: macOS Plugin CI

on:
  pull_request:
    # ready_for_review reruns the deferred runner lane after a draft is ready.
    types: [opened, synchronize, reopened, ready_for_review]
  workflow_dispatch:

permissions:
  contents: read
  # The classify job reads active jobs to choose a macOS runner pool.
  actions: read

# Pull request runs are not cancelled per branch: the lane-reuse step keeps an
# earlier run whose lanes it reuses and cancels the others.
concurrency:
  group: macos-plugin-ci-${{ github.workflow }}-${{ github.event_name == 'pull_request' && format('run-{0}', github.run_id) || github.ref }}
  cancel-in-progress: ${{ github.event_name != 'pull_request' }}

jobs:
  changes:
    name: Classify changes
    runs-on: ubuntu-latest
    permissions:
      contents: read
      # Cancels earlier runs of the same pull request that no lane reuses.
      actions: write
    outputs:
      plugins: ${{ steps.classify.outputs.plugins }}
      run_plugins: ${{ steps.reuse.outputs.run_plugins }}
      reuse: ${{ steps.reuse.outputs.reuse }}

    steps:
      - name: Check out source
        uses: actions/checkout@v7
        with:
          fetch-depth: 0

      - name: Resolve comparison base
        id: base
        env:
          EVENT_NAME: ${{ github.event_name }}
          PR_BASE_SHA: ${{ github.event.pull_request.base.sha }}
          PUSH_BASE_SHA: ${{ github.event.before }}
        shell: bash
        run: |
          if [[ "$EVENT_NAME" == "workflow_dispatch" ]]; then
            echo "manual=true" >> "$GITHUB_OUTPUT"
            exit 0
          fi

          base_sha="$PUSH_BASE_SHA"
          if [[ "$EVENT_NAME" == "pull_request" ]]; then
            base_sha="$PR_BASE_SHA"
          fi
          {
            echo "manual=false"
            echo "base_sha=$base_sha"
          } >> "$GITHUB_OUTPUT"

      - name: Classify changed paths
        id: classify
        env:
          MANUAL: ${{ steps.base.outputs.manual }}
          BASE_SHA: ${{ steps.base.outputs.base_sha }}
          LITHE_CI_DRAFT_PULL_REQUEST: ${{ github.event.pull_request.draft == true }}
          BASE_REF: ${{ github.base_ref }}
          HEAD_REF: ${{ github.head_ref }}
          HEAD_REPOSITORY: ${{ github.event.pull_request.head.repo.full_name }}
        shell: bash
        run: |
          if [[ "$MANUAL" == "true" ]]; then
            echo "plugins=true" >> "$GITHUB_OUTPUT"
            exit 0
          fi

          # Promoting preview to main reruns no lane; macOS CI requires the
          # preview verification of the same commit instead.
          if [[ "$BASE_REF" == "main" && "$HEAD_REF" == "preview" && "$HEAD_REPOSITORY" == "$GITHUB_REPOSITORY" ]]; then
            export LITHE_CI_SCOPE=release_promotion
          fi
          ./scripts/ci/common/classify-ci-changes.sh "$BASE_SHA" "$GITHUB_SHA" >> "$GITHUB_OUTPUT"

      # Reuse lanes that passed (or are running) on an earlier revision of this
      # pull request when its own new changes cannot affect them.
      - name: Reuse unaffected lane results
        id: reuse
        env:
          GITHUB_TOKEN: ${{ github.token }}
          LITHE_CI_WORKFLOW: plugins
          LITHE_CI_WORKFLOW_FILE: ci-plugins.yml
          PR_BASE_SHA: ${{ github.event.pull_request.base.sha }}
          PR_BASE_REF: ${{ github.base_ref }}
          PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
          PR_HEAD_REF: ${{ github.head_ref }}
          PR_HEAD_REPOSITORY: ${{ github.event.pull_request.head.repo.full_name }}
          LITHE_CI_CLASSIFICATION: |
            ci_scope=${{ steps.classify.outputs.ci_scope }}
            plugins=${{ steps.classify.outputs.plugins }}
        shell: bash
        run: node scripts/ci/common/plan-ci-lane-reuse.mjs

      - name: Summarize selected lanes
        shell: bash
        env:
          PLUGINS: ${{ steps.classify.outputs.plugins }}
          DRAFT: ${{ github.event.pull_request.draft == true }}
        run: |
          {
            echo "### Plugin CI lanes"
            echo "| Lane | Run |"
            echo "| --- | --- |"
            echo "| Plugin tests and package verification | $PLUGINS |"
            if [[ "$DRAFT" == "true" ]]; then
              echo ""
              echo "Draft pull request: the macOS plugin lane is deferred until it is marked ready for review."
            fi
          } >> "$GITHUB_STEP_SUMMARY"

  plugin-tests:
    name: Plugin tests and package verification
    needs: changes
    if: needs.changes.outputs.run_plugins == 'true'
    runs-on: macos-26
    timeout-minutes: 75

    steps:
      - name: Check out source
        uses: actions/checkout@v7

      - name: Set up Swift 6.3.3 and Xcode
        uses: ./.github/actions/setup-macos-toolchain

      # test-macos.sh links Rust Core; install it explicitly on every runner pool.
      - name: Set up Rust
        uses: dtolnay/rust-toolchain@stable

      - name: Prepare verified SwiftPM cache
        uses: ./.github/actions/prepare-macos-dependency-cache
        with:
          swiftpm: "true"
          cargo: "true"
          # Java Support is assembled from the pinned JDT LS and JDK.
          jdtls: "true"
          jdk: "true"
          jdk-architecture: arm64

      # Compile and discover tests before starting the test execution deadline.
      # A cold Rust/Swift build exceeded 20 minutes while still compiling Lithe
      # in run 39741361768. Keep that budget separate from test execution.
      - name: Build Swift tests
        timeout-minutes: 40
        run: ./scripts/macos/test/test-macos.sh list > /dev/null

      - name: Run plugin-focused Swift tests
        timeout-minutes: 17
        run: ./.agents/skills/write-stable-tests/scripts/test-stability-macos.sh --report .artifacts/test-stability/macos-plugins.json --suite-timeout-seconds 960 -- --skip-build --filter '([Pp]lugin|LanguageExtensionProcessLifecycleTests|LanguageServerToolServiceTests|LinuxDo)'

      - name: Build and verify official plugin packages
        timeout-minutes: 10
        run: ./scripts/plugins/verify-official-plugins.sh

      - name: Generate combined plugin test report
        if: always()
        run: node .agents/skills/write-stable-tests/scripts/generate-test-report.mjs

      - name: Upload plugin test reports
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: test-stability-plugins
          path: .artifacts/test-stability/
          if-no-files-found: ignore
          retention-days: 14

  gate:
    name: Plugin CI gate
    needs:
      - changes
      - plugin-tests
    if: always() && !cancelled()
    runs-on: ubuntu-latest

    steps:
      - name: Verify required jobs
        env:
          CHANGES_RESULT: ${{ needs.changes.result }}
          PLUGIN_SELECTED: ${{ needs.changes.outputs.plugins }}
          PLUGIN_RESULT: ${{ needs.plugin-tests.result }}
          RUN_PLUGINS: ${{ needs.changes.outputs.run_plugins }}
          REUSE: ${{ needs.changes.outputs.reuse }}
        shell: bash
        run: |
          [[ "$CHANGES_RESULT" == "success" ]]
          require_covered() {
            local selected="$1" ran="$2" lane="$3"
            [[ "$selected" != "true" || "$ran" == "true" ]] && return 0
            jq -e --arg lane "$lane" 'has($lane)' <<< "${REUSE:-{\}}" > /dev/null || {
              echo "::error::Lane $lane is selected but neither ran nor reused an earlier result"
              return 1
            }
          }
          require_job() {
            local ran="$1" result="$2"
            if [[ "$ran" == "true" ]]; then [[ "$result" == "success" ]]; else [[ "$result" == "skipped" ]]; fi
          }
          require_covered "$PLUGIN_SELECTED" "$RUN_PLUGINS" plugins
          require_job "$RUN_PLUGINS" "$PLUGIN_RESULT"
      - name: Check out the reused-result verifier
        if: needs.changes.result == 'success' && needs.changes.outputs.reuse != '{}' && needs.changes.outputs.reuse != ''
        uses: actions/checkout@v7
        with:
          sparse-checkout: scripts/ci/common/verify-reused-ci-jobs.mjs
          sparse-checkout-cone-mode: false

      - name: Verify reused lane results
        if: needs.changes.result == 'success' && needs.changes.outputs.reuse != '{}' && needs.changes.outputs.reuse != ''
        env:
          GITHUB_TOKEN: ${{ github.token }}
          LITHE_CI_REUSE: ${{ needs.changes.outputs.reuse }}
        timeout-minutes: 95
        run: node scripts/ci/common/verify-reused-ci-jobs.mjs