pr-validate.yml

# yaml-language-server: $schema=https://json.schemastore.org/github-workflow.json

name: Validate Pull Request

on:
  pull_request:
    branches: [main]
  push:
    branches: [main]

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: read
  pull-requests: read

jobs:
  # Detect docs-only PRs to skip heavy CI (same pattern as hyperlight)
  docs-pr:
    runs-on: ubuntu-latest
    outputs:
      docs-only: ${{ steps.docs-only.outputs.result }}
    steps:
      - uses: actions/checkout@v6
        with:
          fetch-depth: 2
      - uses: dorny/paths-filter@v4
        id: changes
        with:
          filters: |
            docs:
              - '**/*.md'
            code:
              - 'src/**'
              - 'plugins/**'
              - 'builtin-modules/**'
              - 'tests/**'
              - 'scripts/**'
              - 'skills/**'
              - 'patterns/**'
              - 'package.json'
              - 'package-lock.json'
              - 'tsconfig.json'
              - 'vitest.config.ts'
              - 'Justfile'
              - 'Dockerfile'
              - '.github/workflows/**'
      - uses: actions/github-script@v9
        id: docs-only
        with:
          script: |
            return '${{ steps.changes.outputs.code }}' !== 'true';
          result-encoding: string

  # Lint, typecheck, and unit tests (needs KVM for sandbox tests)
  lint-and-test:
    name: Lint & Test
    needs: [docs-pr]
    if: needs.docs-pr.outputs.docs-only != 'true'
    runs-on: [self-hosted, Linux, X64, "1ES.Pool=hld-kvm-amd","JobId=hyperagent-pr-validate-${{ github.run_id }}-${{ github.run_number }}-${{ github.run_attempt }}"]
    steps:
      - uses: actions/checkout@v6

      - uses: actions/setup-node@v6
        with:
          node-version: "22"

      - uses: hyperlight-dev/ci-setup-workflow@v1.9.0
        with:
          rust-toolchain: "1.89"
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Install PDF test dependencies
        run: |
          sudo apt-get update -qq
          sudo apt-get install -y -qq poppler-utils qpdf fonts-dejavu-core

      - name: Setup
        run: just setup

      - name: Lint (TS + Rust)
        run: just lint-all

      - name: Test (TS + Rust)
        run: just test-all

  # Build and test on all hypervisor configurations (1ES runners have Rust + just)
  build-and-test:
    name: Build & Test (${{ matrix.build }})
    needs: [docs-pr]
    if: needs.docs-pr.outputs.docs-only != 'true'
    strategy:
      fail-fast: false
      matrix:
        build:
          - linux-kvm-debug
          - linux-kvm-release
          - linux-mshv-debug
          - linux-mshv-release
          - windows-whp-debug
          - windows-whp-release
        include:
          - build: linux-kvm-debug
            hypervisor: kvm
            config: debug
          - build: linux-kvm-release
            hypervisor: kvm
            config: release
          - build: linux-mshv-debug
            hypervisor: mshv
            config: debug
          - build: linux-mshv-release
            hypervisor: mshv
            config: release
          - build: windows-whp-debug
            hypervisor: whp
            config: debug
          - build: windows-whp-release
            hypervisor: whp
            config: release
    runs-on: ${{ fromJson(
      format('["self-hosted", "{0}", "X64", "1ES.Pool=hld-{1}-amd", "JobId={2}-{3}-{4}-{5}"]',
        matrix.hypervisor == 'whp' && 'Windows' || 'Linux',
        matrix.hypervisor == 'whp' && 'win2025' || matrix.hypervisor == 'mshv' && 'azlinux3-mshv' || 'kvm',
        matrix.build,
        github.run_id,
        github.run_number,
        github.run_attempt)) }}
    steps:
      - uses: actions/checkout@v6

      - uses: actions/setup-node@v6
        with:
          node-version: "22"

      - uses: hyperlight-dev/ci-setup-workflow@v1.9.0
        with:
          rust-toolchain: "1.89"
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Install PDF test dependencies
        if: matrix.hypervisor == 'kvm'
        run: |
          sudo apt-get update -qq
          sudo apt-get install -y -qq poppler-utils qpdf fonts-dejavu-core

      - name: Setup
        run: just setup

      - name: Build binary
        run: node scripts/build-binary.js ${{ matrix.config == 'release' && '--release' || '' }}

      - name: Run tests
        run: just test

      - name: Upload binary artifact
        if: matrix.config == 'release'
        uses: actions/upload-artifact@v7
        with:
          name: hyperagent-${{ matrix.build }}
          path: dist/
          retention-days: 7

  # Build Docker image (just setup builds deps + creates symlinks for Dockerfile COPY)
  build-docker:
    name: Build Docker Image
    needs: [docs-pr]
    if: needs.docs-pr.outputs.docs-only != 'true'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6

      - uses: actions/setup-node@v6
        with:
          node-version: "22"

      - uses: hyperlight-dev/ci-setup-workflow@v1.9.0
        with:
          rust-toolchain: "1.89"
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Setup
        run: just setup

      - name: Resolve symlinks for Docker context
        run: |
          if [ -L deps/js-host-api ]; then
            target=$(readlink -f deps/js-host-api)
            rm deps/js-host-api
            cp -r "$target" deps/js-host-api
          fi

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v4

      - name: Build Docker image
        uses: docker/build-push-action@v7
        with:
          context: .
          push: false
          tags: hyperagent:test
          build-args: |
            VERSION=${{ github.sha }}
          cache-from: type=gha
          cache-to: type=gha,mode=max

  # Gate PR merges on all jobs passing
  ci-status:
    name: CI Status
    needs: [docs-pr, lint-and-test, build-and-test, build-docker]
    if: always()
    runs-on: ubuntu-latest
    steps:
      - name: Check all jobs passed
        run: jq --exit-status 'all(.result == "success" or .result == "skipped")' <<< '${{ toJson(needs) }}'