mutation-tests.yml

name: Mutation quality

on:
  workflow_call:
    outputs:
      qualified-sha:
        description: Exact source qualified by every canonical target; absent for diagnostics
        value: ${{ jobs.mutation-quality.outputs.qualified-sha }}
  schedule:
    - cron: '17 8 * * 0'
  workflow_dispatch:
    inputs:
      target:
        description: Diagnostic exact target ID; blank qualifies every canonical target
        required: false
        type: string

permissions: {}

concurrency:
  group: mutation-quality-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: false

jobs:
  prepare:
    name: Build mutation campaign
    runs-on: ubuntu-latest
    timeout-minutes: 30
    permissions:
      contents: read
    outputs:
      targets: ${{ steps.targets.outputs.targets }}
      mode: ${{ steps.targets.outputs.mode }}
      mutation-matrix: ${{ steps.targets.outputs.mutation-matrix }}
      partition-targets: ${{ steps.targets.outputs.partition-targets }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: 24.18.0
          cache: pnpm

      - name: Install frozen dependencies
        run: pnpm install --frozen-lockfile --ignore-scripts

      - name: Rebuild the audited workspace build tool
        run: pnpm rebuild esbuild

      - name: Select the full campaign or one exact target
        id: targets
        env:
          REQUESTED_TARGET: ${{ github.workflow == 'Mutation quality' && github.event_name == 'workflow_dispatch' && inputs.target || '' }}
        run: |
          GOVERNED_TARGETS=$(node scripts/mutation-testing.mjs --list)
          if [ -n "$REQUESTED_TARGET" ]; then
            if ! grep -Fxq "$REQUESTED_TARGET" <<<"$GOVERNED_TARGETS"; then
              echo "::error::Unknown mutation target: $REQUESTED_TARGET"
              exit 1
            fi
            TARGETS=$(jq -cn --arg target "$REQUESTED_TARGET" '[$target]')
          else
            TARGETS=$(jq -R -s -c 'split("\n") | map(select(length > 0))' <<<"$GOVERNED_TARGETS")
          fi
          echo "targets=$TARGETS" >> "$GITHUB_OUTPUT"
          MUTATION_MATRIX=$(node scripts/mutation-partition-evidence.mjs matrix --selected "$TARGETS")
          PARTITION_TARGETS=$(node scripts/mutation-partition-evidence.mjs targets --selected "$TARGETS")
          echo "mutation-matrix=$MUTATION_MATRIX" >> "$GITHUB_OUTPUT"
          echo "partition-targets=$PARTITION_TARGETS" >> "$GITHUB_OUTPUT"
          if [ -n "$REQUESTED_TARGET" ]; then
            echo "mode=diagnostic" >> "$GITHUB_OUTPUT"
          else
            echo "mode=full" >> "$GITHUB_OUTPUT"
          fi

      - name: Verify current complete test and mutation governance
        run: node scripts/test-governance.mjs

      - name: Reject advisory failures before expensive full qualification
        if: steps.targets.outputs.mode == 'full'
        run: pnpm audit:security

      - name: Build the governed package graph
        run: pnpm build:property

      - name: Archive build outputs
        run: |
          {
            find packages -type d \( -name dist -o -name out \) -prune -print0
            find packages -type f -name '*.tsbuildinfo' -print0
          } | tar --null --create --gzip --file build-outputs.tar.gz --files-from=-

      - name: Share build outputs
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: mutation-build-outputs-${{ github.run_id }}-${{ github.run_attempt }}
          path: build-outputs.tar.gz
          if-no-files-found: error
          retention-days: 1

  mutation-tests:
    name: Mutation / ${{ matrix.target }} / ${{ matrix.partition }}
    needs: prepare
    runs-on: ubuntu-latest
    # Preserve the acknowledged wallet/overlays90-minute target union.
    timeout-minutes: ${{ contains(fromJSON('["revenue-lineage-package","revenue-lineage-graph","sdk-revenue-listing-funding","output-lookup-session-records","output-lookup-session-payloads","wallet-recovery-codec","wallet-recovery-installation","wallet-recovery-store","wallet-funding-store","wallet-recovery-transitions","wallet-recovery-controller","root-eviction-storage","root-eviction-journal","root-eviction-records","wallet-retained-snapshot","wallet-snapshot-sync","wallet-snapshot-sync-destination","wallet-snapshot-sync-rows","wallet-snapshot-archive","wallet-snapshot-remote-http"]'), matrix.target) && 90 || 45 }}
    permissions:
      contents: read
    strategy:
      fail-fast: false
      # Run the whole campaign at once; the slowest single target bounds wall time.
      max-parallel: 20
      matrix: ${{ fromJSON(needs.prepare.outputs.mutation-matrix) }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: 24.18.0
          cache: pnpm

      - name: Install frozen dependencies
        run: pnpm install --frozen-lockfile --ignore-scripts

      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
        with:
          name: mutation-build-outputs-${{ github.run_id }}-${{ github.run_attempt }}
          path: .ci-artifacts

      - name: Restore build outputs
        run: tar --extract --gzip --file .ci-artifacts/build-outputs.tar.gz

      - name: Enforce the governed mutation-quality ratchet
        env:
          MUTATION_VERBOSE: '0'
        run: node scripts/mutation-testing.mjs --target "${{ matrix.target }}" --partition "${{ matrix.partition }}"

      - name: Capture successful exact-source complete target evidence
        if: matrix.partition == 'whole'
        env:
          CAMPAIGN_MODE: ${{ needs.prepare.outputs.mode }}
          TARGET: ${{ matrix.target }}
        run: |
          node scripts/mutation-final-qualification.mjs capture \
            --mode "$CAMPAIGN_MODE" --target "$TARGET" \
            --directory "artifacts/mutation/$TARGET"

      - name: Capture complete execution-partition evidence
        if: matrix.partition != 'whole'
        env:
          CAMPAIGN_MODE: ${{ needs.prepare.outputs.mode }}
        run: |
          node scripts/mutation-partition-evidence.mjs capture --mode "$CAMPAIGN_MODE" \
            --target "${{ matrix.target }}" --partition "${{ matrix.partition }}" \
            --directory "artifacts/mutation/${{ matrix.target }}/${{ matrix.partition }}"
      - name: Preserve the machine-readable mutation report
        if: always()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: ${{ matrix.partition == 'whole' && 'mutation-receipt' || 'mutation-partition' }}-${{ github.run_id }}-${{ github.run_attempt }}-${{ matrix.target }}-${{ matrix.partition }}
          path: artifacts/mutation/${{ matrix.target }}
          if-no-files-found: ignore
          retention-days: 30

  partition-aggregate:
    name: Canonical global gate / ${{ matrix.target }}
    if: always() && !cancelled() && needs.prepare.result == 'success' && needs.mutation-tests.result == 'success' && needs.prepare.outputs.partition-targets != '[]' && needs.prepare.outputs.partition-targets != ''
    needs: [prepare, mutation-tests]
    strategy:
      fail-fast: false
      max-parallel: 2
      matrix:
        target: ${{ fromJSON(needs.prepare.outputs.partition-targets) }}
    runs-on: ubuntu-latest
    timeout-minutes: 10
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: 24.18.0
          cache: pnpm
      - name: Install pinned canonical aggregate verifier
        run: pnpm install --frozen-lockfile --ignore-scripts
      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
        with:
          pattern: mutation-partition-${{ github.run_id }}-${{ github.run_attempt }}-${{ matrix.target }}-*
          path: .mutation-parts
      - name: Require the original global score and exhaustive canonical inventory
        env:
          CAMPAIGN_MODE: ${{ needs.prepare.outputs.mode }}
        run: |
          node scripts/mutation-partition-evidence.mjs verify --mode "$CAMPAIGN_MODE" \
            --target "${{ matrix.target }}" --directory .mutation-parts \
            --output "artifacts/mutation/${{ matrix.target }}"
      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        if: always()
        with:
          name: mutation-receipt-${{ github.run_id }}-${{ github.run_attempt }}-${{ matrix.target }}
          path: artifacts/mutation/${{ matrix.target }}
          if-no-files-found: ignore
          retention-days: 30

  mutation-quality:
    name: Mutation campaign / ${{ needs.prepare.outputs.mode }}
    if: always()
    needs:
      - prepare
      - mutation-tests
      - partition-aggregate
    runs-on: ubuntu-latest
    timeout-minutes: 10
    permissions:
      contents: read
    outputs:
      qualified-sha: ${{ steps.qualification.outputs.qualified-sha }}
    steps:
      - name: Verify the campaign
        env:
          PREPARE_RESULT: ${{ needs.prepare.result }}
          MUTATION_RESULT: ${{ needs.mutation-tests.result }}
          PARTITION_RESULT: ${{ needs.partition-aggregate.result }}
          PARTITION_TARGETS: ${{ needs.prepare.outputs.partition-targets }}
        run: |
          if [[ "$PREPARE_RESULT" != "success" || "$MUTATION_RESULT" != "success" ]]; then
            echo "::error::Mutation campaign failed: prepare=$PREPARE_RESULT mutation=$MUTATION_RESULT"
            exit 1
          fi
          jq -e 'type == "array" and all(.[]; type == "string")' <<<"$PARTITION_TARGETS" > /dev/null
          if [[ "$PARTITION_TARGETS" != "[]" && "$PARTITION_RESULT" != "success" ]]; then
            echo "::error::Complete canonical partition gate failed: $PARTITION_RESULT"
            exit 1
          fi

      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: ${{ github.sha }}
          persist-credentials: false
      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: 24.18.0
          cache: pnpm
      - name: Install pinned inventory verifier dependencies
        run: pnpm install --frozen-lockfile --ignore-scripts
      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
        with:
          pattern: mutation-receipt-${{ github.run_id }}-${{ github.run_attempt }}-*
          path: .mutation-receipts
      - name: Independently recheck every selected canonical partition before full qualification
        if: needs.prepare.outputs.partition-targets != '[]' && needs.prepare.outputs.partition-targets != ''
        env:
          CAMPAIGN_MODE: ${{ needs.prepare.outputs.mode }}
          PARTITION_TARGETS: ${{ needs.prepare.outputs.partition-targets }}
        run: |
          TARGET_LINES=$(jq -er '.[]' <<<"$PARTITION_TARGETS")
          while IFS= read -r target; do
            node scripts/mutation-partition-evidence.mjs recheck --mode "$CAMPAIGN_MODE" \
              --target "$target" --directory .mutation-receipts
          done <<<"$TARGET_LINES"
      - name: Issue full qualification only for every exact-source canonical target
        id: qualification
        env:
          CAMPAIGN_MODE: ${{ needs.prepare.outputs.mode }}
        run: |
          node scripts/mutation-final-qualification.mjs verify \
            --mode "$CAMPAIGN_MODE" --directory .mutation-receipts