OpenAgentsControl/.github/workflows/packages-checks.yml

name: Packages Checks

on:
  pull_request:
    paths:
      - 'packages/**'
      - '.github/workflows/packages-checks.yml'
      - 'scripts/validation/detect-pr-changes.ts'

permissions:
  contents: read

jobs:
  check-changes:
    name: Detect Package Changes
    runs-on: ubuntu-latest
    outputs:
      has-packages: ${{ steps.filter.outputs.has-packages }}

    steps:
      - name: Checkout code
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
        with:
          fetch-depth: 0
          persist-credentials: false

      - name: Setup Bun
        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
        with:
          bun-version: 1.3.14

      - name: Check changed files
        id: filter
        run: |
          echo "Changed files:" >&2
          git diff --name-only -z "${{ github.event.pull_request.base.sha }}...${{ github.event.pull_request.head.sha }}" |
            tee >(while IFS= read -r -d '' path; do printf '  %q\n' "$path" >&2; done) |
            bun run scripts/validation/detect-pr-changes.ts

  cli-checks:
    name: CLI (build + test + typecheck)
    runs-on: ubuntu-latest
    timeout-minutes: 10
    needs: check-changes
    if: needs.check-changes.outputs.has-packages == 'true'

    steps:
      - name: Checkout code
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
        with:
          persist-credentials: false

      - name: Setup Bun
        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
        with:
          bun-version: 1.3.14

      # packages/cli is a root bun workspace member; the root lockfile covers it.
      - name: Install workspace dependencies
        run: bun install --frozen-lockfile

      # cli tsconfig paths point at ../compatibility-layer/dist, so build it first.
      - name: Build compatibility-layer dependency
        working-directory: packages/compatibility-layer
        run: bun run build

      - name: Typecheck
        working-directory: packages/cli
        run: bun run typecheck

      - name: Build
        working-directory: packages/cli
        run: bun run build

      # packages/cli tests use Bun-only APIs (Bun.file, Bun.spawn, import.meta.dir)
      # until Stage 5 removes them — they must run under `bun test`, not vitest.
      - name: Test
        working-directory: packages/cli
        run: bun run test

  compatibility-layer-checks:
    name: Compatibility Layer (build + test + lint)
    runs-on: ubuntu-latest
    timeout-minutes: 10
    needs: check-changes
    if: needs.check-changes.outputs.has-packages == 'true'

    steps:
      - name: Checkout code
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
        with:
          persist-credentials: false

      - name: Setup Node.js
        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
        with:
          node-version: '20'
          cache: 'npm'
          cache-dependency-path: 'packages/compatibility-layer/package-lock.json'

      - name: Install dependencies
        working-directory: packages/compatibility-layer
        run: npm ci

      # build runs tsc, which is also the typecheck for this package.
      - name: Build (tsc typecheck)
        working-directory: packages/compatibility-layer
        run: npm run build

      - name: Lint
        working-directory: packages/compatibility-layer
        run: npm run lint

      - name: Test (vitest)
        working-directory: packages/compatibility-layer
        run: npm test

  # Non-blocking: packages/plugin-abilities is known-red today (92 tsc errors,
  # 23 failing bun tests; its lint script is broken — eslint is not a dependency
  # and no config exists). This job reports build/test status without failing
  # PRs until the package is repaired. Once it is green, promote the build and
  # test commands to normal failing steps and gate the summary on this job.
  plugin-abilities-checks:
    name: Plugin Abilities (build + test, non-blocking)
    runs-on: ubuntu-latest
    timeout-minutes: 10
    needs: check-changes
    if: needs.check-changes.outputs.has-packages == 'true'
    outputs:
      status: ${{ steps.nonblocking.outputs.status }}

    steps:
      - name: Checkout code
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
        with:
          persist-credentials: false

      - name: Setup Bun
        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
        with:
          bun-version: 1.3.14

      # Not a root workspace member — it has its own lockfile.
      - name: Install dependencies
        working-directory: packages/plugin-abilities
        run: bun install --frozen-lockfile

      - name: Build and test (non-blocking)
        id: nonblocking
        working-directory: packages/plugin-abilities
        run: |
          STATUS=pass
          bun run build || STATUS=fail
          bun test || STATUS=fail
          echo "status=$STATUS" >> "$GITHUB_OUTPUT"
          if [ "$STATUS" = "fail" ]; then
            echo "::warning title=plugin-abilities red::packages/plugin-abilities build/test failing (pre-existing, non-blocking)"
          fi

  summary:
    name: Packages Checks Summary
    runs-on: ubuntu-latest
    needs: [check-changes, cli-checks, compatibility-layer-checks, plugin-abilities-checks]
    if: always()

    steps:
      - name: Generate summary
        run: |
          echo "## 📦 Packages Checks Summary" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY

          report() {
            local label="$1" result="$2"
            case "$result" in
              success) echo "✅ **${label}:** Passed" >> $GITHUB_STEP_SUMMARY ;;
              skipped) echo "⏭️ **${label}:** Skipped (no packages/** changes)" >> $GITHUB_STEP_SUMMARY ;;
              *) echo "❌ **${label}:** ${result}" >> $GITHUB_STEP_SUMMARY ;;
            esac
          }

          report "Change Detection" "${{ needs.check-changes.result }}"
          report "CLI" "${{ needs.cli-checks.result }}"
          report "Compatibility Layer" "${{ needs.compatibility-layer-checks.result }}"

          case "${{ needs.plugin-abilities-checks.result }}/${{ needs.plugin-abilities-checks.outputs.status }}" in
            success/pass) echo "✅ **Plugin Abilities (non-blocking):** Passed" >> $GITHUB_STEP_SUMMARY ;;
            success/fail) echo "⚠️ **Plugin Abilities (non-blocking):** Failing (pre-existing, does not block this PR)" >> $GITHUB_STEP_SUMMARY ;;
            skipped/*) echo "⏭️ **Plugin Abilities (non-blocking):** Skipped (no packages/** changes)" >> $GITHUB_STEP_SUMMARY ;;
            *) echo "⚠️ **Plugin Abilities (non-blocking):** ${{ needs.plugin-abilities-checks.result }}" >> $GITHUB_STEP_SUMMARY ;;
          esac

          echo "" >> $GITHUB_STEP_SUMMARY

          FAILED=0
          [ "${{ needs.check-changes.result }}" != "success" ] && FAILED=1
          for result in "${{ needs.cli-checks.result }}" "${{ needs.compatibility-layer-checks.result }}"; do
            if [ "$result" != "success" ] && [ "$result" != "skipped" ]; then
              FAILED=1
            fi
          done

          if [ $FAILED -eq 0 ]; then
            echo "### ✅ Required Package Checks Passed" >> $GITHUB_STEP_SUMMARY
          else
            echo "### ❌ Some Package Checks Failed" >> $GITHUB_STEP_SUMMARY
            exit 1
          fi