ci.yml

name: CI

on:
  pull_request:
    branches: [ main ]
  push:
    branches: [ main ]

jobs:
  shellcheck:
    name: Shell Linting
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Run ShellCheck
        uses: ludeeus/action-shellcheck@master
        with:
          scandir: "."
          format: gcc
          severity: error
          ignore_paths: ".github"

  test:
    name: Basic Tests
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Test help output
        run: |
          ./deva.sh --help
          ./claude-yolo --help

      - name: Test version output
        run: |
          ./deva.sh --version
          ./claude-yolo --version

      - name: Check version consistency
        run: |
          chmod +x scripts/version-check.sh
          ./scripts/version-check.sh

  smoke:
    name: Installer Smoke Test
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup Node
        uses: actions/setup-node@v4
        with:
          node-version: "22"

      - name: Resolve tool versions
        id: versions
        env:
          GH_TOKEN: ${{ github.token }}
        run: bash ./scripts/resolve-tool-versions.sh

      - name: Build local smoke image
        run: |
          docker build -t deva-smoke:ci \
            --build-arg CLAUDE_CODE_VERSION="${{ steps.versions.outputs.claude_code_version }}" \
            --build-arg CODEX_VERSION="${{ steps.versions.outputs.codex_version }}" \
            --build-arg GEMINI_CLI_VERSION="${{ steps.versions.outputs.gemini_cli_version }}" \
            --build-arg ATLAS_CLI_VERSION="${{ steps.versions.outputs.atlas_cli_version }}" \
            --build-arg COPILOT_API_VERSION="${{ steps.versions.outputs.copilot_api_version }}" \
            .

      - name: Build core and rust images via Makefile
        run: |
          make build-core build-rust-image \
            IMAGE_NAME=deva-smoke \
            TAG=ci \
            CORE_TAG=ci-core \
            RUST_TAG=ci-rust \
            CLAUDE_CODE_VERSION="${{ steps.versions.outputs.claude_code_version }}" \
            CODEX_VERSION="${{ steps.versions.outputs.codex_version }}" \
            GEMINI_CLI_VERSION="${{ steps.versions.outputs.gemini_cli_version }}" \
            ATLAS_CLI_VERSION="${{ steps.versions.outputs.atlas_cli_version }}" \
            COPILOT_API_VERSION="${{ steps.versions.outputs.copilot_api_version }}"

      - name: Install and launch each agent without a TTY
        shell: bash
        run: |
          set -euo pipefail
          export HOME="$(mktemp -d)"
          export PATH="$HOME/.local/bin:$PATH"
          export DEVA_INSTALL_BASE_URL="file://$PWD"
          export DEVA_DOCKER_IMAGE="deva-smoke"
          export DEVA_DOCKER_TAG="ci"
          export DEVA_DOCKER_IMAGE_FALLBACK=""
          export DEVA_NO_DOCKER=1

          bash ./install.sh

          deva.sh claude -Q -- --version
          deva.sh codex -Q -- --version
          deva.sh gemini -Q -- --version

      - name: Smoke Claude --chrome mount assembly
        shell: bash
        run: |
          set -euo pipefail
          tmp_root="$(mktemp -d)"
          bridge_dir="$tmp_root/claude-mcp-browser-bridge-$(id -un)"
          profile_dir="$tmp_root/chrome/Default"

          mkdir -p "$bridge_dir"
          chmod 700 "$bridge_dir"
          mkdir -p "$profile_dir/Extensions/fcoeoabgfenejglbffodgkkbkcdhcgfn/1.0.0"

          dry_run="$(
            DEVA_DOCKER_IMAGE=deva-smoke \
            DEVA_DOCKER_TAG=ci \
            DEVA_CHROME_PROFILE_PATH="$profile_dir" \
            DEVA_HOST_CHROME_BRIDGE_DIR="$bridge_dir" \
            ./deva.sh claude --debug --dry-run -- --chrome 2>&1
          )"

          printf '%s\n' "$dry_run"
          grep -F -- "$bridge_dir:/deva-host-chrome-bridge" <<<"$dry_run"
          grep -F -- "$profile_dir/Extensions:/home/deva/.config/google-chrome/Default/Extensions:ro" <<<"$dry_run"

      - name: Smoke Chrome bridge entrypoint symlink
        shell: bash
        run: |
          set -euo pipefail
          tmp_root="$(mktemp -d)"
          bridge_dir="$tmp_root/claude-mcp-browser-bridge-$(id -un)"

          mkdir -p "$bridge_dir"
          chmod 700 "$bridge_dir"

          docker run --rm \
            -e DEVA_AGENT=claude \
            -e DEVA_UID="$(id -u)" \
            -e DEVA_GID="$(id -g)" \
            -e DEVA_CHROME_HOST_BRIDGE=1 \
            -e DEVA_CHROME_HOST_BRIDGE_DIR=/deva-host-chrome-bridge \
            -v "$bridge_dir:/deva-host-chrome-bridge" \
            deva-smoke:ci \
            bash -lc 'link="/tmp/claude-mcp-browser-bridge-$(id -un)"; test -L "$link"; test "$(readlink "$link")" = "/deva-host-chrome-bridge"'

      - name: Smoke tmux-bridge CLI surface
        shell: bash
        run: |
          set -euo pipefail
          # tmux-bridge is the layer-2 agent comms CLI vendored from smux.
          # We assert it's installed, executable, runs outside a tmux pane for
          # the version/help/id error paths, and that tmux itself is present
          # so a future operator can drive tmux-bridge against host tmux.
          docker run --rm deva-smoke:ci bash -lc '
            set -euo pipefail
            command -v tmux-bridge
            command -v tmux
            tmux-bridge version
            tmux-bridge --help | grep -q "cross-pane communication"
            # id requires $TMUX_PANE; outside tmux it must error cleanly.
            if tmux-bridge id 2>/dev/null; then
              echo "tmux-bridge id should fail outside a tmux pane" >&2
              exit 1
            fi
            # Ephemeral tmux server to prove list/name/read/type work end-to-end.
            sock="/tmp/tmux-smoke.sock"
            tmux -S "$sock" new-session -d -s smoke "sleep 30"
            export TMUX_BRIDGE_SOCKET="$sock"
            tmux-bridge list | tee /tmp/list.out
            grep -q "smoke:0" /tmp/list.out
            target="$(tmux -S "$sock" display-message -p "#{pane_id}")"
            tmux-bridge name "$target" smoke-worker
            tmux-bridge resolve smoke-worker
            tmux-bridge read "$target" 5 >/dev/null
            # read-guard: must read before type; second type without read must fail
            tmux-bridge type smoke-worker "echo hi"
            if tmux-bridge type smoke-worker "echo twice" 2>/dev/null; then
              echo "read-guard should have blocked second type without read" >&2
              exit 1
            fi
            tmux -S "$sock" kill-server
          '

  docs:
    name: Docs Build
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: "3.x"

      - name: Install MkDocs
        run: |
          python -m pip install --upgrade pip
          python -m pip install -r docs-requirements.txt

      - name: Build docs
        run: mkdocs build --strict