name: CI

on:
  push:
    branches: [main]
  pull_request:

permissions:
  contents: read

concurrency:
  group: ci-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  test:
    name: ${{ matrix.os }} / Node ${{ matrix.node }}
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, macos-latest, windows-latest]
        node: [22.22.2, 24.15.0]
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: ${{ matrix.node }}
          cache: npm
          registry-url: https://registry.npmjs.org/
      - run: npm ci
      - run: npm test
      - run: npm run build
      - if: ${{ matrix.os == 'macos-latest' && matrix.node == '22.22.2' }}
        run: npm run test:desktop-smoke
      # 真实消费者验收：打包 → 装进只含已声明依赖的裸消费者 → CLI 与
      # Gateway 契约全链路。跑在基线 Node 上，一并证明基线可用。
      - if: ${{ matrix.os == 'ubuntu-latest' && matrix.node == '22.22.2' }}
        run: QWEN_AUDIO_CONSUMER_PROBE=1 node --test test/consumer-install.test.mjs
      - run: node scripts/verify-package.mjs

  release-check:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version-file: .nvmrc
          cache: npm
          registry-url: https://registry.npmjs.org/
      - run: npm ci
      - run: npm run release:check

  # One stable branch-protection context. The matrix job names change whenever
  # the supported OS/Node set changes; this aggregate keeps main protection
  # bound to the complete CI result instead of a fragile list of matrix names.
  required:
    name: required
    if: ${{ always() }}
    needs: [test, release-check]
    runs-on: ubuntu-latest
    steps:
      - name: Verify all required jobs
        env:
          TEST_RESULT: ${{ needs.test.result }}
          RELEASE_CHECK_RESULT: ${{ needs.release-check.result }}
        run: |
          test "$TEST_RESULT" = success
          test "$RELEASE_CHECK_RESULT" = success