name: Server CI and Windows package

on:
  push:
    branches: [aiturk/main, fix/ide-windows-vcruntime]
  workflow_dispatch:

permissions:
  contents: read

jobs:
  verify:
    runs-on: ubuntu-24.04
    timeout-minutes: 40
    env:
      NODE_OPTIONS: --max-old-space-size=2560
      PYTHONDONTWRITEBYTECODE: '1'
    steps:
      - uses: actions/checkout@v4
        with:
          github-server-url: https://gitea.turkservis.online
      - name: Exact source and Linux test environment
        run: |
          set -eu
          test "$(git rev-parse HEAD)" = "$GITHUB_SHA"
          apt-get update
          apt-get install -y --no-install-recommends ripgrep
          rg --version
          python3 -m venv "$RUNNER_TEMP/bootstrap"
          "$RUNNER_TEMP/bootstrap/bin/pip" install uv
          "$RUNNER_TEMP/bootstrap/bin/uv" venv --python 3.11 "$RUNNER_TEMP/ci-venv"
          "$RUNNER_TEMP/bootstrap/bin/uv" pip install --python "$RUNNER_TEMP/ci-venv/bin/python" -e . pytest zstandard
      - name: Approval gate and file safety on the server
        run: |
          "$RUNNER_TEMP/ci-venv/bin/python" -m pytest tests/tools/test_protected_instruction_unattended.py tests/tools/test_file_write_safety.py tests/tools/test_computer_use_approval_isolation.py tests/cli/test_cli_approval_ui.py tests/cli/test_single_query_session_finalize.py -q -p no:cacheprovider -rf
      - name: Codex bridge regression tests
        run: '"$RUNNER_TEMP/ci-venv/bin/python" -m unittest discover -s apps/desktop/assets/codex-bridge'
      - name: Project scoped and bounded search regressions
        run: '"$RUNNER_TEMP/ci-venv/bin/python" -m pytest tests/tools/test_search_project_scope.py tests/tools/test_search_files_cpu_windows.py tests/tools/test_search_zero_match_and_multipath.py tests/tools/test_search_giant_line_containment.py tests/tools/test_search_budget_truncation.py -q -p no:cacheprovider -rf'
      - name: Native watch and speech mux pytest regressions
        run: '"$RUNNER_TEMP/ci-venv/bin/python" -m pytest apps/desktop/assets/codex-bridge/test_bekci_watch.py apps/desktop/assets/codex-bridge/test_native_speech_mux.py apps/desktop/assets/codex-bridge/test_live_limits.py -q -p no:cacheprovider -rf'
      - name: Mobile and desktop startup regression tests
        run: |
          npm install --prefix "$RUNNER_TEMP/mobile-tests" --no-save --ignore-scripts --no-audit --no-fund --legacy-peer-deps vitest@4.1.10 ws@8.21.1
          ln -s "$RUNNER_TEMP/mobile-tests/node_modules" node_modules
          node node_modules/vitest/vitest.mjs run --root apps/desktop --config vitest.mobile.config.ts --maxWorkers=2

  windows-package:
    if: github.ref == 'refs/heads/fix/ide-windows-vcruntime'
    needs: verify
    runs-on: ubuntu-24.04
    timeout-minutes: 60
    # Windows packaging runs on Linux/Wine in the new server. No laptop runner.
    container: electronuserland/builder@sha256:b226b27b1a7e95ad25eb3d6414ea90c56c04eb6d8329967f4d721dce50b989ff
    env:
      NODE_OPTIONS: --max-old-space-size=2560
      CSC_IDENTITY_AUTO_DISCOVERY: 'false'
    steps:
      - uses: actions/checkout@v4
        with:
          github-server-url: https://gitea.turkservis.online
      - name: Install locked source dependencies
        run: npm ci --no-audit --no-fund
      - name: Install Windows launcher cross compiler and framework reference
        run: |
          set -eu
          apt-get update
          apt-get install -y --no-install-recommends mono-mcs=6.8.0.105+dfsg-3.2 libmono-system-web-extensions4.0-cil=6.8.0.105+dfsg-3.2
      - name: Compile Windows launcher from source and verify failure gate
        run: node --test apps/desktop/scripts/build-native-watch-launcher.test.mjs
      - name: Native dependency staging regression tests
        run: npx vitest run --root apps/desktop scripts/stage-native-deps.test.mjs --maxWorkers=2
      - name: Codex connection settings regression tests
        run: npx vitest run --root apps/desktop electron/codex-link.test.ts electron/codex-link-config.test.ts electron/staged-transition.test.ts electron/compression-settings.test.ts src/app/settings/codex-link-settings.test.tsx src/app/settings/staged-transition-settings.test.tsx src/app/settings/compression-settings.test.tsx --maxWorkers=2
      - name: Build and package Windows x64
        run: |
          set -eu
          test "$(git rev-parse HEAD)" = "$GITHUB_SHA"
          npm run build --workspace=apps/desktop
          npm run builder --workspace=apps/desktop -- --win nsis zip --x64 --publish never
          git diff --exit-code
          cd apps/desktop/release
          sha256sum *.exe *.zip > SHA256SUMS
      - name: Preserve exact-source Windows package
        uses: actions/upload-artifact@v3
        with:
          name: aiturk-ide-windows-${{ github.sha }}
          if-no-files-found: error
          path: |
            apps/desktop/release/*.exe
            apps/desktop/release/*.zip
            apps/desktop/release/SHA256SUMS