ci.yml

name: CI

# Runs the data-tracking guard and the unit suite on every push to `main` and every pull request.
# Read-only: it builds nothing, publishes nothing and uses no credential.

on:
  push:
    branches: [dev]
  pull_request:

concurrency:
  group: ci-${{ github.ref }}
  cancel-in-progress: true

jobs:
  test:
    runs-on: ubuntu-latest

    permissions:
      contents: read

    steps:
      - name: Checkout
        uses: actions/checkout@v7
        with:
          fetch-depth: 1

      # Matches the pipeline workflow; this repository declares no `engines`.
      - name: Setup Node
        uses: actions/setup-node@v7
        with:
          node-version: '24'

      # No `playwright install`: the unit config declares no `webServer` and launches no browser.
      - name: Install dependencies
        run: npm ci

      - name: Assert no derived data is tracked
        run: npm run check-data-tracking

      # `npm ci` above ran the postinstall linker, so this asserts the projection actually happened
      # rather than re-doing it: both skill surfaces point at the installed package, and no skill
      # byte is tracked here. An `--ignore-scripts` install resolves the dependency without linking
      # anything, and this is what makes that state red instead of silently fine.
      #
      # No path filter, and no workflow of its own: a path-filtered workflow reports *pending* on
      # PRs that miss the filter, which can never satisfy a required check.
      - name: Assert the skill substrate is projected, not copied
        run: npx --no-install neo-agent-skills-materialize --check

      # `--project=unit` excludes `unit-profiling`. Those two specs read the real `users.jsonl`, which
      # is gitignored and whose fetch skips under CI, and they assert wall-clock budgets that a shared
      # runner can double — a regression report for something that did not regress.
      #
      # `--fail-on-flaky-tests` matters because the config retries twice under CI and a Playwright
      # retry runs in a fresh worker, so leaked state repairs itself and the run reports green.
      #
      # Expect 47 tests; a project name matching nothing also exits 0.
      - name: Unit tests
        run: npx playwright test -c test/playwright/playwright.config.unit.mjs --project=unit --fail-on-flaky-tests

      - name: Upload test report
        if: failure()
        uses: actions/upload-artifact@v7
        with:
          name: playwright-report
          path: test/playwright/test-results/unit/
          retention-days: 7