# AITURK IDE ajan CI (kart turkservis-20261007-1421-2).
#
# Bu depo bir yukari akis catalidir; .github/workflows altindaki GitHub is akislari Gitea'da kosmaz. .gitea/workflows
# klasoru var oldugu surece Gitea yalniz buradaki is akislarini okur.
#
# Ne kosar: korumali talimat dosyasi onay kapisinin testleri (insana sorulamayan kosuda aninda BLOCKED, gec onayin
# uygulanmamasi, yolo ile kapinin acilmamasi) ve dosya yazma guvenligi testleri. Kosucu Windows'tur (etiket
# windows-latest; 7 Ekim 2026'da cevrimici kosucu hermes-laptop-windows): urunun hedefi Windows x64'tur ve hata
# Windows asama kosusunda gorulmustur.
#
# Ne sayilmaz (durustluk notu): tests/tools/test_file_write_safety.py icindeki 7 test Windows'ta bu degisiklikten
# bagimsiz olarak gecemez; yukari akis bunlari POSIX icin yazmistir (/etc, /private/etc, /boot yollari; yonetici
# ayricaligi isteyen symlink; POSIX stat alanlari). Asagida adlariyla deselect edilir; degismemis 58dbb4523b
# commit'inde de ayni 7 test kaliyordu (7 Ekim 2026 olcumu). Tam yukari akis test takimi burada KOSMAZ.
name: ci

on:
  push:
    branches:
      - aiturk/main
      - fix/ide-windows-vcruntime
  workflow_dispatch:

permissions:
  contents: read

jobs:
  mobile-link-windows:
    runs-on: windows-latest
    timeout-minutes: 15
    steps:
      - uses: https://gitea.twinpay.one/yilsem/ci-actions-checkout@11d5960a326750d5838078e36cf38b85af677262 # upstream v4.4.0
        with:
          github-server-url: https://gitea.twinpay.one
      - name: Mobil TLS, profil ve baslatma regresyonlari
        shell: powershell
        run: |
          $ErrorActionPreference = 'Stop'
          $deps = Join-Path $env:RUNNER_TEMP "mobile-tests-$env:GITHUB_RUN_ID"
          New-Item -ItemType Directory -Force -Path $deps | Out-Null
          npm install --prefix $deps --no-save --ignore-scripts --no-audit --no-fund --legacy-peer-deps vitest@4.1.10 ws@8.21.1
          if ($LASTEXITCODE -ne 0) { throw 'Test bagimliliklari kurulamadi' }
          New-Item -ItemType Junction -Path node_modules -Target (Join-Path $deps 'node_modules') | Out-Null
          node node_modules/vitest/vitest.mjs run --root apps/desktop --config vitest.mobile.config.ts
          exit $LASTEXITCODE
      - name: Codex koprusu (Python, bagimliliksiz) testleri
        shell: powershell
        run: |
          $ErrorActionPreference = 'Stop'
          $py = (Get-Command python -ErrorAction SilentlyContinue).Source
          if ($py) { & $py -m unittest discover -s apps/desktop/assets/codex-bridge }
          else { & py -3 -m unittest discover -s apps/desktop/assets/codex-bridge }
          exit $LASTEXITCODE

  approval-gate-windows:
    runs-on: windows-latest
    timeout-minutes: 40
    steps:
      - name: Kaynagi al
        uses: https://gitea.twinpay.one/yilsem/ci-actions-checkout@11d5960a326750d5838078e36cf38b85af677262 # upstream v4.4.0
        with:
          github-server-url: https://gitea.twinpay.one

      - name: Ortami kur
        shell: powershell
        run: |
          $ErrorActionPreference = 'Stop'
          "kosucu: $env:COMPUTERNAME / $env:USERNAME"
          "checkout SHA: $(git rev-parse HEAD) / beklenen: $env:GITHUB_SHA"
          $py = $null
          $launcher = Get-Command py -ErrorAction SilentlyContinue
          if ($launcher) { $py = (& $launcher.Source -3 -c 'import sys; print(sys.executable)').Trim() }
          if (-not $py) {
            $cmd = Get-Command python -ErrorAction SilentlyContinue
            if ($cmd -and $cmd.Source -notlike '*\WindowsApps\*') { $py = $cmd.Source }
          }
          if (-not $py) { throw 'Python bulunamadi' }
          "onyukleme python: $py"
          & $py -m pip install --quiet --disable-pip-version-check --target "$env:RUNNER_TEMP\uvboot" uv
          if ($LASTEXITCODE -ne 0) { throw 'uv kurulamadi' }
          $env:PYTHONPATH = "$env:RUNNER_TEMP\uvboot"
          & $py -m uv venv --python 3.11 "$env:RUNNER_TEMP\ci-venv"
          if ($LASTEXITCODE -ne 0) { throw 'venv olusturulamadi' }
          & $py -m uv pip install --python "$env:RUNNER_TEMP\ci-venv\Scripts\python.exe" -e . pytest
          if ($LASTEXITCODE -ne 0) { throw 'bagimliliklar kurulamadi' }
          $env:PYTHONPATH = ''
          & "$env:RUNNER_TEMP\ci-venv\Scripts\python.exe" --version

      - name: Onay kapisi testleri
        shell: powershell
        run: |
          $ErrorActionPreference = 'Continue'
          $env:PYTHONDONTWRITEBYTECODE = '1'
          $env:PYTHONUTF8 = '1'
          $venv = "$env:RUNNER_TEMP\ci-venv\Scripts\python.exe"
          $f = 'tests/tools/test_file_write_safety.py'
          $sayilmayan = @(
            "${f}::TestCheckSensitivePathMacOSBypass::test_etc_hosts_blocked",
            "${f}::TestCheckSensitivePathMacOSBypass::test_private_etc_hosts_blocked",
            "${f}::TestCheckSensitivePathMacOSBypass::test_private_etc_ssh_config_blocked",
            "${f}::TestCheckSensitivePathMacOSBypass::test_private_var_blocked",
            "${f}::TestCheckSensitivePathMacOSBypass::test_boot_still_blocked",
            "${f}::TestAtomicWrite::test_patch_routes_through_atomic_write",
            "${f}::TestProtectedInstructionFiles::test_symlink_to_protected_file_is_gated"
          )
          $deselect = @()
          foreach ($t in $sayilmayan) { $deselect += '--deselect'; $deselect += $t }
          "CI OZETI: Windows'ta sayilmayan (deselect) test sayisi: $($sayilmayan.Count)"
          $sayilmayan | ForEach-Object { "  sayilmadi: $_" }
          & $venv -m pytest tests/tools/test_protected_instruction_unattended.py $f `
            tests/tools/test_computer_use_approval_isolation.py tests/cli/test_cli_approval_ui.py `
            tests/cli/test_single_query_session_finalize.py `
            tests/hermes_cli/test_plugin_catalog.py tests/hermes_cli/test_aiturk_plugin_catalog.py `
            tests/hermes_cli/test_plugin_install_ref.py `
            tests/tui_gateway/test_mobile_subagents.py @deselect -q -p no:cacheprovider -rf
          $kod = $LASTEXITCODE
          "pytest cikis kodu: $kod"
          exit $kod