name: Server CI and Windows package

on:
  push:
    branches: [aiturk/main, fix/ide-windows-vcruntime]
  workflow_dispatch:

permissions:
  contents: read

jobs:
  verify:
    runs-on: ubuntu-24.04
    timeout-minutes: 40
    env:
      NODE_OPTIONS: --max-old-space-size=2560
      PYTHONDONTWRITEBYTECODE: '1'
    steps:
      - uses: actions/checkout@v4
        with:
          github-server-url: https://gitea.turkservis.online
      - name: Exact source and Linux test environment
        run: |
          set -eu
          test "$(git rev-parse HEAD)" = "$GITHUB_SHA"
          python3 -m venv "$RUNNER_TEMP/bootstrap"
          "$RUNNER_TEMP/bootstrap/bin/pip" install uv
          "$RUNNER_TEMP/bootstrap/bin/uv" venv --python 3.11 "$RUNNER_TEMP/ci-venv"
          "$RUNNER_TEMP/bootstrap/bin/uv" pip install --python "$RUNNER_TEMP/ci-venv/bin/python" -e . pytest
      - name: Approval gate and file safety on the server
        run: |
          "$RUNNER_TEMP/ci-venv/bin/python" -m pytest tests/tools/test_protected_instruction_unattended.py tests/tools/test_file_write_safety.py tests/tools/test_computer_use_approval_isolation.py tests/cli/test_cli_approval_ui.py tests/cli/test_single_query_session_finalize.py -q -p no:cacheprovider -rf
      - name: Codex bridge regression tests
        run: python3 -m unittest discover -s apps/desktop/assets/codex-bridge
      - name: Mobile and desktop startup regression tests
        run: |
          npm install --prefix "$RUNNER_TEMP/mobile-tests" --no-save --ignore-scripts --no-audit --no-fund --legacy-peer-deps vitest@4.1.10 ws@8.21.1
          ln -s "$RUNNER_TEMP/mobile-tests/node_modules" node_modules
          node node_modules/vitest/vitest.mjs run --root apps/desktop --config vitest.mobile.config.ts --maxWorkers=2

  windows-package:
    if: github.ref == 'refs/heads/fix/ide-windows-vcruntime'
    needs: verify
    runs-on: ubuntu-24.04
    timeout-minutes: 60
    # Windows packaging runs on Linux/Wine in the new server. No laptop runner.
    container: electronuserland/builder@sha256:b226b27b1a7e95ad25eb3d6414ea90c56c04eb6d8329967f4d721dce50b989ff
    env:
      NODE_OPTIONS: --max-old-space-size=2560
      CSC_IDENTITY_AUTO_DISCOVERY: 'false'
    steps:
      - uses: actions/checkout@v4
        with:
          github-server-url: https://gitea.turkservis.online
      - name: Install locked source dependencies
        run: npm ci --no-audit --no-fund
      - name: Build and package Windows x64
        run: |
          set -eu
          test "$(git rev-parse HEAD)" = "$GITHUB_SHA"
          npm run build --workspace=apps/desktop
          npm run builder --workspace=apps/desktop -- --win nsis zip --x64 --publish never
          git diff --exit-code
          cd apps/desktop/release
          sha256sum *.exe *.zip > SHA256SUMS
      - name: Preserve exact-source Windows package
        uses: actions/upload-artifact@v3
        with:
          name: aiturk-ide-windows-${{ github.sha }}
          if-no-files-found: error
          path: |
            apps/desktop/release/*.exe
            apps/desktop/release/*.zip
            apps/desktop/release/SHA256SUMS