name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
  workflow_dispatch:

permissions: {}

jobs:
  go:
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-24.04, macos-15]
    runs-on: ${{ matrix.os }}
    timeout-minutes: 20
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          persist-credentials: false
      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
        with:
          go-version-file: go.mod
          cache: false
      - name: Test, check, and build the library, runner, and TUI
        run: make test check build

  fuzz:
    name: Fuzzing (${{ matrix.target }})
    runs-on: ubuntu-24.04
    timeout-minutes: 5
    permissions:
      contents: read
    strategy:
      fail-fast: false
      matrix:
        include:
          - target: FuzzCoordinatorLogMatchesExecution
            package: ./cmd/internal/agentrunner
          - target: FuzzRunLogMatchesExecution
            package: ./cmd/internal/agentrunner
          - target: FuzzCoordinatorFaults
            package: ./harness/coordinator
          - target: FuzzPrepareViewImage
            package: ./harness/operation
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          persist-credentials: false
      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
        with:
          go-version-file: go.mod
          cache: false
      - name: Run fuzz target
        run: go test ${{ matrix.package }} -run '^$' -fuzz '^${{ matrix.target }}$' -fuzztime=30s -fuzzminimizetime=1s -parallel=2
      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        if: failure()
        with:
          name: fuzz-corpus-${{ matrix.target }}
          path: ${{ matrix.package }}/testdata/fuzz/
          if-no-files-found: ignore
          retention-days: 7

  harbor:
    runs-on: ubuntu-24.04
    timeout-minutes: 25
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          persist-credentials: false
      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
        with:
          go-version-file: go.mod
          cache: false
      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
        with:
          python-version: '3.12'
      - uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
        with:
          version: '0.12.17'
          enable-cache: false
      - run: make -C benchmarks/harbor test check build BUNDLE=../../bin/harbor/ci
      - run: make -C benchmarks/harbor smoke BUNDLE=../../bin/harbor/ci
      - run: docker build -t unreal-agent-ci .
      - run: docker run --rm unreal-agent-ci -h