source-candidate.yml

name: Source candidate
on:
  workflow_dispatch:
  workflow_call:
    inputs:
      revision:
        type: string
        required: true
env:
  MCODE_CANDIDATE_REVISION: ${{ inputs.revision || github.sha }}
concurrency:
  group: ${{ github.workflow }}-${{ inputs.revision || github.sha }}
  cancel-in-progress: false
permissions:
  contents: read
jobs:
  export:
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          ref: ${{ env.MCODE_CANDIDATE_REVISION }}
          fetch-depth: 0
      - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: "24"
          cache: pnpm
      - run: pnpm install --frozen-lockfile
      - name: Export committed source
        shell: bash
        run: |
          mkdir "$RUNNER_TEMP/candidate"
          node scripts/export-source-preview.mjs --out "$RUNNER_TEMP/candidate/minimax-code-source.tar.gz"
          node scripts/source-candidate.mjs unpack --archive "$RUNNER_TEMP/candidate/minimax-code-source.tar.gz" --revision "$REVISION" --destination "$RUNNER_TEMP/source-audit"
        env:
          REVISION: ${{ env.MCODE_CANDIDATE_REVISION }}
      - uses: ./.github/actions/setup-gitleaks
      - name: Scan history and the exact exported source
        shell: bash
        run: |
          gitleaks git --redact --config .gitleaks.toml --log-opts=--all
          gitleaks dir "$RUNNER_TEMP/source-audit" --redact --config .gitleaks.toml
      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: unverified-source-${{ env.MCODE_CANDIDATE_REVISION }}
          path: ${{ runner.temp }}/candidate/
          retention-days: 1
          overwrite: true
          if-no-files-found: error
  validate:
    needs: export
    runs-on: ${{ matrix.os }}
    timeout-minutes: 20
    strategy:
      fail-fast: false
      matrix:
        # Windows validation is temporarily paused until its checks are reliable.
        os: [ubuntu-latest, macos-latest]
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          ref: ${{ env.MCODE_CANDIDATE_REVISION }}
      - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: "24"
          cache: pnpm
      - run: pnpm install --frozen-lockfile
      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
        with:
          name: unverified-source-${{ env.MCODE_CANDIDATE_REVISION }}
          path: ${{ runner.temp }}/candidate
      - name: Authenticate and unpack into a fresh directory
        shell: bash
        run: node scripts/source-candidate.mjs unpack --archive "$RUNNER_TEMP/candidate/minimax-code-source.tar.gz" --revision "$REVISION" --destination "$RUNNER_TEMP/candidate-source"
        env:
          REVISION: ${{ env.MCODE_CANDIDATE_REVISION }}
      - name: Cold install from the exported source
        working-directory: ${{ runner.temp }}/candidate-source/minimax-code
        shell: bash
        run: pnpm install --frozen-lockfile --store-dir "$RUNNER_TEMP/candidate-store" --registry https://registry.npmjs.org/
      - name: Verify the exported source
        working-directory: ${{ runner.temp }}/candidate-source/minimax-code
        run: pnpm verify --profile archive
        env:
          MCODE_VERIFY_REPORT_DIR: ${{ runner.temp }}/candidate-report
          MCODE_VERIFY_REVISION: ${{ env.MCODE_CANDIDATE_REVISION }}
      - uses: ./.github/actions/setup-gitleaks
        if: runner.os == 'Linux'
      - name: Scan the candidate Linux distribution
        if: runner.os == 'Linux'
        shell: bash
        run: gitleaks dir "$RUNNER_TEMP/candidate-source/minimax-code/dist" --redact --config .gitleaks.toml
      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        if: ${{ always() }}
        timeout-minutes: 2
        with:
          name: candidate-validation-${{ matrix.os }}
          path: ${{ runner.temp }}/candidate-report/
          retention-days: 14
          overwrite: true
  publish:
    needs: [export, validate]
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          ref: ${{ env.MCODE_CANDIDATE_REVISION }}
      - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: "24"
          cache: pnpm
      - run: pnpm install --frozen-lockfile
      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
        with:
          name: unverified-source-${{ env.MCODE_CANDIDATE_REVISION }}
          path: ${{ runner.temp }}/candidate
      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
        with:
          pattern: candidate-validation-*
          path: ${{ runner.temp }}/candidate/reports
      - name: Require matching Linux and macOS validation reports
        shell: bash
        run: node scripts/source-candidate.mjs finalize --archive "$RUNNER_TEMP/candidate/minimax-code-source.tar.gz" --revision "$REVISION" --reports "$RUNNER_TEMP/candidate/reports"
        env:
          REVISION: ${{ env.MCODE_CANDIDATE_REVISION }}
      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: source-candidate-${{ env.MCODE_CANDIDATE_REVISION }}
          path: ${{ runner.temp }}/candidate/
          retention-days: 14
          overwrite: true
          if-no-files-found: error