ci.yml

name: CI

on:
  push:
    branches: [main]
  pull_request:
    types: [opened, synchronize, reopened, labeled]

permissions:
  contents: read

concurrency:
  group: ci-${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true

jobs:
  checks:
    name: Checks
    if: github.event_name != 'pull_request' || github.base_ref == 'main' || contains(github.event.pull_request.labels.*.name, 'aggregate-ci')
    runs-on: ubuntu-latest
    env:
      AGENTOS_SKIP_NATIVE_META_BUILD: '1'
    steps:
      - uses: actions/checkout@v4
      - uses: pnpm/action-setup@v4
      - uses: actions/setup-node@v4
        with:
          node-version: 24
          cache: pnpm
          cache-dependency-path: pnpm-lock.yaml
      - uses: dtolnay/rust-toolchain@stable
        with:
          components: rustfmt
      - run: |
          rm -rf /tmp/docs-theme
          git clone https://github.com/rivet-dev/docs-theme.git /tmp/docs-theme
          git -C /tmp/docs-theme checkout 450c498555135098c6a927adfdf13458be9be22a
          rm -rf website/vendor/theme && mkdir -p website/vendor
          cp -r /tmp/docs-theme/packages/theme website/vendor/theme
      - run: pnpm install --frozen-lockfile
      - run: |
          # Browser runtime sources remain in-tree, but are intentionally disabled
          # until their sidecar/reactor architecture has a separate approved design.
          # Native sidecars are built by the parallel Rust job, never by this graph.
          if grep -qE '^[[:space:]]*-[[:space:]]*website[[:space:]]*$' pnpm-workspace.yaml; then
            npx turbo build \
              --only \
              --concurrency=4 \
              --filter='!@rivet-dev/agentos-runtime-browser'
          else
            npx turbo build \
              --only \
              --concurrency=4 \
              --filter='!@rivet-dev/agentos-runtime-browser'
          fi
      - run: pnpm --dir scripts/publish run check-types
      - run: pnpm --dir scripts/publish test
      - run: node --test scripts/check-rust-package-metadata.test.mjs
      - run: node scripts/check-rust-package-metadata.mjs
      - run: node --test scripts/check-agentos-client-protocol-compat.test.mjs
      - run: node scripts/check-agentos-client-protocol-compat.mjs
      - run: node --test scripts/verify-fixed-versions.test.mjs
      - run: node scripts/verify-fixed-versions.mjs
      - run: node --test scripts/check-layout.test.mjs
      - run: pnpm check-layout
      - run: node --test scripts/check-rustfmt.test.mjs
      - run: node scripts/check-rustfmt.mjs
      - run: pnpm check-types
      - name: Run fast package unit tests
        run: |
          pnpm --parallel --aggregate-output \
            --filter '@rivet-dev/agentos-build-tools' \
            --filter '@rivet-dev/agentos-toolchain' \
            --filter '@rivet-dev/agentos-runtime-sidecar' \
            test
      - run: pnpm lint
        continue-on-error: true
      - name: Pack JavaScript build outputs
        run: |
          tar \
            --exclude='software/*/dist/package' \
            --exclude='software/*/dist/package.tar' \
            --exclude='software/*/dist/package.aospkg' \
            -czf /tmp/agentos-js-dist.tar.gz \
            packages/*/dist software/*/dist test-harness/dist
      - uses: actions/upload-artifact@v4
        with:
          name: js-dist
          path: /tmp/agentos-js-dist.tar.gz
          retention-days: 1
          if-no-files-found: error

  wasm-commands:
    name: WASM Commands
    if: github.event_name != 'pull_request' || github.base_ref == 'main' || contains(github.event.pull_request.labels.*.name, 'aggregate-ci')
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: pnpm/action-setup@v4
      - uses: actions/setup-node@v4
        with:
          node-version: 24
          cache: pnpm
          cache-dependency-path: pnpm-lock.yaml
      - uses: dtolnay/rust-toolchain@nightly
        with:
          targets: wasm32-wasip1
      - uses: Swatinem/rust-cache@v2
        with:
          workspaces: toolchain -> target
          key: wasm-commands-${{ hashFiles('toolchain/Cargo.lock') }}
      - run: pnpm install --frozen-lockfile --filter '@rivet-dev/agentos-runtime-core...'
      - run: make -C toolchain pr-commands
      - run: node packages/runtime-core/scripts/copy-wasm-commands.mjs --require-coreutils
      - uses: actions/upload-artifact@v4
        with:
          name: wasm-commands
          path: packages/runtime-core/commands
          retention-days: 1
          if-no-files-found: error

  rust:
    name: Rust
    if: github.event_name != 'pull_request' || github.base_ref == 'main' || contains(github.event.pull_request.labels.*.name, 'aggregate-ci')
    runs-on: ubuntu-latest
    env:
      CARGO_PROFILE_DEV_DEBUG: '0'
      CARGO_PROFILE_TEST_DEBUG: '0'
    steps:
      - uses: actions/checkout@v4
      - uses: pnpm/action-setup@v4
      - uses: actions/setup-node@v4
        with:
          node-version: 24
          cache: pnpm
          cache-dependency-path: pnpm-lock.yaml
      - uses: dtolnay/rust-toolchain@stable
        with:
          components: rustfmt, clippy
      - uses: Swatinem/rust-cache@v2
        with:
          key: native-pr-${{ hashFiles('Cargo.lock') }}
      - name: Install V8 bridge build dependencies
        run: pnpm install --frozen-lockfile --filter '@rivet-dev/agentos-build-tools...'
      - name: Verify generated VM config bindings
        run: |
          cargo test -p agentos-vm-config --quiet
          git diff --exit-code -- packages/runtime-core/src/generated
      - name: Build PR sidecar binary
        run: cargo build -p agentos-native-sidecar
      - run: cargo clippy --workspace --exclude agentos-native-sidecar-browser --all-targets -- -D warnings
      - name: Test Rust client contracts
        env:
          AGENTOS_SIDECAR_BIN: ${{ github.workspace }}/target/debug/agentos-native-sidecar
        run: |
          cargo test -p agentos-client \
            --features service-internals \
            --lib \
            --test scaffold \
            --test e2e_smoke \
            --test fs_e2e \
            --test lifecycle_e2e \
            --test mount_e2e \
            --test sidecar_pool_e2e \
            --test cron_e2e \
            --test cron_grammar_e2e \
            --test vm_config_compare_e2e \
            -- --test-threads=1
      - name: Stage stripped sidecar artifacts
        run: |
          mkdir -p ci-artifacts/agentos-native-sidecar
          cp target/debug/agentos-native-sidecar ci-artifacts/agentos-native-sidecar/agentos-native-sidecar
          strip --strip-all ci-artifacts/agentos-native-sidecar/agentos-native-sidecar
      - uses: actions/upload-artifact@v4
        with:
          name: agentos-native-sidecar
          path: ci-artifacts/agentos-native-sidecar/agentos-native-sidecar
          retention-days: 1
          if-no-files-found: error

  core-pr:
    name: Core PR
    if: github.event_name != 'pull_request' || github.base_ref == 'main' || contains(github.event.pull_request.labels.*.name, 'aggregate-ci')
    needs: [checks, rust, wasm-commands]
    runs-on: ubuntu-latest
    env:
      AGENTOS_SKIP_NATIVE_META_BUILD: '1'
    steps:
      - uses: actions/checkout@v4
      - uses: pnpm/action-setup@v4
      - uses: actions/setup-node@v4
        with:
          node-version: 24
          cache: pnpm
          cache-dependency-path: pnpm-lock.yaml
      - run: pnpm install --frozen-lockfile --filter '@rivet-dev/agentos-core...' --filter 'secure-exec...'
      - uses: actions/download-artifact@v4
        with:
          name: js-dist
          path: ci-artifacts/js
      - uses: actions/download-artifact@v4
        with:
          name: agentos-native-sidecar
          path: ci-artifacts/agentos-native-sidecar
      - uses: actions/download-artifact@v4
        with:
          name: wasm-commands
          path: packages/runtime-core/commands
      - name: Restore runtime inputs
        run: |
          tar -xzf ci-artifacts/js/agentos-js-dist.tar.gz
          chmod +x ci-artifacts/agentos-native-sidecar/agentos-native-sidecar
          node packages/runtime-core/scripts/copy-wasm-commands.mjs --require-coreutils
          pnpm --filter @agentos-software/coreutils build:runtime
      - run: pnpm --dir packages/core test:pr
        env:
          AGENTOS_SIDECAR_BIN: ${{ github.workspace }}/ci-artifacts/agentos-native-sidecar/agentos-native-sidecar
      - run: pnpm --dir secure-exec test
        env:
          AGENTOS_SIDECAR_BIN: ${{ github.workspace }}/ci-artifacts/agentos-native-sidecar/agentos-native-sidecar

  runtime-core-pr:
    name: Runtime Core PR
    if: github.event_name != 'pull_request' || github.base_ref == 'main' || contains(github.event.pull_request.labels.*.name, 'aggregate-ci')
    needs: [checks, rust, wasm-commands]
    runs-on: ubuntu-latest
    env:
      AGENTOS_SKIP_NATIVE_META_BUILD: '1'
    steps:
      - uses: actions/checkout@v4
      - uses: pnpm/action-setup@v4
      - uses: actions/setup-node@v4
        with:
          node-version: 24
          cache: pnpm
          cache-dependency-path: pnpm-lock.yaml
      - run: pnpm install --frozen-lockfile --filter '@rivet-dev/agentos-runtime-core...'
      - uses: actions/download-artifact@v4
        with:
          name: js-dist
          path: ci-artifacts/js
      - uses: actions/download-artifact@v4
        with:
          name: agentos-native-sidecar
          path: ci-artifacts/agentos-native-sidecar
      - uses: actions/download-artifact@v4
        with:
          name: wasm-commands
          path: packages/runtime-core/commands
      - name: Restore runtime inputs
        run: |
          tar -xzf ci-artifacts/js/agentos-js-dist.tar.gz
          chmod +x ci-artifacts/agentos-native-sidecar/agentos-native-sidecar
          node packages/runtime-core/scripts/copy-wasm-commands.mjs --require-coreutils
      - run: pnpm --dir packages/runtime-core test:pr
        env:
          AGENTOS_NATIVE_SIDECAR_BIN: ${{ github.workspace }}/ci-artifacts/agentos-native-sidecar/agentos-native-sidecar

  required:
    name: CI / Required
    if: ${{ always() && (github.event_name != 'pull_request' || github.base_ref == 'main' || contains(github.event.pull_request.labels.*.name, 'aggregate-ci')) }}
    needs: [checks, wasm-commands, rust, core-pr, runtime-core-pr]
    runs-on: ubuntu-latest
    steps:
      - name: Require every PR gate
        env:
          CHECKS_RESULT: ${{ needs.checks.result }}
          WASM_RESULT: ${{ needs.wasm-commands.result }}
          RUST_RESULT: ${{ needs.rust.result }}
          CORE_RESULT: ${{ needs.core-pr.result }}
          RUNTIME_CORE_RESULT: ${{ needs.runtime-core-pr.result }}
        run: |
          for result in \
            "$CHECKS_RESULT" \
            "$WASM_RESULT" \
            "$RUST_RESULT" \
            "$CORE_RESULT" \
            "$RUNTIME_CORE_RESULT"; do
            if [ "$result" != success ]; then
              echo "required CI job did not succeed: $result" >&2
              exit 1
            fi
          done