openrig/.github/workflows/tests.yml

name: Tests

# Builds, type-checks and runs every test suite on a clean GitHub runner, and records the file
# list each published package would contain. Each suite is its own job so one failure does not
# hide the others. No provider credentials or operator configuration are supplied.
# Package suites and the Linux seat-environment check deny external networking;
# scenario runtime has no external route.

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: tests-${{ github.event_name }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  build-and-package:
    runs-on: ubuntu-latest
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@v4
        with:
          persist-credentials: false
      - uses: actions/setup-node@v4
        with:
          node-version: 22
          cache: npm
      - run: npm ci
      - run: npm run build
      - name: Record the published file list of each package
        run: |
          set -euo pipefail
          mkdir -p pack-lists
          for p in cli daemon tui; do
            (cd packages/$p && npm pack --dry-run --json --ignore-scripts) \
              | node -e 'let s="";process.stdin.on("data",d=>s+=d).on("end",()=>{for(const f of JSON.parse(s)[0].files)console.log(f.path)})' \
              | sort > pack-lists/$p.txt
            echo "$p: $(wc -l < pack-lists/$p.txt) files"
          done
      - uses: actions/upload-artifact@v4
        with:
          name: pack-lists
          path: pack-lists/

  typecheck:
    runs-on: ubuntu-latest
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@v4
        with:
          persist-credentials: false
      - uses: actions/setup-node@v4
        with:
          node-version: 22
          cache: npm
      - run: npm ci
      - run: npm run lint

  repo-checks:
    runs-on: ubuntu-latest
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@v4
        with:
          persist-credentials: false
      - uses: actions/setup-node@v4
        with:
          node-version: 22
          cache: npm
      - run: npm ci
      - run: npm run test:repo

  linux-seat-environment:
    if: ${{ github.event_name != 'push' }}
    # Cover /proc seat environments and Linux canonical-input limits that macOS cannot exercise.
    runs-on: ubuntu-latest
    timeout-minutes: 20
    steps:
      - uses: actions/checkout@v4
        with:
          persist-credentials: false
      - uses: actions/setup-node@v4
        with:
          node-version: 22
          cache: npm
      - name: Install the real terminal and staging tools
        run: |
          sudo apt-get update
          sudo apt-get install --yes tmux rsync
      - run: npm ci
      - run: npm run build
      - name: Check seat environments without ambient credentials or external network
        run: |
          set -euo pipefail
          suite_root=$(mktemp -d "$RUNNER_TEMP/opr-seat-env.XXXXXX")
          mkdir -p "$suite_root/home"
          # Only loopback exists in this namespace. Drop back to the runner user
          # before the CLI, private daemon and private tmux server are started.
          sudo unshare --net -- /bin/bash -s -- "$(id -un)" "$suite_root" "$PATH" <<'SUITE'
          set -euo pipefail
          ip link set lo up
          exec runuser -u "$1" -- env -i HOME="$2/home" PATH="$3" TMPDIR="$2" TMUX_TMPDIR="$2" \
            CI=true TERM=xterm-256color \
            npm run test -w packages/daemon -- test/seat-env-parent-session.integration.test.ts test/pi-shell-launch-native.test.ts --maxWorkers=1 --reporter=verbose
          SUITE

  package-tests:
    if: ${{ github.event_name != 'push' }}
    # macOS, the platform OpenRig runs on: several daemon and cli tests read macOS ps columns,
    # file-inode behaviour and release tags.
    runs-on: macos-latest
    timeout-minutes: 60
    strategy:
      fail-fast: false
      matrix:
        package: [daemon, cli, tui, ui]
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
          persist-credentials: false
      - uses: actions/setup-node@v4
        with:
          node-version: 22
          cache: npm
      - run: brew install tmux
      - run: npm ci
      - name: Build the packages the tests import
        run: npm run build
      - name: Run the suite without ambient credentials or external network
        run: |
          suite_root=$(mktemp -d "$RUNNER_TEMP/opr-test.XXXXXX")
          suite_root=$(cd "$suite_root" && pwd -P)
          mkdir -p "$suite_root/home" "$suite_root/bin"
          # Same system bytes, nonprivileged mode; no system file is changed.
          /usr/bin/install -m 0755 /bin/ps "$suite_root/bin/ps"
          # Only this job's temporary sockets (including tmux) are reachable.
          env -i HOME="$suite_root/home" PATH="$PATH" TMPDIR="$suite_root" TMUX_TMPDIR="$suite_root" \
            CI=true TERM=xterm-256color \
            sandbox-exec -D IPC_ROOT="$suite_root" -p '(version 1)(allow default)(deny network-outbound)(allow network-outbound (remote ip "localhost:*"))(allow network-outbound (subpath (param "IPC_ROOT")))' \
            /bin/bash -s "${{ matrix.package }}" <<'SUITE'
          set -euo pipefail
          node scripts/ci-macos-process-probe.mjs
          # The production readers use bare ps. Select real system bytes only after
          # self/owned-child observation and network/IPC confinement are proved.
          export PATH="$TMPDIR/bin:$PATH"
          test "$(command -v ps)" = "$TMPDIR/bin/ps"
          exec npm run test -w "packages/$1"
          SUITE

  installed-scenario:
    runs-on: ubuntu-latest
    timeout-minutes: 35
    steps:
      - uses: actions/checkout@v4
        with:
          persist-credentials: false
      - uses: actions/setup-node@v4
        with:
          node-version: 22
          cache: npm
      - run: npm ci
      - name: Installed package, daemon restart, and seeded durability failure
        run: bash scripts/run-pr-scenarios.sh
      - uses: actions/upload-artifact@v4
        if: always()
        with:
          name: installed-scenario-evidence
          path: dist/pr-scenarios/
          if-no-files-found: error