ci.yml

name: ci

on:
  pull_request:
  pull_request_review:
    types: [submitted, edited, dismissed]
  pull_request_review_comment:
    types: [created, edited, deleted]
  issue_comment:
    types: [created, edited, deleted]
  push:
    branches:
      - main
      - dev
  schedule:
    - cron: "0 3 * * *"
  workflow_dispatch:

concurrency:
  group: ci-${{ github.workflow }}-${{ github.ref }}-${{ github.event_name }}
  cancel-in-progress: true

env:
  # Framework fallback reads these names via Environment.GetEnvironmentVariable(...)
  DEEPSEEK_API_KEY: ${{ secrets.DEEPSEEK_API_KEY }}
  OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
  AEVATAR_LLM_API_KEY: ${{ secrets.AEVATAR_LLM_API_KEY }}
  CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
  # Optional test overrides for real OpenAI integration test.
  AEVATAR_TEST_OPENAI_BASE_URL: ${{ secrets.AEVATAR_TEST_OPENAI_BASE_URL }}
  AEVATAR_TEST_OPENAI_MODEL: ${{ secrets.AEVATAR_TEST_OPENAI_MODEL }}

jobs:
  changes:
    if: github.event_name == 'pull_request' || github.event_name == 'push' || github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'
    runs-on: ubuntu-latest
    outputs:
      docs_only: ${{ steps.docs_only_route.outputs.docs_only }}
      all_changed: ${{ steps.filter.outputs.all_changed }}
      core_code: ${{ steps.filter.outputs.core_code }}
      product_runtime: ${{ steps.filter.outputs.product_runtime }}
      host_composition: ${{ steps.filter.outputs.host_composition }}
      projection_provider: ${{ steps.filter.outputs.projection_provider }}
      kafka_runtime: ${{ steps.filter.outputs.kafka_runtime }}
      event_sourcing: ${{ steps.filter.outputs.event_sourcing }}
      console_web: ${{ steps.filter.outputs.console_web }}
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Detect Changed Paths
        id: filter
        uses: dorny/paths-filter@v3
        with:
          filters: |
            all_changed:
              - '**'
            docs_only:
              - '**/*.md'
              - 'docs/**'
              - 'LICENSE'
              - 'CHANGELOG*'
              - '.github/ISSUE_TEMPLATE/**'
              - '.gitignore'
            core_code:
              - 'src/**'
              - 'test/**'
              - 'aevatar.slnx'
              - 'aevatar.*.slnf'
              - '.editorconfig'
              - 'Directory.Build.props'
              - 'Directory.Packages.props'
              - 'global.json'
              - 'tools/ci/**'
              - '.github/workflows/ci.yml'
            product_runtime:
              - 'src/**'
              - 'agents/**'
              - 'aevatar.slnx'
              - 'aevatar.*.slnf'
              - '.editorconfig'
              - 'Directory.Build.props'
              - 'Directory.Packages.props'
              - 'global.json'
              - 'scripts/run.sh'
              - 'tools/ci/main_flow_runtime_smoke.sh'
              - '.github/workflows/ci.yml'
            host_composition:
              - 'src/**'
              - 'test/**'
              - 'aevatar.slnx'
              - 'aevatar.*.slnf'
              - '.editorconfig'
              - 'Directory.Build.props'
              - 'Directory.Packages.props'
              - 'global.json'
              - 'tools/ci/host_composition_smoke.sh'
              - '.github/workflows/ci.yml'
            projection_provider:
              - 'docker-compose.projection-providers.yml'
              - 'src/Aevatar.CQRS.Projection.*/**'
              - 'src/Aevatar.CQRS.Projection.Core/**'
              - 'src/workflow/Aevatar.Workflow.Projection/**'
              - 'src/workflow/extensions/Aevatar.Workflow.Extensions.Hosting/**'
              - 'src/workflow/Aevatar.Workflow.Infrastructure/DependencyInjection/WorkflowCapabilityServiceCollectionExtensions.cs'
              - 'test/Aevatar.CQRS.Projection.Core.Tests/**'
              - 'test/Aevatar.Workflow.Host.Api.Tests/**'
              - 'tools/ci/projection_provider_e2e_smoke.sh'
              - '.github/workflows/ci.yml'
            kafka_runtime:
              - 'docker-compose.yml'
              - 'src/Aevatar.Foundation.Runtime*/**'
              - 'test/Aevatar.Foundation.Runtime.Hosting.Tests/**'
              - 'tools/ci/kafka_transport_integration_smoke.sh'
              - '.github/workflows/ci.yml'
            event_sourcing:
              - 'src/Aevatar.Foundation.Core/**'
              - 'src/Aevatar.Foundation.Runtime/**'
              - 'src/Aevatar.Foundation.Runtime.Implementations.Orleans/**'
              - 'src/Aevatar.Foundation.Runtime.Persistence.Implementations.Garnet/**'
              - 'test/Aevatar.Foundation.Core.Tests/**'
              - 'test/Aevatar.Foundation.Runtime.Hosting.Tests/**'
              - 'test/Aevatar.SecretStore.Tools.Tests/**'
              - 'tools/secret-store/**'
              - 'tools/ci/event_sourcing_regression.sh'
              - 'tools/ci/orleans_garnet_persistence_smoke.sh'
              - 'tools/ci/architecture_guards.sh'
              - '.github/workflows/ci.yml'
            console_web:
              - 'apps/aevatar-console-web/**'
              - '.github/workflows/ci.yml'

      - name: Resolve Doc-Only Route
        id: docs_only_route
        env:
          ALL_CHANGED_COUNT: ${{ steps.filter.outputs.all_changed_count }}
          DOCS_ONLY_COUNT: ${{ steps.filter.outputs.docs_only_count }}
        run: |
          if [ "${ALL_CHANGED_COUNT:-0}" != "0" ] && [ "${ALL_CHANGED_COUNT:-0}" = "${DOCS_ONLY_COUNT:-0}" ]; then
            echo "docs_only=true" >> "$GITHUB_OUTPUT"
          else
            echo "docs_only=false" >> "$GITHUB_OUTPUT"
          fi

  fkst-host-policy:
    if: |
      github.event_name == 'pull_request' ||
      (
        github.event_name == 'pull_request_review' &&
        (vars.FKST_GITHUB_BOT_LOGIN == '' || github.actor != vars.FKST_GITHUB_BOT_LOGIN)
      ) ||
      (
        github.event_name == 'pull_request_review_comment' &&
        (vars.FKST_GITHUB_BOT_LOGIN == '' || github.actor != vars.FKST_GITHUB_BOT_LOGIN)
      ) ||
      (
        github.event_name == 'issue_comment' &&
        github.event.issue.pull_request &&
        (vars.FKST_GITHUB_BOT_LOGIN == '' || github.actor != vars.FKST_GITHUB_BOT_LOGIN)
      )
    runs-on: ubuntu-latest
    timeout-minutes: 10
    permissions:
      contents: read
      pull-requests: read
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: FKST Host Policy Guard
        env:
          GH_TOKEN: ${{ github.token }}
          GITHUB_EVENT_NAME: ${{ github.event_name }}
          GITHUB_BASE_REF: ${{ github.base_ref || github.event.pull_request.base.ref }}
          GITHUB_BASE_SHA: ${{ github.event.pull_request.base.sha }}
          GITHUB_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
          PR_NUMBER: ${{ github.event.pull_request.number || github.event.issue.number }}
        run: bash tools/ci/fkst_host_policy_guard.sh

  runtime-main-flow-smoke:
    if: needs.changes.outputs.docs_only == 'false' && needs.changes.outputs.product_runtime == 'true'
    needs: changes
    runs-on: ubuntu-latest
    timeout-minutes: 25
    steps:
      - uses: actions/checkout@v4

      - name: Prepare Runner
        uses: ./.github/actions/prepare-runner

      - name: Main Flow Runtime Smoke
        run: bash scripts/run.sh main-flow-smoke

  fast-gates:
    # Refactor (iter16/cluster-ci-systemic-refactor):
    #   Old pattern: fast-gates skipped scheduled CI and ran for workflow_dispatch or core_code changes
    #   New principle: skip scheduled/doc-only CI while keeping workflow_dispatch active
    if: github.event_name != 'schedule' && needs.changes.outputs.docs_only == 'false'
    needs: changes
    runs-on: ubuntu-latest
    timeout-minutes: 20
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Prepare Runner
        uses: ./.github/actions/prepare-runner
        with:
          setup-dotnet: "false"
          cache-nuget: "false"
          install-ripgrep: "true"
          install-buf: "true"

      - name: Architecture Guards (full-scan + projection route mapping)
        env:
          GITHUB_EVENT_NAME: ${{ github.event_name }}
          GITHUB_BASE_REF: ${{ github.base_ref }}
          GITHUB_EVENT_BEFORE: ${{ github.event.before }}
          GITHUB_SHA: ${{ github.sha }}
        run: bash tools/ci/architecture_guards.sh

      - name: PR Size Guard (advisory)
        if: github.event_name == 'pull_request'
        env:
          GITHUB_BASE_REF: ${{ github.base_ref }}
          GITHUB_BASE_SHA: ${{ github.event.pull_request.base.sha }}
          GITHUB_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
        run: bash tools/ci/pr_size_guard.sh

      - name: Test Stability Guards
        run: bash tools/ci/test_stability_guards.sh

  console-web:
    # Refactor (iter16/cluster-ci-systemic-refactor):
    #   Old pattern: console-web skipped scheduled CI and ran for every PR, workflow_dispatch, main/dev push, or console_web changes
    #   New principle: gate on changes.outputs.console_web per Phase 9 #716 r3 consensus A
    if: needs.changes.outputs.docs_only == 'false' && needs.changes.outputs.console_web == 'true'
    needs: changes
    runs-on: ubuntu-latest
    # The serial suite grew into this budget: recent runs took 19m02s, 19m35s,
    # 19m57s, then 20m10s and 20m17s, the last two cancelled mid-test at the
    # 20m cap. The ~18m of test work is real, so give it headroom rather than
    # letting every run decide the build on runner jitter.
    timeout-minutes: 35
    steps:
      - uses: actions/checkout@v4

      - name: Setup pnpm
        uses: pnpm/action-setup@v4
        with:
          version: 10.2.1
          run_install: false

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: 20
          cache: pnpm
          cache-dependency-path: apps/aevatar-console-web/pnpm-lock.yaml

      - name: Install console-web dependencies
        run: pnpm --dir apps/aevatar-console-web install --frozen-lockfile

      - name: Type-check console-web
        run: pnpm --dir apps/aevatar-console-web tsc

      - name: Test console-web
        run: pnpm --dir apps/aevatar-console-web test --runInBand

      - name: Build console-web
        run: pnpm --dir apps/aevatar-console-web build

  slow-test-guards:
    needs: changes
    # Refactor (iter18/cluster-019-strict-coverage-aevatar-slnx):
    #   Old pattern: coverage_quality_guard.sh 吞 test fail 继续 emit coverage;split-test-guards 漏跑 22 orphan project
    #   New principle: strict-coverage fail-fast(不吞 fail);aevatar.slnx-or-slow-test 唯一测试权威;
    #   retire slnf 测试执行(只保留 slnf build boundary);slow-tests 独立 CI job
    if: |
      github.event_name == 'schedule' ||
      github.event_name == 'workflow_dispatch' ||
      (github.event_name == 'push' && (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/dev')) ||
      (
        needs.changes.outputs.docs_only == 'false' &&
        needs.changes.outputs.core_code == 'true'
      )
    runs-on: ubuntu-latest
    timeout-minutes: 25
    steps:
      - uses: actions/checkout@v4

      - name: Prepare Runner
        uses: ./.github/actions/prepare-runner

      - name: Run slow test guard
        run: bash tools/ci/slow_test_guards.sh

  projection-provider-e2e:
    # Refactor (iter16/cluster-ci-systemic-refactor):
    #   Old pattern: projection-provider-e2e skipped scheduled CI and ran for every PR, workflow_dispatch, main/dev push, or projection_provider changes
    #   New principle: gate on changes.outputs.projection_provider per Phase 9 #716 r3 consensus A
    if: needs.changes.outputs.docs_only == 'false' && needs.changes.outputs.projection_provider == 'true'
    needs:
      - changes
    runs-on: ubuntu-latest
    timeout-minutes: 25
    steps:
      - uses: actions/checkout@v4

      - name: Prepare Runner
        uses: ./.github/actions/prepare-runner
        with:
          install-ripgrep: "true"

      - name: Projection Provider E2E Smoke Test
        run: bash tools/ci/projection_provider_e2e_smoke.sh

      - name: Upload workflow report-artifact benchmark
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: workflow-report-artifact-write-cost
          path: artifacts/ci/workflow-report-artifact-write-cost.txt
          if-no-files-found: warn

  kafka-transport-integration:
    # Refactor (iter16/cluster-ci-systemic-refactor):
    #   Old pattern: kafka-transport-integration skipped scheduled CI and ran for every PR, workflow_dispatch, main/dev push, or kafka_runtime changes
    #   New principle: gate on changes.outputs.kafka_runtime per Phase 9 #716 r3 consensus A
    if: needs.changes.outputs.docs_only == 'false' && needs.changes.outputs.kafka_runtime == 'true'
    needs:
      - changes
    runs-on: ubuntu-latest
    timeout-minutes: 20
    steps:
      - uses: actions/checkout@v4

      - name: Prepare Runner
        uses: ./.github/actions/prepare-runner

      - name: Kafka Transport Integration Smoke Test
        run: bash tools/ci/kafka_transport_integration_smoke.sh

  event-sourcing-regression:
    # Refactor (iter16/cluster-ci-systemic-refactor):
    #   Old pattern: event-sourcing-regression skipped scheduled CI and ran for every PR, workflow_dispatch, main/dev push, or event_sourcing changes
    #   New principle: gate on changes.outputs.event_sourcing per Phase 9 #716 r3 consensus A
    if: needs.changes.outputs.docs_only == 'false' && needs.changes.outputs.event_sourcing == 'true'
    needs:
      - changes
    runs-on: ubuntu-latest
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@v4

      - name: Prepare Runner
        uses: ./.github/actions/prepare-runner
        with:
          install-ripgrep: "true"
          install-buf: "true"

      - name: EventSourcing Regression
        run: bash tools/ci/event_sourcing_regression.sh

  host-composition-smoke:
    needs: changes
    # Refactor (iter16/cluster-ci-systemic-refactor):
    #   Old pattern: host-composition-smoke skipped scheduled CI and ran for every PR, workflow_dispatch, or main/dev push
    #   New principle: gate on changes.outputs.host_composition per Phase 9 #716 r3 consensus A
    if: needs.changes.outputs.docs_only == 'false' && needs.changes.outputs.host_composition == 'true'
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@v4

      - name: Prepare Runner
        uses: ./.github/actions/prepare-runner

      - name: Host Composition Smoke (DI ValidateOnBuild)
        run: bash tools/ci/host_composition_smoke.sh

  coverage-quality:
    needs: changes
    # Refactor (iter18/cluster-019-strict-coverage-aevatar-slnx):
    #   Old pattern: coverage_quality_guard.sh 吞 test fail 继续 emit coverage;split-test-guards 漏跑 22 orphan project
    #   New principle: strict-coverage fail-fast(不吞 fail);aevatar.slnx-or-slow-test 唯一测试权威;
    #   retire slnf 测试执行(只保留 slnf build boundary);slow-tests 独立 CI job
    if: |
      github.event_name == 'schedule' ||
      github.event_name == 'workflow_dispatch' ||
      (github.event_name == 'push' && (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/dev')) ||
      needs.changes.outputs.docs_only == 'false'
    runs-on: ubuntu-latest
    # Full coverage takes 34-35 minutes after a roughly 10-minute restore/build,
    # then still needs time to upload the report. Keep the fail-fast guard while
    # leaving enough headroom for runner variance and cleanup.
    timeout-minutes: 55
    services:
      agent-tool-admission-redis:
        image: redis:7.2.3
        ports:
          - 6379:6379
        options: >-
          --health-cmd "redis-cli ping"
          --health-interval 5s
          --health-timeout 3s
          --health-retries 10
    env:
      AGENT_TOOL_ADMISSION_REDIS_CONNECTION_STRING: >-
        127.0.0.1:6379,abortConnect=true,allowAdmin=true,connectTimeout=5000,syncTimeout=5000
    steps:
      - uses: actions/checkout@v4

      - name: Prepare Runner
        uses: ./.github/actions/prepare-runner

      - name: Restore and Build
        run: bash tools/ci/restore_and_build.sh

      - name: Coverage Quality Guard
        env:
          COVERAGE_LINE_THRESHOLD: "85"
          COVERAGE_BRANCH_THRESHOLD: "72"
        run: bash tools/ci/coverage_quality_guard.sh

      - name: Upload coverage artifact
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: coverage-quality-report
          path: artifacts/coverage
          if-no-files-found: error

      - name: Upload coverage to Codecov
        if: ${{ success() && env.CODECOV_TOKEN != '' }}
        uses: codecov/codecov-action@v5
        with:
          files: ./artifacts/coverage/**/report/Cobertura.xml
          disable_search: true
          fail_ci_if_error: false
          flags: ci
          name: coverage-quality
          skip_validation: true
          verbose: true
        env:
          CODECOV_TOKEN: ${{ env.CODECOV_TOKEN }}

  distributed-3node-smoke:
    if: |
      github.event_name == 'schedule' ||
      github.event_name == 'workflow_dispatch'
    runs-on: ubuntu-latest
    timeout-minutes: 25
    steps:
      - uses: actions/checkout@v4

      - name: Prepare Runner
        uses: ./.github/actions/prepare-runner

      - name: 3-Node Distributed Smoke Test
        run: bash tools/ci/distributed_3node_smoke.sh

  distributed-mixed-version-smoke:
    needs: changes
    # Refactor (iter16/cluster-ci-systemic-refactor):
    #   Old pattern: distributed-mixed-version-smoke ran unconditionally on scheduled/manual CI, including doc-only changes
    #   New principle: preserve scheduled/manual health checks
    if: |
      github.event_name == 'schedule' ||
      github.event_name == 'workflow_dispatch'
    runs-on: ubuntu-latest
    timeout-minutes: 35
    steps:
      - uses: actions/checkout@v4

      - name: Prepare Runner
        uses: ./.github/actions/prepare-runner

      - name: Mixed-Version Distributed Smoke Test
        run: bash tools/ci/distributed_mixed_version_smoke.sh