native.yml

name: Native desktop
on:
  push:
    branches: [main]
  pull_request:
    paths: ['native/**', 'vendor/**', 'scripts/fixtures/native-glib-variant.rs', 'scripts/fixtures/native-runtime-write-errors.c', 'src-tauri/**', 'ui/**', 'licenses/native/**', 'packaging/native-runtime/**', 'packaging/native-app-run.sh', 'packaging/llama.cpp/**', 'packaging/shadow-agent.desktop', 'tools/llama.cpp.pin', 'tools/glslc-flatpak.sh', 'scripts/build-llama.cpp.sh', 'scripts/*llama*.mjs', 'scripts/install-appimage.sh', 'scripts/install-release-state.sh', 'scripts/installer-auth-fixtures.mjs', 'scripts/test-install-auth.mjs', 'release/**', 'scripts/test-install-appimage.sh', 'scripts/test-clean-host-*.mjs', 'scripts/clean-host-*.mjs', 'scripts/clean-host-mcp-smoke.sh', 'scripts/fixtures/native-*.mjs', 'scripts/clean-host-runtime.Dockerfile', 'scripts/clean-host-gui-smoke.sh', 'scripts/*native*.mjs', 'scripts/publisher-fixtures.mjs', 'scripts/test-publisher-auth.mjs', 'scripts/native-packaging-env.sh', 'scripts/native-release-auth-lib.sh', 'scripts/verify-native-release.sh', 'scripts/check-secrets.mjs', 'scripts/test-check-secrets.mjs', 'scripts/native-mcp-peer/**', 'Cargo.toml', 'Cargo.lock', '.github/workflows/native.yml', '.github/workflows/release.yml']
permissions:
  contents: read
jobs:
  verify:
    # x86_64 and aarch64 (GitHub's Arm runners) build and qualify natively.
    # The x86_64 leg keeps its historical artifact names (empty suffix).
    name: verify (${{ matrix.arch }})
    strategy:
      fail-fast: false
      matrix:
        include:
          - arch: x86_64
            runner: ubuntu-24.04
            appimage: amd64
            deb: amd64
            suffix: ''
          - arch: aarch64
            runner: ubuntu-24.04-arm
            appimage: aarch64
            deb: arm64
            suffix: '-aarch64'
    runs-on: ${{ matrix.runner }}
    timeout-minutes: 120
    env:
      RUSTUP_TOOLCHAIN: '1.95.0'
      SHADOWCODE_BUILD_JOBS: '4'
      # The Debian package must pass lintian (errors fail; warnings are reported).
      SHADOWCODE_REQUIRE_LINTIAN: '1'
    steps:
      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
        with:
          node-version: '22'
          cache: npm
          cache-dependency-path: ui/package-lock.json
      - name: Native window dependencies
        run: sudo apt-get update && sudo apt-get install -y libwebkit2gtk-4.1-dev libgtk-3-dev librsvg2-dev libayatana-appindicator3-dev libasound2-dev patchelf webkit2gtk-driver xvfb appstream dbus-daemon dbus-bin lintian desktop-file-utils xdg-utils
      - name: Test release staging and immutable retry behavior
        run: node --test scripts/test-native-release.mjs scripts/test-native-release-verification.mjs scripts/test-publisher-auth.mjs scripts/test-native-release-signing.mjs scripts/test-native-test-session.mjs scripts/test-clean-host-mcp-receipt.mjs scripts/test-clean-host-container.mjs scripts/test-native-app-run.mjs scripts/test-llama-build-inputs.mjs scripts/test-native-arch.mjs && node scripts/test-native-process-ownership.mjs
      - name: Verify publisher authentication and private release snapshots
        run: node --test scripts/test-native-release-auth.mjs scripts/test-check-secrets.mjs
      - name: Package version
        run: echo "VERSION=$(node -p "require('./src-tauri/tauri.conf.json').version")" >> "$GITHUB_ENV"
      - name: Managed llama.cpp build dependencies
        run: sudo apt-get install -y cmake ninja-build libssl-dev libvulkan-dev glslc spirv-headers gcc-14 g++-14
      - run: npm --prefix ui ci && npm --prefix ui run build && npm --prefix ui test
      - name: Install pinned Rust toolchain
        run: rustup toolchain install 1.95.0 --profile minimal --component rustfmt --component clippy
      - name: Verify the exact GLib backport and optimized iterator behavior
        run: |
          rustfmt +1.95.0 --check --edition 2021 scripts/fixtures/native-glib-variant.rs
          node --test --test-reporter=tap scripts/test-native-glib-backport.mjs
          node scripts/test-native-glib-variant.mjs
      - run: cargo +1.95.0 fmt --all --check
      - run: cargo +1.95.0 clippy --workspace --all-targets --locked -- -D warnings
      - run: cargo +1.95.0 build -p shadowcode-desktop --locked
      - run: cargo +1.95.0 test --workspace --locked -- --skip worktrees::cleanup::tests::actual_built_project_cleanup_is_bounded_and_completes
      - name: Qualify cleanup over actual built UI dependencies and output
        run: node scripts/native-release-verification.mjs run built-project-cleanup
      - name: Preserve built-project cleanup diagnostics
        if: always()
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        with:
          name: built-project-cleanup-diagnostics${{ matrix.suffix }}
          path: artifacts/built-project-cleanup
      - name: Exercise the native CLI without a display
        run: node scripts/test-native-cli.mjs
      - name: Stress repeated native tasks, cancellation, output and cleanup
        run: node scripts/test-native-stress.mjs
      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        if: always()
        with:
          name: native-stress-diagnostics${{ matrix.suffix }}
          path: artifacts/native-stress
      - name: Exercise the native terminal through a real PTY
        run: node scripts/test-native-tui.mjs
      - name: Exercise the native MCP server without a display
        run: node scripts/test-native-mcp-server.mjs
      - name: Exercise the authenticated native MCP HTTP server
        run: SHADOW_MCP_TRANSPORT=http node scripts/test-native-mcp-server.mjs
      - name: Install independent MCP test clients
        run: npm --prefix scripts/native-mcp-peer ci --ignore-scripts --no-audit --no-fund
      - name: Verify MCP interoperability with official TypeScript clients
        run: node scripts/test-native-mcp-peer.mjs
      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        if: always()
        with:
          name: native-mcp-server-diagnostics${{ matrix.suffix }}
          path: |
            artifacts/native-mcp-server*
            artifacts/native-mcp-peer
      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        if: always()
        with:
          name: native-cli-diagnostics${{ matrix.suffix }}
          path: |
            artifacts/native-cli
            artifacts/native-tui
      - run: cargo +1.95.0 install tauri-driver --version 2.0.6 --locked
      - name: Exercise the native window
        run: node scripts/run-native-x11.mjs node scripts/test-native-desktop.mjs
      - name: Exercise the embedded Markdown worker under the native security policy
        run: node scripts/run-native-x11.mjs node scripts/test-native-markdown.mjs
      - name: Qualify 100 sequential tasks through the native window
        run: node scripts/native-release-verification.mjs run native-endurance
      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        if: always()
        with:
          name: native-window-diagnostics${{ matrix.suffix }}
          path: |
            artifacts/native
            artifacts/native-markdown
            artifacts/native-endurance
            artifacts/native-x11
      - run: cargo +1.95.0 build --release -p shadowcode-core --examples --locked
      - name: Check pinned-source failures and mirror recovery
        run: node --test scripts/test-native-source-fetch.mjs
      - name: Packaging PATH ignores host node hijacks; Debian package checks
        run: node --test scripts/test-native-packaging-env.mjs scripts/test-native-deb.mjs
      - name: Restore the managed llama.cpp build
        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
        with:
          path: |
            tools/llama.cpp
            tools/spirv-headers
            tools/spirv-headers-prefix
          key: llama-cpp-${{ runner.os }}${{ matrix.suffix }}-${{ hashFiles('tools/llama.cpp.pin', 'scripts/build-llama.cpp.sh') }}
      - name: Build the managed llama.cpp runtime (Vulkan + all CPU variants)
        run: bash scripts/build-llama.cpp.sh --no-user-install
      - name: Check the managed runtime packaging steps
        run: node --test scripts/test-llama-runtime.mjs scripts/test-native-desktop-metadata.mjs
      - name: Build native development packages with dependency notices
        run: node scripts/build-native.mjs
      - name: Inspect both packages
        run: node scripts/check-native-package.mjs "target/release/bundle/appimage/ShadowCode_${VERSION}_${{ matrix.appimage }}.AppImage" "target/release/bundle/deb/ShadowCode_${VERSION}_${{ matrix.deb }}.deb"
      - name: Build runtime-only clean-host qualification image
        run: docker build --build-arg TARGETARCH="$(dpkg --print-architecture)" -f scripts/clean-host-runtime.Dockerfile -t shadowcode-clean-runtime:ci scripts
      - name: Install and first-launch both packages in an offline clean host
        run: node scripts/test-clean-host-packages.mjs "target/release/bundle/appimage/ShadowCode_${VERSION}_${{ matrix.appimage }}.AppImage" "target/release/bundle/deb/ShadowCode_${VERSION}_${{ matrix.deb }}.deb" artifacts/native-package/SHA256SUMS
      - name: Reject AppImage extraction writes that fail
        run: node scripts/test-native-runtime-write-errors.mjs
      - name: Rebuild the shipped runtime sources without network access
        run: node scripts/test-native-runtime-sources.mjs
      - name: Exercise concurrent AppImage extraction and shutdown
        run: node scripts/test-native-runtime.mjs
      - name: Verify installer runtime swap and checksum refusal
        run: |
          node --test --test-reporter=tap scripts/test-install-auth.mjs
          bash scripts/test-install-appimage.sh
      - name: Exercise the packaged CLI without a display
        env:
          SHADOW_DESKTOP_BINARY: ${{ github.workspace }}/target/release/bundle/appimage/ShadowCode_${{ env.VERSION }}_${{ matrix.appimage }}.AppImage
          SHADOW_CLI_ARGS: '["--appimage-extract-and-run"]'
          SHADOW_CLI_ARTIFACTS: artifacts/native-package/cli
        run: node scripts/test-native-cli.mjs
      - name: Exercise the packaged native terminal
        env:
          SHADOW_DESKTOP_BINARY: ${{ github.workspace }}/target/release/bundle/appimage/ShadowCode_${{ env.VERSION }}_${{ matrix.appimage }}.AppImage
          SHADOW_CLI_ARGS: '["--appimage-extract-and-run"]'
          SHADOW_TUI_ARTIFACTS: artifacts/native-package/tui
        run: node scripts/test-native-tui.mjs
      - name: Exercise the packaged native window
        env:
          SHADOW_DESKTOP_BINARY: ${{ github.workspace }}/target/release/bundle/appimage/ShadowCode_${{ env.VERSION }}_${{ matrix.appimage }}.AppImage
          SHADOW_DESKTOP_ARGS: '["--appimage-extract-and-run","ui"]'
          SHADOW_NATIVE_DEFAULT_PROFILE: '1'
          SHADOW_NATIVE_ARTIFACTS: artifacts/native-package/window
        run: node scripts/run-native-x11.mjs node scripts/test-native-desktop.mjs
      - name: Exercise the packaged Markdown worker under its native security policy
        env:
          SHADOW_DESKTOP_BINARY: ${{ github.workspace }}/target/release/bundle/appimage/ShadowCode_${{ env.VERSION }}_${{ matrix.appimage }}.AppImage
          SHADOW_DESKTOP_ARGS: '["--appimage-extract-and-run"]'
          SHADOW_NATIVE_ARTIFACTS: artifacts/native-package/markdown
        run: node scripts/run-native-x11.mjs node scripts/test-native-markdown.mjs
      - name: Exercise the packaged native MCP server
        env:
          SHADOW_DESKTOP_BINARY: ${{ github.workspace }}/target/release/bundle/appimage/ShadowCode_${{ env.VERSION }}_${{ matrix.appimage }}.AppImage
          SHADOW_CLI_ARGS: '["--appimage-extract-and-run"]'
          SHADOW_MCP_ARTIFACTS: artifacts/native-package/mcp-server
        run: node scripts/test-native-mcp-server.mjs
      - name: Exercise the packaged native MCP HTTP server
        env:
          SHADOW_DESKTOP_BINARY: ${{ github.workspace }}/target/release/bundle/appimage/ShadowCode_${{ env.VERSION }}_${{ matrix.appimage }}.AppImage
          SHADOW_CLI_ARGS: '["--appimage-extract-and-run"]'
          SHADOW_MCP_ARTIFACTS: artifacts/native-package/mcp-server-http
          SHADOW_MCP_TRANSPORT: http
        run: node scripts/test-native-mcp-server.mjs
      - name: Verify packaged MCP interoperability with official TypeScript clients
        env:
          SHADOW_DESKTOP_BINARY: ${{ github.workspace }}/target/release/bundle/appimage/ShadowCode_${{ env.VERSION }}_${{ matrix.appimage }}.AppImage
          SHADOW_CLI_ARGS: '["--appimage-extract-and-run"]'
          SHADOW_MCP_PEER_ARTIFACTS: artifacts/native-package/mcp-peer
        run: node scripts/test-native-mcp-peer.mjs
      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        if: always()
        with:
          name: native-package-diagnostics${{ matrix.suffix }}
          path: |
            artifacts/native-package
            artifacts/native-x11
      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        with:
          name: native-linux-development${{ matrix.suffix }}
          retention-days: 14
          path: |
            target/release/bundle/appimage/*.AppImage
            target/release/bundle/appimage/*runtime-sources.tar.gz
            target/release/bundle/deb/*.deb
            artifacts/native-package/SHA256SUMS