ci.yml

name: ci

on:
  push:
    branches: [master]
  pull_request:

permissions:
  contents: read

env:
  VOLAR_BRANCH: feat/tsgo-diagnostic-codes
  VOLAR_SHA: 37c5a2367 # vuejs/language-tools@feat/tsgo-diagnostic-codes, pinned for reproducibility

jobs:
  regression:
    runs-on: macos-latest
    steps:
      - uses: actions/checkout@v4
        with:
          submodules: recursive
          fetch-depth: 1

      - uses: actions/setup-node@v4
        with:
          node-version: 24
          cache: npm
          cache-dependency-path: |
            package-lock.json
            typescript/package-lock.json
            typescript-go/package-lock.json

      - uses: actions/setup-go@v5
        with:
          go-version: "1.26" # typescript-go/go.mod
          cache-dependency-path: typescript-go/go.sum

      - name: Install dependencies
        run: npm ci

      - name: Install typescript submodule dependencies
        run: npm ci
        working-directory: typescript

      - name: Install typescript-go submodule dependencies
        run: npm ci
        working-directory: typescript-go

      - name: Build js (tsgo native-preview -> vendor)
        run: npm run build:js

      - name: Build lib (patched TypeScript fork)
        run: npm run build:lib

      - name: Build bridge (cgo dylib)
        run: npm run build:bridge

      - name: go vet
        # Scoped to packages TNB patches touch — vetting all of typescript-go
        # (plus every test file) costs ~6min/run; upstream code is not our
        # surface. Keep in sync with patches/typescript-go/.
        run: go vet ./internal/api/... ./internal/ls/... ./internal/checker/... ./internal/compiler/... ./internal/bundled/... ./internal/project/... ./internal/module/...
        working-directory: typescript-go

      - name: Gates
        run: |
          npm run check:lib
          npm run check:enums

      # V8-sandbox failure class: the bridge's binary path must work under
      # Electron (VS Code's tsserver host) — invisible to every Node-only gate
      # (2026-07-20 incident). The probe spawns itself under Electron and
      # round-trips callBinary payloads.
      - name: Electron sandbox ABI probe
        run: |
          npm i --no-save electron@42
          node tools/triage-electron-abi.mjs

      - name: Clone volar (cache)
        id: volar-cache
        uses: actions/cache@v4
        with:
          path: |
            ${{ runner.temp }}/volar
            ${{ runner.temp }}/volar-stock
          key: volar-${{ env.VOLAR_SHA }}-v2

      - name: Clone volar
        if: steps.volar-cache.outputs.cache-hit != 'true'
        run: |
          git clone --depth 50 --branch "$VOLAR_BRANCH" https://github.com/vuejs/language-tools.git "$RUNNER_TEMP/volar"
          git -C "$RUNNER_TEMP/volar" checkout "$VOLAR_SHA"
          # Point volar's typescript override at the CI-built TNB — volar
          # master's override is `npm:typescript-native-bridge@<release>`, which
          # would fetch the released package instead of the commit under test.
          cd "$RUNNER_TEMP/volar"
          node -e "const fs=require('fs');const p='pnpm-workspace.yaml';let s=fs.readFileSync(p,'utf8');s=s.replace(/typescript: npm:typescript-native-bridge@.*/,'typescript: link:'+process.env.GITHUB_WORKSPACE);fs.writeFileSync(p,s);console.log(s.match(/overrides:[\s\S]*/)[0])"

      - name: Install volar
        if: steps.volar-cache.outputs.cache-hit != 'true'
        run: |
          cd "$RUNNER_TEMP/volar"
          corepack enable
          pnpm install --no-frozen-lockfile

      # Runs on every CI run (cache hit or miss): the cached node_modules links
      # typescript -> $GITHUB_WORKSPACE, i.e. the commit under test.
      - name: Test volar
        run: |
          # Volar's tsserver harness resolves typescript/lib/tsserver via a
          # fresh module lookup from dirname(realpath(typescript/package.json)).
          # With the link: override that realpath is this repo, so `typescript`
          # must resolve from here too — self-link it (TNB has no typescript
          # dependency of its own; node_modules is CI-local state).
          ln -sfn "$GITHUB_WORKSPACE" "$GITHUB_WORKSPACE/node_modules/typescript"
          cd "$RUNNER_TEMP/volar"
          npm test

      - name: Pack stock typescript
        if: steps.volar-cache.outputs.cache-hit != 'true'
        run: |
          mkdir "$RUNNER_TEMP/volar-stock"
          cd "$RUNNER_TEMP/volar-stock"
          npm pack typescript@6.0.3 --silent
          tar -xzf typescript-6.0.3.tgz

      - name: sweep-ls-throws
        env:
          VOLAR_ROOT: ${{ runner.temp }}/volar
        run: |
          # Runs before the witness batch: it regenerates /tmp/tnb-sweep-fixtures
          # that triage-quickinfo-emptyparity and triage-refs-exportspec read.
          TNB_TRACE_THROW=1 TNB_TRACE_THROW_FILE=/tmp/tnb-throw-ci.jsonl \
            node tools/sweep-ls-throws.mjs 2>&1 | tee /tmp/tnb-sweep-ci.log
          grep -q "correlated throw hits: 0" /tmp/tnb-sweep-ci.log \
            || { echo "sweep correlated hits != 0"; exit 1; }

      - name: Regression witnesses
        env:
          VOLAR_ROOT: ${{ runner.temp }}/volar
          STOCK_TSSERVER_PATH: ${{ runner.temp }}/volar-stock/package/lib/tsserver.js
        run: |
          # Parallel groups on isolated tools copies: the harness lock lives at
          # <toolsDir>/../.tnb-harness.lock, so concurrent tools from one
          # tools/ dir would serialize. vendor/ lib/ native/ are symlinked into
          # each copy for tools that boot the bridge in-process (they resolve the
          # repo from import.meta.dirname/..); README.md + patches/ too — the
          # ledger gate reads them for the patch<->README reconciliation.
          # Starts are staggered to spread the tsserver boot spike.
          group1="triage-f2qi-names triage-xrefs-diag-variants triage-tostring-gtd-vue triage-adv6b-generic-sig triage-sim-edit triage-f2hl-jsdoc triage-completion-details-array triage-refs-exportspec"
          group2="triage-f2r5-defcases triage-f2r6-samevue triage-f2r6-libref triage-f2r6-xvue triage-sim-xfile triage-f2hl-typesref triage-geterr-5823 triage-quickinfo-emptyparity triage-completion-parity triage-program-info"
          group3="triage-qi-delete-min triage-defineprops-refs triage-impl-kind triage-rpcsym-nameless triage-rpcsym-adversarial triage-f2hl-augment triage-orphan-leak triage-parent-watch-acceptance triage-f2hl-defaultkw triage-adv6a-jsx-spelling triage-empty-literal triage-alias-nil triage-ghost-close triage-prefetch-inferred triage-builder-keyform triage-win-drive-overlay triage-backslash-getsourcefile triage-bool-literal-intrinsic triage-tp-constraint triage-incremental-emit triage-bridge-thread-race triage-worker-libpath triage-jsdoc-assignment triage-alias-self-loop triage-type-field-audit triage-checker-differential triage-imported-extra-extension triage-emit-declaration-only triage-semantic-defaultlib triage-cli-only-flags triage-eslint-typeref-target check-readme-ledger triage-overlay-delta-sync"
          pids=()
          i=0
          for group in "$group1" "$group2" "$group3"; do
            i=$((i + 1))
            rm -rf "/tmp/tnb-wg$i"
            mkdir -p "/tmp/tnb-wg$i"
            cp -R tools "/tmp/tnb-wg$i/tools"
            ln -sfn "$GITHUB_WORKSPACE/vendor" "/tmp/tnb-wg$i/vendor"
            ln -sfn "$GITHUB_WORKSPACE/lib" "/tmp/tnb-wg$i/lib"
            ln -sfn "$GITHUB_WORKSPACE/native" "/tmp/tnb-wg$i/native"
            ln -sfn "$GITHUB_WORKSPACE/README.md" "/tmp/tnb-wg$i/README.md"
            ln -sfn "$GITHUB_WORKSPACE/patches" "/tmp/tnb-wg$i/patches"
            (
              failed=()
              for w in $group; do
                echo "=== [wg$i] $w ==="
                (cd "/tmp/tnb-wg$i/tools" && node "$w.mjs") || failed+=("$w")
              done
              if ((${#failed[@]})); then
                echo "WG$i FAILURES (${#failed[@]}): ${failed[*]}"
                exit 1
              fi
            ) > "/tmp/tnb-wg$i.log" 2>&1 &
            pids+=($!)
            sleep 15
          done
          rc=0
          for p in "${pids[@]}"; do wait "$p" || rc=1; done
          for j in 1 2 3; do
            echo "=== witness group $j (tail) ==="
            tail -5 "/tmp/tnb-wg$j.log" || true
            if ((rc)); then
              # tail -5 can land on a KNOWN-exemption pair and hide the real
              # failure keys (run 30062511367 misread this way): on failure,
              # surface diff lines with their stock/tnb context.
              echo "=== witness group $j (failure lines) ==="
              grep -E -A2 "^DIFF |^FAIL |VERDICT: FAIL|FAILURES \(|verdict=DIFF" "/tmp/tnb-wg$j.log" || true
            fi
          done
          exit $rc

      - name: sourcefile-guard
        env:
          VOLAR_ROOT: ${{ runner.temp }}/volar
        run: npm run check:sourcefile-guard

      - name: Cleanup harness processes
        if: always()
        run: node tools/kill-leaked-harness.mjs || true