aego/.github/workflows/ci.yml

name: ci

on:
  push:
    branches: [master]
    tags: ["v*"]
  pull_request:

permissions:
  contents: read

env:
  GLSLANG_APT_VERSION: 15.1.0-2~ubuntu0.24.04.2
  SDL_AUDIO_DRIVER: dummy
  SDL_AUDIODRIVER: dummy
  LINUX_PKGS: >-
    build-essential cmake ninja-build pkg-config openssl
    libgl1-mesa-dev libegl1-mesa-dev libgles2-mesa-dev
    libx11-dev libxext-dev libxrandr-dev libxcursor-dev libxfixes-dev libxi-dev libxss-dev libxtst-dev libxkbcommon-dev
    libwayland-dev wayland-protocols libdecor-0-dev
    libasound2-dev libpulse-dev libdrm-dev libgbm-dev libudev-dev libdbus-1-dev libibus-1.0-dev

jobs:
  checks:
    if: github.server_url != 'https://github.com'
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-go@v5
        with:
          go-version-file: go.mod
      - uses: actions/setup-node@v4
        with:
          node-version: "24"
      - name: system packages
        run: sudo apt-get update && sudo apt-get install -y $LINUX_PKGS "glslang-tools=$GLSLANG_APT_VERSION" && bash tools/check-glslang.sh
      - uses: actions/cache@v4
        continue-on-error: true
        with:
          path: .cache/native
          key: native-linux_amd64-${{ hashFiles('third_party/sdl/version.txt', 'tools/bootstrap-native.sh') }}
      - run: bash tools/bootstrap-native.sh
      - run: go vet -cgocall=false -unsafeptr=false $(go list ./... | grep -v '/gpu/gl33/gl$')
      - run: go vet ./platform/sdl
      - run: make lint
      - run: make depcheck
      - name: Test worktree evidence inventory
        run: |
          PYTHONDONTWRITEBYTECODE=1 python3 -m unittest discover -s tools/ci -p worktree_manifest_test.py
          PYTHONDONTWRITEBYTECODE=1 python3 -m unittest discover -s tools/ci -p test_component_try_evidence.py
          PYTHONDONTWRITEBYTECODE=1 python3 -m unittest discover -s tools/ci -p test_integration_race.py
          PYTHONDONTWRITEBYTECODE=1 python3 -m unittest discover -s tools/ci -p test_protocol_install.py
      - name: Install isolated Asset Studio browser test environment
        run: |
          sudo apt-get install -y python3-venv xvfb xauth xdotool
          python3 -m venv "$RUNNER_TEMP/aego-artstudio-python"
          "$RUNNER_TEMP/aego-artstudio-python/bin/pip" install 'playwright==1.64.1'
          PLAYWRIGHT_BROWSERS_PATH="$RUNNER_TEMP/aego-artstudio-browsers" \
            "$RUNNER_TEMP/aego-artstudio-python/bin/python" -m playwright install --with-deps chromium firefox
      - name: Asset Studio snapshot and real browser integration
        id: artstudio_snapshot
        run: |
          export ARTSTUDIO_PYTHON="$RUNNER_TEMP/aego-artstudio-python/bin/python"
          export ARTSTUDIO_SNAPSHOT_DIR="$RUNNER_TEMP/aego-artstudio-evidence"
          export PLAYWRIGHT_BROWSERS_PATH="$RUNNER_TEMP/aego-artstudio-browsers"
          bash tools/ci/artstudio_snapshot_e2e.sh
      # The stock v4 GitHub action may reject Gitea as GHES on older runners.
      # This pinned Gitea-compatible fork uploads even a failed run's evidence.
      - name: Preserve Asset Studio snapshot evidence
        if: ${{ always() }}
        uses: https://github.com/ChristopherHX/gitea-upload-artifact@81f940d004763f986ba3582c007fd842dd5cb0d7
        with:
          name: asset-studio-snapshot-${{ github.run_id }}-${{ github.run_attempt }}
          if-no-files-found: warn
          retention-days: 14
          path: |
            ${{ runner.temp }}/aego-artstudio-evidence/*.log
            ${{ runner.temp }}/aego-artstudio-evidence/*.exit
            ${{ runner.temp }}/aego-artstudio-evidence/*.txt
            ${{ runner.temp }}/aego-artstudio-evidence/*.json
            ${{ runner.temp }}/aego-artstudio-evidence/*.sha256
            ${{ runner.temp }}/aego-artstudio-evidence/artifact/**
            ${{ runner.temp }}/aego-artstudio-evidence/site/asset-studio/**
            ${{ runner.temp }}/aego-artstudio-evidence/chromium-browser/**
            ${{ runner.temp }}/aego-artstudio-evidence/firefox-browser/**
            ${{ runner.temp }}/aego-artstudio-evidence/chromium-gpu-browser/**
            ${{ runner.temp }}/aego-artstudio-evidence/firefox-gpu-browser/**
            ${{ runner.temp }}/aego-artstudio-evidence/parity-replay/*.json
      - name: Full Aego regression and component Try
        env:
          PLAYWRIGHT_BROWSERS_PATH: ${{ runner.temp }}/aego-artstudio-browsers
          AEGO_TRY_FIREFOX_HEADED: "1"
        run: |
          set -euo pipefail
          (cd tools/websmoke && npm ci --no-audit --no-fund)
          chromium="$(cd tools/websmoke && node -e 'console.log(require("playwright-core").chromium.executablePath())')"
          export ARTSTUDIO_ARTIFACT="$RUNNER_TEMP/aego-artstudio-evidence/artifact"
          export ARTSTUDIO_MANIFEST_SHA256="$(cat "$RUNNER_TEMP/aego-artstudio-evidence/manifest.sha256")"
          mkdir -p "$RUNNER_TEMP/aego-full-ci"
          set +e
          xvfb-run -a -s '-screen 0 1440x1050x24' make ci XVFB= CHROMIUM="$chromium" \
            >"$RUNNER_TEMP/aego-full-ci/make-ci.log" 2>&1
          result=$?
          set -e
          printf '%s\n' "$result" >"$RUNNER_TEMP/aego-full-ci/make-ci.exit"
          tail -n 100 "$RUNNER_TEMP/aego-full-ci/make-ci.log"
          if [ "$result" -ne 0 ]; then exit "$result"; fi
          python3 -B tools/ci/component_try_evidence.py verify --root "$PWD" \
            --report .cache/component-try.json --evidence .cache/component-try-evidence \
            --wasm site/try/aego-docs.wasm --output "$RUNNER_TEMP/aego-full-ci/component-try-verified.json"
      - name: Native authoring and installed Linux protocol
        env:
          PLAYWRIGHT_BROWSERS_PATH: ${{ runner.temp }}/aego-artstudio-browsers
        run: |
          set -euo pipefail
          run_gate() {
            local name="$1"; shift
            set +e
            "$@" >"$RUNNER_TEMP/aego-full-ci/$name.log" 2>&1
            local code=$?
            set -e
            printf '%s\n' "$code" >"$RUNNER_TEMP/aego-full-ci/$name.exit"
            tail -n 100 "$RUNNER_TEMP/aego-full-ci/$name.log"
            return "$code"
          }
          run_gate native-user-scenario env SDL_VIDEODRIVER=offscreen \
            AEGO_NATIVE_SCENARIO_EVIDENCE="$RUNNER_TEMP/aego-full-ci/native-sdl" \
            bash tools/stage125-check.sh artstudio-native
          run_gate file-interoperability env SDL_VIDEODRIVER=offscreen \
            "$RUNNER_TEMP/aego-artstudio-python/bin/python" tools/artstudio/release/tests/file_interop_e2e.py \
            --artifact "$RUNNER_TEMP/aego-artstudio-evidence/artifact" \
            --native-evidence "$RUNNER_TEMP/aego-full-ci/native-sdl" \
            --evidence "$RUNNER_TEMP/aego-full-ci/file-interop" \
            --app-url http://127.0.0.1:8097/ --serve-artifact
          run_gate remote-examples make remote-examples-check XVFB= \
            REMOTE_EXAMPLES_OUT="$RUNNER_TEMP/aego-full-ci/remote-protocol"
      - name: Preserve full CI and component evidence
        if: ${{ always() }}
        uses: https://github.com/ChristopherHX/gitea-upload-artifact@81f940d004763f986ba3582c007fd842dd5cb0d7
        with:
          name: aego-full-ci-${{ github.run_id }}-${{ github.run_attempt }}
          if-no-files-found: warn
          retention-days: 14
          path: |
            ${{ runner.temp }}/aego-full-ci/**
            .cache/component-try.json*
            .cache/component-try-evidence/**
            .cache/component-try-evidence-negative/**
            .cache/integration-race/**
            site/try/aego-docs.wasm
      - name: packaging tools
        run: sudo apt-get install -y nsis squashfs-tools
      - name: installer dry run
        run: make nsis-check

  build:
    # Both jobs are heavy on the shared Gitea runner. Run build afterwards,
    # including when checks failed, so neither gate is dropped on failure.
    needs: checks
    if: ${{ always() && github.server_url != 'https://github.com' }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - { os: ubuntu-24.04, goos: linux, goarch: amd64 }
    runs-on: ${{ matrix.os }}
    defaults:
      run:
        shell: bash
    env:
      CGO_ENABLED: "1"
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-go@v5
        with:
          go-version-file: go.mod
      - name: linux packages
        if: runner.os == 'Linux'
        run: sudo apt-get update && sudo apt-get install -y $LINUX_PKGS "glslang-tools=$GLSLANG_APT_VERSION" && bash tools/check-glslang.sh
      - name: msys2
        if: runner.os == 'Windows'
        id: msys2
        uses: msys2/setup-msys2@v2
        with:
          msystem: UCRT64
          update: false
          install: mingw-w64-ucrt-x86_64-gcc mingw-w64-ucrt-x86_64-cmake mingw-w64-ucrt-x86_64-ninja
      - name: mingw path
        if: runner.os == 'Windows'
        run: echo "${{ steps.msys2.outputs.msys2-location }}\ucrt64\bin" >> "$GITHUB_PATH"
      - name: macos tools
        if: runner.os == 'macOS'
        run: brew list ninja >/dev/null 2>&1 || brew install ninja
      - uses: actions/cache@v4
        continue-on-error: true
        with:
          path: .cache/native
          key: native-${{ matrix.goos }}_${{ matrix.goarch }}-${{ hashFiles('third_party/sdl/version.txt', 'tools/bootstrap-native.sh') }}
      - name: bootstrap native
        run: bash tools/bootstrap-native.sh
      - name: build
        run: go build ./...
      - name: test
        run: go test ./...
      - name: test without native backends
        run: go test -tags aego_nonative $(go list ./... | grep -v -e '/platform/sdl$' -e '/gpu/gl33$' -e '/gpu/gl33/gl$')
      - name: gl tests (offscreen, llvmpipe)
        if: runner.os == 'Linux'
        env:
          SDL_VIDEODRIVER: offscreen
          LIBGL_ALWAYS_SOFTWARE: "1"
          GALLIUM_DRIVER: llvmpipe
        run: go test -tags aego_gltest ./tests/gl/
      - name: golden
        if: runner.os == 'Linux'
        env:
          SDL_VIDEODRIVER: offscreen
          LIBGL_ALWAYS_SOFTWARE: "1"
          GALLIUM_DRIVER: llvmpipe
        run: go test -tags aego_golden ./tests/golden/...
      - name: headless smoke
        run: go run ./cmd/sandbox --demo headless --frames 600 --strict-allocs
      - name: build the cli
        run: go build -o /tmp/aego ./cmd/aego
      - name: cli smoke
        run: |
          /tmp/aego new /tmp/clitest
          /tmp/aego import /tmp/clitest
          /tmp/aego check /tmp/clitest
          /tmp/aego run /tmp/clitest --headless --frames 60
      - name: example project
        run: |
          /tmp/aego check examples/native-rotator
          /tmp/aego run examples/native-rotator --headless --frames 60

  release:
    needs: [checks, build]
    # Pause all automatic releases until the reviewed nightly/stable pipeline
    # enforces native gates and preserves existing tags and release assets.
    if: ${{ false }}
    runs-on: ubuntu-24.04
    permissions:
      contents: write
    env:
      CGO_ENABLED: "1"
      GITEA_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      # the key that signs release.json and the public half the binaries trust; without them no release.json is published (D362)
      AEGO_RELEASE_KEY: ${{ secrets.AEGO_RELEASE_KEY }}
      AEGO_UPDATE_KEY: ${{ vars.AEGO_UPDATE_KEY || secrets.AEGO_UPDATE_KEY }}
      GITEA_API: ${{ github.server_url }}/api/v1/repos/${{ github.repository }}
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-go@v5
        with:
          go-version-file: go.mod
      - name: linux packages
        run: sudo apt-get update && sudo apt-get install -y $LINUX_PKGS "glslang-tools=$GLSLANG_APT_VERSION" && bash tools/check-glslang.sh
      - uses: actions/cache@v4
        continue-on-error: true
        with:
          path: .cache/native
          key: native-linux_amd64-${{ hashFiles('third_party/sdl/version.txt', 'tools/bootstrap-native.sh') }}
      - run: bash tools/bootstrap-native.sh
      - name: windows tools
        run: sudo apt-get install -y mingw-w64 nsis zip
      - name: publish
        env:
          REQUIRE_WINDOWS: "1"
          GITEA_RESOLVE: git.akarpov.ru:443:79.142.92.250
        run: |
          case "$GITHUB_REF" in
          refs/tags/v*) sh tools/release/release.sh "$GITHUB_REF_NAME" ;;
          refs/heads/master) sh tools/release/release.sh nightly ;;
          esac