ci.yml

name: CI

on:
  pull_request:
  push:
    branches: [main]
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: ci-${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true

jobs:
  knowledge-audit:
    name: Audit knowledge risks
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - name: Checkout
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
        with:
          fetch-depth: 0

      - name: Setup Go
        uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0
        with:
          go-version-file: packages/cli/go.mod

      - name: Setup pnpm
        uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v4.4.0
        with:
          version: 10

      - name: Setup Node
        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
        with:
          node-version: 22
          cache: pnpm

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Build viewer assets
        run: pnpm build:viewer

      - name: Audit knowledge risks
        run: |
          go build -o "$RUNNER_TEMP/okn" ./packages/cli/cmd/openknowledge
          mkdir -p "$RUNNER_TEMP/openknowledge-reports"
          "$RUNNER_TEMP/okn" --no-telemetry validate Wiki
          "$RUNNER_TEMP/okn" --no-telemetry claims validate --path Wiki --json \
            > "$RUNNER_TEMP/openknowledge-reports/claims-validation.json"
          "$RUNNER_TEMP/okn" --no-telemetry eval claims \
            .openknowledge/evals/wiki-claims.yaml Wiki --format json \
            --max-stale 0 --max-hallucinated 0 --max-unverified 0 \
            --out "$RUNNER_TEMP/openknowledge-reports/claim-replay.json"
          "$RUNNER_TEMP/okn" --no-telemetry audit Wiki \
            --baseline .openknowledge/audit-sources.json \
            --observe-remote \
            --fail-on high --format json --out "$RUNNER_TEMP/openknowledge-reports/audit.json"

      - name: Validate claim lifecycle against base
        if: github.event_name == 'pull_request' || (github.event_name == 'push' && github.event.before != '0000000000000000000000000000000000000000')
        env:
          BASE_SHA: ${{ github.event.pull_request.base.sha || github.event.before }}
        run: |
          git worktree add --detach "$RUNNER_TEMP/openknowledge-base" "$BASE_SHA"
          "$RUNNER_TEMP/okn" --no-telemetry claims validate --path Wiki \
            --against "$RUNNER_TEMP/openknowledge-base/Wiki" --json \
            > "$RUNNER_TEMP/openknowledge-reports/claims-lifecycle.json"

      - name: Upload knowledge audit report
        if: always()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: knowledge-audit-report
          path: ${{ runner.temp }}/openknowledge-reports
          if-no-files-found: error
          retention-days: 14

  knowledge-eval:
    if: github.event_name == 'pull_request' || (github.event_name == 'push' && github.event.before != '0000000000000000000000000000000000000000')
    uses: ./.github/workflows/knowledge-eval.yml
    with:
      dataset: .openknowledge/evals/wiki.yaml
      target: Wiki
      base_ref: ${{ github.event.pull_request.base.sha || github.event.before }}
      gate: regressions

  verify:
    runs-on: ubuntu-latest
    timeout-minutes: 30
    steps:
      - name: Checkout
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1

      - name: Reject tracked viewer build output
        shell: bash
        run: |
          tracked="$(git ls-files -- packages/cli/cmd/openknowledge/viewer_assets)"
          if [ -n "$tracked" ]; then
            echo "Compiled viewer assets must not be committed:" >&2
            printf '%s\n' "$tracked" >&2
            exit 1
          fi

      - name: Setup Go
        uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0
        with:
          go-version-file: packages/cli/go.mod

      - name: Setup pnpm
        uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v4.4.0
        with:
          version: 10

      - name: Setup Node
        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
        with:
          node-version: 22
          cache: pnpm

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Verify Go modules are tidy
        shell: bash
        run: |
          go -C packages/cli mod tidy
          git diff --exit-code -- packages/cli/go.mod packages/cli/go.sum

      - name: Verify source formatting
        run: pnpm check:format

      - name: Test
        run: pnpm test

      - name: Gate deterministic retrieval quality
        run: |
          go build -o "$RUNNER_TEMP/okn-retrieval" ./packages/cli/cmd/openknowledge
          "$RUNNER_TEMP/okn-retrieval" --no-telemetry eval retrieval \
            packages/cli/internal/eval/testdata/earnings-retrieval-v1/retrieval.yaml \
            packages/cli/internal/eval/testdata/earnings-retrieval-v1/knowledge
          "$RUNNER_TEMP/okn-retrieval" --no-telemetry eval retrieval \
            .openknowledge/evals/wiki-retrieval.yaml Wiki

      - name: Test Go race safety and collect coverage
        run: |
          pnpm test:race
          pnpm test:coverage
          go tool cover -func=coverage.out

      - name: Vet
        run: go vet ./packages/cli/...

      - name: Build
        run: pnpm build

      - name: Install browser test runtime
        run: pnpm exec playwright install --with-deps chromium

      - name: Test browser journeys and accessibility
        run: pnpm test:browser

      - name: Validate repository wiki
        run: ./bin/openknowledge validate Wiki

  go-platforms:
    name: Go tests (${{ matrix.os }})
    runs-on: ${{ matrix.os }}
    timeout-minutes: 30
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, macos-latest, windows-latest]
    steps:
      - name: Checkout
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1

      - name: Setup Go
        uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0
        with:
          go-version-file: packages/cli/go.mod

      - name: Setup pnpm
        uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v4.4.0
        with:
          version: 10

      - name: Setup Node
        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
        with:
          node-version: 22
          cache: pnpm

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Build viewer assets
        run: pnpm build:viewer

      - name: Test CLI
        run: go test -timeout 20m ./packages/cli/...

      - name: Build CLI
        run: go build ./packages/cli/cmd/openknowledge

  node-20:
    name: Node 20 compatibility
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - name: Checkout
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1

      - name: Setup pnpm
        uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v4.4.0
        with:
          version: 10

      - name: Setup Node
        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
        with:
          node-version: 20
          cache: pnpm

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Test supported Node baseline
        run: |
          pnpm test:npm-install
          pnpm test:packed-npm
          pnpm test:web
          pnpm build:web