validate.yml

name: Validate package

on:
  push:
    branches: [main]
  pull_request:
  workflow_dispatch:

concurrency:
  group: validate-${{ github.event_name == 'pull_request' && format('pr-{0}', github.event.pull_request.number) || format('{0}-{1}', github.event_name, github.sha) }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

permissions:
  contents: read

env:
  EXPECTED_SKILLS: >-
    cc-issue-review cc-implement-issue cc-initial-review cc-resolve-comments
    cc-rereview
    cc-orchestrator cc-orca-orchestrator cc-pr-review cc-code-review
    cc-security-review cc-verify cc-run cc-provider-bootstrap cc-stats
    cc-profile-config cc-host-permissions

jobs:
  validate:
    name: Skills, manifests, and Bash installer
    # Pull requests from any other repository run on GitHub-hosted runners;
    # all other events use self-hosted. Comparing the head repository fails
    # closed: a null head repository also selects ubuntu-latest.
    runs-on: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name != github.repository && 'ubuntu-latest' || fromJSON('["self-hosted","Linux","X64"]') }}
    steps:
      - name: Check out repository
        uses: actions/checkout@v4
        with:
          # The classification diffs against the base of a pull request or the
          # previous commit of a push, which a shallow checkout lacks.
          fetch-depth: 0

      - name: Set up Python
        # The self-hosted runner uses its system python3: the tool-cache
        # Python is built shared and its child processes cannot find
        # libpython once the tests clear the environment. A virtual
        # environment keeps pip installs off the system interpreter.
        shell: bash
        run: |
          python3 -m venv "$RUNNER_TEMP/venv"
          echo "$RUNNER_TEMP/venv/bin" >> "$GITHUB_PATH"

      - name: Classify the change
        # Every step below that is not the fast path runs unless this step
        # reports `fast`, so a step that fails to run classifies as `full`.
        id: classify
        continue-on-error: true
        run: python3 scripts/fast_path.py classify
        env:
          FAST_PATH_BASE: ${{ github.event.pull_request.base.sha || github.event.before }}
          FAST_PATH_HEAD: ${{ github.event.pull_request.head.sha || github.sha }}

      - name: Show the interpreter and environment
        if: ${{ steps.classify.outputs.mode != 'fast' }}
        shell: bash
        run: |
          python3 --version
          command -v python3
          ldd "$(command -v python3)" | grep -i libpython || echo "statically linked or no libpython needed"
          echo "HOME=$HOME USER=$(id -un) TMPDIR=${TMPDIR:-unset}"
          ls -ld "$HOME" || true

      - name: Install the configuration parser
        # PyYAML is the runtime's one optional dependency, needed only to read a
        # repository's `.code-cycle.yml`. Installed here so the configuration
        # path is exercised rather than skipped.
        run: python3 -m pip install --quiet pyyaml

      - name: Run the fast path for a non-code change
        # The privacy and metadata-sidecar scan, plus the tests that read an
        # allowlisted file. Every other validation is skipped.
        if: ${{ steps.classify.outputs.mode == 'fast' }}
        run: python3 scripts/fast_path.py run-fast --job validate --scan
        env:
          FAST_PATH_TESTS: ${{ steps.classify.outputs.tests }}

      - name: Validate skills and package metadata
        if: ${{ steps.classify.outputs.mode != 'fast' }}
        run: |
          python3 scripts/validate-package.py
          python3 -m unittest discover -s tests -v

      - name: Set up Node.js for skills CLI discovery
        if: ${{ steps.classify.outputs.mode != 'fast' }}
        uses: actions/setup-node@v4
        with:
          node-version: '22'

      - name: Discover every skill through the recommended CLI
        if: ${{ steps.classify.outputs.mode != 'fast' }}
        run: |
          set -euo pipefail
          output="$(npx --yes skills@1.5.23 add . --list)"
          printf '%s\n' "$output"
          for skill in $EXPECTED_SKILLS; do
            case "$output" in
              *"$skill"*) ;;
              *) echo "skills CLI did not discover: $skill" >&2; exit 1 ;;
            esac
          done

      - name: Validate JSON manifests
        if: ${{ steps.classify.outputs.mode != 'fast' }}
        run: |
          python3 -m json.tool .claude-plugin/plugin.json >/dev/null
          python3 -m json.tool .codex-plugin/plugin.json >/dev/null

      - name: Check Bash installer syntax
        if: ${{ steps.classify.outputs.mode != 'fast' }}
        run: |
          bash -n scripts/install.sh
          sh -n scripts/get.sh

      - name: Lint Bash installer
        if: ${{ steps.classify.outputs.mode != 'fast' }}
        # System tools are preinstalled on the self-hosted runner; the workflow
        # only runs them and needs no root.
        run: |
          command -v shellcheck >/dev/null || { echo "shellcheck is not installed on the runner" >&2; exit 1; }
          shellcheck scripts/install.sh scripts/get.sh

      - name: Install through the one-command installer
        if: ${{ steps.classify.outputs.mode != 'fast' }}
        run: |
          set -euo pipefail
          home="$RUNNER_TEMP/get-home"
          mkdir -p "$home"
          HOME="$home" sh scripts/get.sh --version main
          # get.sh downloads main, so assert the skills main ships; this
          # pull request's own skill set is asserted by the local installs.
          git fetch --quiet --depth=1 origin main
          main_skills=$(git ls-tree --name-only FETCH_HEAD skills/ | sed 's#^skills/##')
          [ -n "$main_skills" ] || { echo "could not list the skills on main" >&2; exit 1; }
          for skill in $main_skills; do
            [ -f "$home/.claude/skills/$skill/SKILL.md" ] \
              || { echo "get.sh did not install $skill" >&2; exit 1; }
          done
          [ -f "$home/.code-cycle/runtime/run_cycle.py" ] \
            || { echo "get.sh did not install the runtime" >&2; exit 1; }
          if HOME="$home" sh scripts/get.sh --version not-a-tag 2>/dev/null; then
            echo "get.sh accepted an invalid version" >&2
            exit 1
          fi

      - name: Test project installation for all hosts
        if: ${{ steps.classify.outputs.mode != 'fast' }}
        run: |
          set -euo pipefail
          project="$RUNNER_TEMP/install-target"
          rm -rf "$project"
          mkdir -p "$project"

          bash scripts/install.sh --agent all --scope project --project-dir "$project"

          for destination in "$project/.claude/skills" "$project/.agents/skills" "$project/.opencode/skills"; do
            [ -d "$destination" ] || { echo "Missing destination: $destination" >&2; exit 1; }
            for skill in $EXPECTED_SKILLS; do
              [ -f "$destination/$skill/SKILL.md" ] \
                || { echo "Missing installed skill: $destination/$skill/SKILL.md" >&2; exit 1; }
            done
          done

      - name: Install Codex skills to .agents/skills only
        if: ${{ steps.classify.outputs.mode != 'fast' }}
        run: |
          set -euo pipefail
          home="$RUNNER_TEMP/codex-home"
          rm -rf "$home"
          mkdir -p "$home/.codex/skills/cc-verify" "$home/.codex/skills/other-skill"

          # Without --force the earlier copies are named and kept.
          HOME="$home" bash scripts/install.sh --agent codex --scope global --no-runtime 2>"$RUNNER_TEMP/codex-warning"
          grep -q "$home/.codex/skills/cc-verify" "$RUNNER_TEMP/codex-warning" \
            || { echo "The installer did not warn about the duplicate" >&2; exit 1; }
          [ -d "$home/.codex/skills/cc-verify" ] \
            || { echo "The installer removed a duplicate without --force" >&2; exit 1; }

          # With --force this toolkit's copies go and nothing else does.
          HOME="$home" bash scripts/install.sh --agent codex --scope global --no-runtime --force
          for skill in $EXPECTED_SKILLS; do
            [ -f "$home/.agents/skills/$skill/SKILL.md" ] \
              || { echo "Missing installed skill: $home/.agents/skills/$skill/SKILL.md" >&2; exit 1; }
            [ ! -e "$home/.codex/skills/$skill" ] \
              || { echo "Codex skill duplicated in $home/.codex/skills/$skill" >&2; exit 1; }
          done
          [ -d "$home/.codex/skills/other-skill" ] \
            || { echo "The installer removed a skill that is not its own" >&2; exit 1; }

      - name: Refuse to overwrite without --force
        if: ${{ steps.classify.outputs.mode != 'fast' }}
        run: |
          set -uo pipefail
          project="$RUNNER_TEMP/install-target"
          if bash scripts/install.sh --agent claude --scope project --project-dir "$project" 2>/dev/null; then
            echo "Installer overwrote an existing installation without --force" >&2
            exit 1
          fi
          bash scripts/install.sh --agent claude --scope project --project-dir "$project" --force

      - name: Reject a missing project directory
        if: ${{ steps.classify.outputs.mode != 'fast' }}
        run: |
          set -uo pipefail
          if bash scripts/install.sh --agent claude --scope project \
              --project-dir "$RUNNER_TEMP/does-not-exist" 2>/dev/null; then
            echo "Installer accepted a nonexistent project directory" >&2
            exit 1
          fi

      - name: Record the validation outcome
        if: ${{ steps.classify.outputs.mode != 'fast' }}
        run: python3 scripts/fast_path.py summary --job validate

  windows-test-shards:
    name: Windows test shard (${{ matrix.shard }})
    runs-on: windows-latest
    strategy:
      fail-fast: false
      matrix:
        shard: [windows-1, windows-2, windows-3, windows-4]
    steps:
      - name: Check out repository
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: '3.x'

      - name: Classify the change
        # Each shard classifies the change itself: there is no job-level skip,
        # so a shard that skips its tests still finishes successfully.
        id: classify
        continue-on-error: true
        run: py -3 scripts/fast_path.py classify
        env:
          FAST_PATH_BASE: ${{ github.event.pull_request.base.sha || github.event.before }}
          FAST_PATH_HEAD: ${{ github.event.pull_request.head.sha || github.sha }}

      - name: Install the Windows test dependencies
        run: py -3 -m pip install --quiet pyyaml

      - name: Run the fast path for a non-code change
        # Only the tests mapped to the change that belong to this shard.
        if: ${{ steps.classify.outputs.mode == 'fast' }}
        run: py -3 scripts/fast_path.py run-fast --job windows-shard --shard ${{ matrix.shard }}
        env:
          FAST_PATH_TESTS: ${{ steps.classify.outputs.tests }}

      - name: Validate shard assignments and run tests
        if: ${{ steps.classify.outputs.mode != 'fast' }}
        run: py -3 scripts/run_windows_test_shard.py ${{ matrix.shard }}

      - name: Record the validation outcome
        if: ${{ steps.classify.outputs.mode != 'fast' }}
        run: py -3 scripts/fast_path.py summary --job windows-shard --shard ${{ matrix.shard }}

  powershell-installer:
    name: PowerShell installer
    runs-on: windows-latest
    needs: windows-test-shards
    if: ${{ always() }}
    steps:
      - name: Require all Windows test shards to pass
        if: ${{ always() && needs.windows-test-shards.result != 'success' }}
        run: exit 1

      - name: Check out repository
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: '3.x'

      - name: Classify the change
        id: classify
        continue-on-error: true
        run: py -3 scripts/fast_path.py classify
        env:
          FAST_PATH_BASE: ${{ github.event.pull_request.base.sha || github.event.before }}
          FAST_PATH_HEAD: ${{ github.event.pull_request.head.sha || github.sha }}

      - name: Install the Windows test dependencies
        run: py -3 -m pip install --quiet pyyaml

      - name: Run the fast path for a non-code change
        # Only the privacy and metadata-sidecar scan: this job's other work is
        # the Windows installer scenarios, which a non-code change cannot reach.
        if: ${{ steps.classify.outputs.mode == 'fast' }}
        run: py -3 scripts/fast_path.py run-fast --job powershell-installer --scan
        env:
          FAST_PATH_TESTS: ''

      - name: Validate package with Windows Python
        if: ${{ steps.classify.outputs.mode != 'fast' }}
        run: py -3 scripts/validate-package.py

      - name: Test project installation for all hosts
        if: ${{ steps.classify.outputs.mode != 'fast' }}
        shell: pwsh
        run: |
          $project = Join-Path $env:RUNNER_TEMP 'code-cycle-toolkit-install-target'
          if (Test-Path -LiteralPath $project) {
              Remove-Item -LiteralPath $project -Recurse -Force
          }
          New-Item -ItemType Directory -Path $project -Force | Out-Null

          & .\scripts\install.ps1 -Agent all -Scope project -ProjectDir $project

          $skills = $env:EXPECTED_SKILLS -split '\s+' | Where-Object { $_ }
          $destinations = @(
              (Join-Path $project '.claude\skills'),
              (Join-Path $project '.agents\skills'),
              (Join-Path $project '.opencode\skills')
          )

          foreach ($destination in $destinations) {
              if (-not (Test-Path -LiteralPath $destination -PathType Container)) {
                  throw "Missing installation destination: $destination"
              }
              foreach ($skill in $skills) {
                  $skillFile = Join-Path (Join-Path $destination $skill) 'SKILL.md'
                  if (-not (Test-Path -LiteralPath $skillFile -PathType Leaf)) {
                      throw "Missing installed skill: $skillFile"
                  }
              }
          }

      - name: Install through the one-command installer
        if: ${{ steps.classify.outputs.mode != 'fast' }}
        shell: pwsh
        run: |
          $project = Join-Path $env:RUNNER_TEMP 'code-cycle-toolkit-get-target'
          New-Item -ItemType Directory -Path $project -Force | Out-Null
          & .\scripts\get.ps1 -Version main -Agent claude -Scope project -ProjectDir $project
          # get.ps1 downloads main, so assert the skills main ships; this
          # pull request's own skill set is asserted by the local installs.
          git fetch --quiet --depth=1 origin main
          if ($LASTEXITCODE -ne 0) { throw 'could not fetch main' }
          $skills = git ls-tree --name-only FETCH_HEAD skills/ | ForEach-Object { $_ -replace '^skills/', '' }
          if (-not $skills) { throw 'could not list the skills on main' }
          foreach ($skill in $skills) {
              $skillFile = Join-Path $project ".claude\skills\$skill\SKILL.md"
              if (-not (Test-Path -LiteralPath $skillFile -PathType Leaf)) {
                  throw "get.ps1 did not install $skill"
              }
          }
          if (-not (Test-Path -LiteralPath (Join-Path $project '.code-cycle\runtime\run_cycle.py') -PathType Leaf)) {
              throw 'get.ps1 did not install the runtime'
          }

      - name: Run a stage from the installed runtime
        if: ${{ steps.classify.outputs.mode != 'fast' }}
        shell: pwsh
        run: |
          $project = Join-Path $env:RUNNER_TEMP 'code-cycle-toolkit-install-target'
          $runtime = Join-Path (Join-Path $project '.code-cycle') 'runtime'
          $database = Join-Path $env:RUNNER_TEMP 'installed-telemetry.sqlite'
          if (Test-Path -LiteralPath $database) {
              Remove-Item -LiteralPath $database -Force
          }
          py -3 tests\installed_stage_check.py $runtime $database
          if ($LASTEXITCODE -ne 0) {
              throw 'The installed runtime could not run and record a stage'
          }

      - name: Leave an existing ignore file alone and refuse a linked one
        if: ${{ steps.classify.outputs.mode != 'fast' }}
        shell: pwsh
        run: |
          $project = Join-Path $env:RUNNER_TEMP 'code-cycle-toolkit-link-target'
          if (Test-Path -LiteralPath $project) {
              Remove-Item -LiteralPath $project -Recurse -Force
          }
          New-Item -ItemType Directory -Path (Join-Path $project '.code-cycle') -Force | Out-Null

          $ignore = Join-Path (Join-Path $project '.code-cycle') '.gitignore'
          Set-Content -LiteralPath $ignore -Value 'keep-existing-rules'
          & .\scripts\install.ps1 -Agent claude -Scope project -ProjectDir $project
          $kept = (Get-Content -LiteralPath $ignore -Raw).Trim()
          if ($kept -ne 'keep-existing-rules') {
              throw "The installer replaced an existing ignore file: $kept"
          }

          $outside = Join-Path $project 'outside.txt'
          Set-Content -LiteralPath $outside -Value 'precious'
          Remove-Item -LiteralPath $ignore -Force
          New-Item -ItemType SymbolicLink -Path $ignore -Target $outside | Out-Null

          $refused = $false
          try {
              & .\scripts\install.ps1 -Agent claude -Scope project -ProjectDir $project -Force
          } catch {
              $refused = $true
          }
          if (-not $refused) {
              throw 'The installer followed a linked ignore file instead of refusing it'
          }
          $survived = (Get-Content -LiteralPath $outside -Raw).Trim()
          if ($survived -ne 'precious') {
              throw "The installer wrote through the link: $survived"
          }

      - name: Install Codex skills to .agents/skills only
        if: ${{ steps.classify.outputs.mode != 'fast' }}
        shell: pwsh
        run: |
          # A global install writes to the runner's own profile, which is
          # discarded with the job.
          $home_ = [Environment]::GetFolderPath('UserProfile')
          $agents = Join-Path $home_ '.agents\skills'
          $legacy = Join-Path $home_ '.codex\skills'
          foreach ($name in 'cc-verify', 'other-skill') {
              New-Item -ItemType Directory -Path (Join-Path $legacy $name) -Force | Out-Null
          }

          # Without -Force the earlier copies are named and kept.
          $warnings = & .\scripts\install.ps1 -Agent codex -Scope global -NoRuntime 3>&1 |
              Where-Object { $_ -is [System.Management.Automation.WarningRecord] }
          if (-not ($warnings -match [regex]::Escape((Join-Path $legacy 'cc-verify')))) {
              throw 'The installer did not warn about the duplicate'
          }
          if (-not (Test-Path -LiteralPath (Join-Path $legacy 'cc-verify'))) {
              throw 'The installer removed a duplicate without -Force'
          }

          # With -Force this toolkit's copies go and nothing else does.
          & .\scripts\install.ps1 -Agent codex -Scope global -NoRuntime -Force
          $skills = $env:EXPECTED_SKILLS -split '\s+' | Where-Object { $_ }
          foreach ($skill in $skills) {
              $skillFile = Join-Path (Join-Path $agents $skill) 'SKILL.md'
              if (-not (Test-Path -LiteralPath $skillFile -PathType Leaf)) {
                  throw "Missing installed skill: $skillFile"
              }
              if (Test-Path -LiteralPath (Join-Path $legacy $skill)) {
                  throw "Codex skill duplicated in $(Join-Path $legacy $skill)"
              }
          }
          if (-not (Test-Path -LiteralPath (Join-Path $legacy 'other-skill'))) {
              throw 'The installer removed a skill that is not its own'
          }

      - name: Refuse to overwrite without -Force
        if: ${{ steps.classify.outputs.mode != 'fast' }}
        shell: pwsh
        run: |
          $project = Join-Path $env:RUNNER_TEMP 'code-cycle-toolkit-install-target'
          $overwrote = $true
          try {
              & .\scripts\install.ps1 -Agent claude -Scope project -ProjectDir $project
          } catch {
              $overwrote = $false
          }
          if ($overwrote) {
              throw 'Installer overwrote an existing installation without -Force'
          }
          & .\scripts\install.ps1 -Agent claude -Scope project -ProjectDir $project -Force

      - name: Reject a missing project directory
        if: ${{ steps.classify.outputs.mode != 'fast' }}
        shell: pwsh
        run: |
          $project = Join-Path $env:RUNNER_TEMP 'code-cycle-toolkit-does-not-exist'
          if (Test-Path -LiteralPath $project) {
              Remove-Item -LiteralPath $project -Recurse -Force
          }
          $accepted = $true
          try {
              & .\scripts\install.ps1 -Agent claude -Scope project -ProjectDir $project
          } catch {
              $accepted = $false
          }
          if ($accepted) {
              throw 'Installer accepted a nonexistent project directory'
          }

      - name: Record the validation outcome
        if: ${{ steps.classify.outputs.mode != 'fast' }}
        run: py -3 scripts/fast_path.py summary --job powershell-installer