ci.yml

name: CI

on:
  pull_request:
  push:
    branches:
      - main
  schedule:
    - cron: "23 5 * * 1"
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: ci-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  workflow-lint:
    name: GitHub Actions static validation
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
      - name: Check out the repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: Set up Node.js 24
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: 24.x
          cache: npm
      - name: Install locked dependencies
        run: npm ci
      - name: Validate Public Preview content and identity
        run: npm run check:public-preview
      - name: Download the pinned actionlint release
        id: actionlint
        shell: bash
        run: |
          set -euo pipefail
          version="$(tr -d '\n' < .github/actionlint-version)"
          asset="actionlint_${version}_linux_amd64.tar.gz"
          base="https://github.com/rhysd/actionlint/releases/download/v${version}"
          curl --fail --location --proto '=https' --retry 3 --silent --show-error \
            "$base/$asset" --output "$RUNNER_TEMP/$asset"
          expected="$(awk -v file="$asset" '$2 == file { print $1 }' .github/actionlint-checksums.txt)"
          actual="$(sha256sum "$RUNNER_TEMP/$asset" | awk '{ print $1 }')"
          if [[ -z "$expected" || "$actual" != "$expected" ]]; then
            echo "actionlint release checksum verification failed." >&2
            exit 1
          fi
          tar -xzf "$RUNNER_TEMP/$asset" -C "$RUNNER_TEMP" actionlint
          echo "binary=$RUNNER_TEMP/actionlint" >> "$GITHUB_OUTPUT"
      - name: Validate all workflows
        env:
          ACTIONLINT_BIN: ${{ steps.actionlint.outputs.binary }}
        run: npm run actionlint

  locked:
    name: Locked OpenAI / Node.js ${{ matrix.node-version }}
    runs-on: ubuntu-latest
    timeout-minutes: 25
    strategy:
      fail-fast: false
      matrix:
        node-version:
          - 22.x
          - 24.x
    steps:
      - name: Check out the repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
          persist-credentials: false
      - name: Set up Node.js ${{ matrix.node-version }}
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: ${{ matrix.node-version }}
          cache: npm
      - name: Install locked dependencies
        run: npm ci
      - name: Check formatting
        run: npm run format:check
      - name: Lint
        run: npm run lint
      - name: Type-check
        run: npm run typecheck
      - name: Run unit and mocked contract tests
        run: npm test
      - name: Scan tracked material for secret patterns
        run: npm run test:secrets
      - name: Scan current and historical standalone content
        run: npm run check:standalone-content
      - name: Build ESM and CommonJS outputs
        run: npm run build
      - name: Validate the package shape
        run: npm run test:package
      - name: Execute the documented examples against a packed artifact
        run: npm run test:examples
      - name: Verify live-smoke semantic checks with mocked transport
        run: npm run test:live-contract
      - name: Test packed-package fixtures
        run: npm run test:fixtures

  artifact-pack:
    name: Pack the CI artifact
    runs-on: ubuntu-latest
    timeout-minutes: 15
    outputs:
      sha256: ${{ steps.pack.outputs.sha256 }}
    steps:
      - name: Check out the repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: Set up Node.js 24
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: 24.x
          cache: npm
      - name: Install locked dependencies
        run: npm ci
      - name: Pack exactly one artifact
        id: pack
        shell: bash
        run: |
          set -euo pipefail
          mkdir -p ci-artifacts
          npm pack --pack-destination ci-artifacts
          mapfile -t tarballs < <(find ci-artifacts -maxdepth 1 -type f -name '*.tgz' -print)
          if [[ "${#tarballs[@]}" -ne 1 ]]; then
            echo "Expected exactly one packed artifact, found ${#tarballs[@]}." >&2
            exit 1
          fi
          echo "sha256=$(sha256sum "${tarballs[0]}" | awk '{ print $1 }')" >> "$GITHUB_OUTPUT"
      - name: Upload the packed artifact
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: ci-npm-package
          path: ci-artifacts/*.tgz
          if-no-files-found: error

  artifact-download:
    name: Verify the CI artifact round-trip
    needs:
      - artifact-pack
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - name: Download the packed artifact by name
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: ci-npm-package
          path: ci-artifacts
      - name: Verify the unique artifact and its digest
        env:
          EXPECTED_SHA256: ${{ needs.artifact-pack.outputs.sha256 }}
        shell: bash
        run: |
          set -euo pipefail
          mapfile -t tarballs < <(find ci-artifacts -maxdepth 1 -type f -name '*.tgz' -print)
          if [[ "${#tarballs[@]}" -ne 1 ]]; then
            echo "Expected exactly one downloaded artifact, found ${#tarballs[@]}." >&2
            exit 1
          fi
          echo "$EXPECTED_SHA256  ${tarballs[0]}" | sha256sum --check --strict

  minimum-openai:
    name: Minimum OpenAI / Node.js 22
    runs-on: ubuntu-latest
    timeout-minutes: 20
    steps:
      - name: Check out the repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: Set up Node.js 22
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: 22.x
          cache: npm
      - name: Install locked development dependencies
        run: npm ci
      - name: Test the minimum supported OpenAI version
        run: npm run test:compat -- --lane minimum

  latest-openai:
    name: Latest OpenAI 6.x canary / Node.js 24
    if: >-
      github.event_name == 'schedule' ||
      github.event_name == 'workflow_dispatch' ||
      (github.event_name == 'pull_request' && github.actor == 'dependabot[bot]')
    runs-on: ubuntu-latest
    timeout-minutes: 20
    steps:
      - name: Check out the repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: Set up Node.js 24
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: 24.x
          cache: npm
      - name: Install locked development dependencies
        run: npm ci
      - name: Test the latest compatible OpenAI version
        run: npm run test:compat -- --lane latest

  current-node-advisory:
    name: Node.js 26 advisory
    continue-on-error: true
    runs-on: ubuntu-latest
    timeout-minutes: 20
    steps:
      - name: Check out the repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: Set up Node.js 26
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: 26.x
          cache: npm
      - name: Install locked dependencies
        run: npm ci
      - name: Type-check
        run: npm run typecheck
      - name: Run unit and mocked contract tests
        run: npm test
      - name: Build ESM and CommonJS outputs
        run: npm run build
      - name: Validate the package shape
        run: npm run test:package
      - name: Verify live-smoke semantic checks with mocked transport
        run: npm run test:live-contract

  self-contained:
    name: Standalone repository check
    runs-on: ubuntu-latest
    timeout-minutes: 25
    steps:
      - name: Check out the repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: Set up Node.js 24
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: 24.x
          cache: npm
      - name: Install locked dependencies
        run: npm ci
      - name: Copy and verify the standalone repository
        run: npm run check:self-contained