ci.yml

# Sovereign CI — calls reusable workflow from paiml/.github
# Change once in paiml/.github → applies to all repos
name: CI

on:
  push:
    branches: [main, master]
  pull_request:
    branches: [main, master]
  workflow_dispatch:

concurrency:
  group: ci-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true

jobs:
  ci:
    uses: paiml/.github/.github/workflows/sovereign-ci.yml@main
    with:
      repo: ${{ github.event.repository.name }}
      # Phase 3 pilot (medium workload) — build-performance.md §7 Phase 3.
      # Workspace with rash + runtime + wasm — moderate dep graph,
      # candidate for mid-range hit-rate signal between copia and aprender.
      enable_sccache: true
      use_nextest: true
      # GH-214: without this the reusable workflow runs `--lib`, which scopes to
      # the ROOT package (bashrs-specs) and never builds rash/, bashrs-oracle,
      # bashrs-runtime or bashrs-wasm. bashrs-oracle's test module therefore
      # failed to compile for months while every check stayed green. `--workspace
      # --lib` is what makes a rotting workspace member loud.
      #
      # Verified locally before enabling, because turning this on blind would red
      # the whole pipeline: `cargo test --workspace --lib --no-run` builds all 5
      # members with 0 errors (bashrs, bashrs_oracle, bashrs_runtime,
      # bashrs_specs, bashrs_wasm).
      test_workspace: true
      # rash/src/testing/shellcheck_validation_tests.rs shells out to shellcheck
      # and `.expect()`s it, so those 23 tests PANIC where it is absent. They
      # never ran before because `--lib` scoped to the root stub package; turning
      # test_workspace on is what surfaced them.
      #
      # Installed rather than skipped: that module asserts a stated critical
      # invariant — "every generated script must pass `shellcheck -s sh`" — so
      # skipping it in CI would swap a red for a silent green, which is the exact
      # failure mode this repo keeps getting bitten by. infra's clean-room gate
      # already installs shellcheck for bashrs for the same reason.
      extra_pkgs: shellcheck
    secrets: inherit

  # Top-level gate: org ruleset requires status check named "gate" (exact match).
  # The reusable workflow produces "ci / gate" which doesn't satisfy the ruleset.
  gate:
    runs-on: ubuntu-latest
    needs: [ci]
    if: always()
    steps:
      - name: Check required jobs
        run: |
          if [ "${{ needs.ci.result }}" != "success" ]; then
            echo "ci failed: ${{ needs.ci.result }}"
            exit 1
          fi
          echo "All required jobs passed"