workdsh/.github/workflows/ci.yml

name: CI

on:
  pull_request:
    branches: [master]
  push:
    branches: [master]
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: ci-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

env:
  DSH_TELEMETRY_DISABLED: '1'

jobs:
  # Keep required checks conclusive for documentation-only changes. Workflow
  # path filters can leave required checks pending, so classify inside the run.
  changes:
    runs-on: ubuntu-latest
    outputs:
      product: ${{ steps.scope.outputs.product }}
    steps:
      - uses: actions/checkout@v6
        with:
          fetch-depth: 0
          persist-credentials: false
      - uses: actions/setup-node@v6
        with:
          node-version: 22.23.2
      - name: Classify changed paths
        id: scope
        shell: bash
        env:
          EVENT_NAME: ${{ github.event_name }}
          BASE_SHA: ${{ github.event.pull_request.base.sha || github.event.before }}
          HEAD_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
        run: |
          set -euo pipefail
          node --test scripts/bilingual-docs.test.mjs
          node scripts/verify-bilingual-docs.mjs
          node --test scripts/market-dependency-direction.test.mjs
          node scripts/verify-market-dependency-direction.mjs
          if [[ "$EVENT_NAME" == "workflow_dispatch" || -z "$BASE_SHA" || "$BASE_SHA" =~ ^0+$ ]]; then
            product=true
          else
            git diff --check "$BASE_SHA" "$HEAD_SHA"
            product="$(git diff --name-only -z "$BASE_SHA" "$HEAD_SHA" | node scripts/classify-ci-changes.mjs)"
          fi
          echo "product=$product" >> "$GITHUB_OUTPUT"

  # Full product gate: build, typecheck, unit tests, and every headless smoke.
  # A documentation-only change already passed diff validation in `changes`.
  check:
    needs: changes
    runs-on: ubuntu-latest
    steps:
      - name: Documentation-only gate
        if: needs.changes.outputs.product == 'false'
        run: echo "Documentation-only change; product build and tests are not required."
      - uses: actions/checkout@v6
        if: needs.changes.outputs.product == 'true'
        with:
          persist-credentials: false
          submodules: recursive
      - uses: actions/setup-node@v6
        if: needs.changes.outputs.product == 'true'
        with:
          node-version: 22.23.2
      - if: needs.changes.outputs.product == 'true'
        run: corepack enable
      - name: Resolve Yarn cache folder
        if: needs.changes.outputs.product == 'true'
        id: yarn-cache
        run: echo "dir=$(yarn config get cacheFolder)" >> "$GITHUB_OUTPUT"
      - uses: actions/cache@v6
        if: needs.changes.outputs.product == 'true'
        with:
          path: ${{ steps.yarn-cache.outputs.dir }}
          key: yarn-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('yarn.lock', '.yarnrc.yml') }}
      - if: needs.changes.outputs.product == 'true'
        run: yarn install --immutable
      - if: needs.changes.outputs.product == 'true'
        run: yarn check

  # Windows-only logic and unsigned NSIS/portable builds on a real Windows runner:
  # updates, window options, pwsh sandbox, volume diagnostics, and packaging.
  # The package gate runs once; both artifacts reuse its build output.
  desktop-windows:
    needs: changes
    if: needs.changes.outputs.product == 'true'
    runs-on: windows-latest
    steps:
      - uses: actions/checkout@v6
        with:
          persist-credentials: false
          submodules: recursive
      - uses: actions/setup-node@v6
        with:
          node-version: 22.23.2
      - run: corepack enable
      - name: Resolve Yarn cache folder
        id: yarn-cache
        run: echo "dir=$(yarn config get cacheFolder)" >> "$env:GITHUB_OUTPUT"
      - uses: actions/cache@v6
        with:
          path: ${{ steps.yarn-cache.outputs.dir }}
          key: yarn-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('yarn.lock', '.yarnrc.yml') }}
      - run: yarn install --immutable
      - run: yarn workspace dsh-plugin-desktop check:win-package
      - name: Build Windows installer
        env:
          DSH_PACKAGE_CHECK_ALREADY_RAN: '1'
        run: yarn workspace dsh-plugin-desktop dist:win
      - name: Build Windows portable archive
        env:
          DSH_PACKAGE_CHECK_ALREADY_RAN: '1'
        run: yarn workspace dsh-plugin-desktop dist:win-portable

  # macOS-only universal packaging smoke on a real macOS runner: the signed
  # release is built manually on a credentialed machine, so an unsigned DMG
  # here catches Intel and Apple Silicon packaging regressions before a manual
  # release. No signing secrets ever reach this job.
  desktop-macos:
    needs: changes
    if: needs.changes.outputs.product == 'true'
    runs-on: macos-latest
    timeout-minutes: 60
    steps:
      - uses: actions/checkout@v6
        with:
          persist-credentials: false
          submodules: recursive
      - uses: actions/setup-node@v6
        with:
          node-version: 22.23.2
      - run: corepack enable
      - name: Resolve Yarn cache folder
        id: yarn-cache
        run: echo "dir=$(yarn config get cacheFolder)" >> "$GITHUB_OUTPUT"
      - uses: actions/cache@v6
        with:
          path: ${{ steps.yarn-cache.outputs.dir }}
          key: yarn-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('yarn.lock', '.yarnrc.yml') }}
      - run: yarn install --immutable
      - run: yarn workspace dsh-plugin-desktop check:mac-package
      - name: Build macOS smoke artifact
        env:
          DSH_PACKAGE_CHECK_ALREADY_RAN: '1'
        run: yarn workspace dsh-plugin-desktop dist:mac-smoke

  # Upstream toolchain smoke: the portable-shell scripts must resolve the
  # pinned submodule's own Yarn/pnpm release on Windows.
  upstream-command-windows:
    needs: changes
    if: needs.changes.outputs.product == 'true'
    runs-on: windows-latest
    steps:
      - uses: actions/checkout@v6
        with:
          persist-credentials: false
          submodules: recursive
      - uses: actions/setup-node@v6
        with:
          node-version: 22.23.2
      - run: corepack enable
      - run: yarn check:layout
      - run: yarn upstream:version