ci.yml

name: ci

# Least-privilege token: CI only needs to read the repo.
permissions:
  contents: read

on:
  push:
    branches: [main]
  pull_request:

# Cancel superseded PR runs to speed up feedback and save runner minutes (the
# macOS job is the expensive one). PR runs are grouped per PR number, so a new
# commit cancels that PR's older run. Non-PR events (pushes to main) have no PR
# number and fall back to a unique per-run id, putting each run in its own group
# — so main commits are never cancelled or dropped, not even a run left pending
# behind an in-progress one (a shared group caps a group at one running + one
# pending run, cancelling older pending runs even when cancel-in-progress is
# false). cancel-in-progress is additionally gated to pull_request events.
# (Module and build caches are already handled: actions/setup-go caches them by
# default, keyed on go.sum.)
concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

jobs:
  test:
    name: test (default / pure Go)
    runs-on: ubuntu-latest
    steps:
      # persist-credentials:false avoids leaving the token on disk (zizmor
      # "artipacked"); the Go version comes from go.mod so module + CI never
      # drift. (Actions left on release tags: pinning to a SHA needs a verified
      # hash, which can't be confirmed from the build sandbox.)
      - uses: actions/checkout@v4
        with:
          persist-credentials: false
      - uses: actions/setup-go@v5
        with:
          go-version-file: go.mod
      - name: Verify formatting
        run: test -z "$(gofmt -l .)" || (gofmt -l . && exit 1)
      - name: Vet
        run: go vet ./...
      - name: Test (race)
        run: go test -race ./...
      - name: Build (default, pure Go)
        run: go build ./...

  e2e:
    name: e2e (real binary, black-box)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          persist-credentials: false
      - uses: actions/setup-go@v5
        with:
          go-version-file: go.mod
      # Drives the actual compiled wisp binary over a PTY running a local shell
      # (internal/e2e) — the test that proves the shipped terminal launches,
      # renders, forwards keystrokes, and injects the proxy env, not just that
      # its packages pass unit tests. -count=1 disables the test cache so it
      # always runs.
      #
      # The WISP_E2E_* env wires optional tailnet credentials from repo secrets
      # into the suite's live test (internal/e2e/tailnet_test.go), which curls a
      # tailnet resource through the embedded proxy. Auth is a Tailscale OAuth
      # client secret — NOT a long-lived auth key: wisp's tsnet exchanges it for
      # a short-lived, tagged key at startup. The OAuth client is scoped to a tag
      # and revocable from the admin console. When the secrets are unset — e.g.
      # on fork PRs, where secrets are unavailable — the live test skips and the
      # hermetic local-shell tests still run. When they are set, wisp is
      # additionally driven through the real tsnet path.
      #
      # To enable, add these repo secrets (Settings → Secrets → Actions):
      #   WISP_E2E_TS_CLIENT_SECRET  OAuth client secret (tskey-client-…), auth_keys scope, owns the tag
      #   WISP_E2E_TS_TAGS           tag(s) the client owns, e.g. tag:ci
      #   WISP_E2E_URL               an HTTP URL reachable only over the tailnet
      #   WISP_E2E_EXPECT            a substring expected in that URL's response body
      #   WISP_E2E_CONTROL_URL       (optional) Headscale/self-hosted control plane
      - name: E2E (black-box, real binary)
        env:
          WISP_E2E_TS_CLIENT_SECRET: ${{ secrets.WISP_E2E_TS_CLIENT_SECRET }}
          WISP_E2E_TS_TAGS: ${{ secrets.WISP_E2E_TS_TAGS }}
          WISP_E2E_URL: ${{ secrets.WISP_E2E_URL }}
          WISP_E2E_EXPECT: ${{ secrets.WISP_E2E_EXPECT }}
          WISP_E2E_CONTROL_URL: ${{ secrets.WISP_E2E_CONTROL_URL }}
        run: |
          go test -tags e2e -count=1 -v ./internal/e2e/...

  gui-linux:
    name: gui (ebiten, Linux smoke)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          persist-credentials: false
      - uses: actions/setup-go@v5
        with:
          go-version-file: go.mod
      - name: Install GPU/windowing dev headers
        run: |
          sudo apt-get update
          sudo apt-get install -y --no-install-recommends \
            libgl1-mesa-dev libxrandr-dev libxcursor-dev libxinerama-dev \
            libxi-dev libxxf86vm-dev xvfb
      - name: Build GUI
        env:
          CGO_ENABLED: "1"
        run: go build -tags ebiten ./...
      - name: Vet GUI
        env:
          CGO_ENABLED: "1"
        run: go vet -tags ebiten ./...
      - name: Test GUI update-banner path (race)
        env:
          CGO_ENABLED: "1"
        run: xvfb-run -a go test -race -tags ebiten ./internal/render/...

  gui-macos:
    name: gui (ebiten, macOS Apple Silicon — release target)
    runs-on: macos-15
    steps:
      - uses: actions/checkout@v4
        with:
          persist-credentials: false
      - uses: actions/setup-go@v5
        with:
          go-version-file: go.mod
      - name: Build GUI (cgo, darwin/arm64)
        env:
          CGO_ENABLED: "1"
          GOOS: darwin
          GOARCH: arm64
        run: go build -tags ebiten ./cmd/wisp
      - name: Test GUI update-banner path
        env:
          CGO_ENABLED: "1"
        run: go test -tags ebiten ./internal/render/...