ci.yml

name: CI

on:
  push:
    branches: [main, kuri-browser]
  pull_request:
    branches: [main, kuri-browser]

jobs:
  build-and-test:
    runs-on: ubuntu-latest

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Install Zig 0.16.0
        uses: mlugg/setup-zig@v2
        with:
          version: 0.16.0

      - name: Cache Zig build artifacts
        uses: actions/cache@v4
        with:
          path: |
            .zig-cache
            ~/.cache/zig
          key: zig-${{ runner.os }}-${{ hashFiles('build.zig', 'build.zig.zon') }}
          restore-keys: |
            zig-${{ runner.os }}-

      - name: Build
        run: zig build -Doptimize=ReleaseSafe

      - name: Run tests
        run: zig build test -Doptimize=ReleaseSafe

      - name: Regression — --help / --version do NOT spawn Chrome (issue #156)
        # Old kuri binaries (≤ v0.1.0) silently fell through to the daemon
        # path on `--help`, launching headless Chrome and binding :8080.
        # Fixed in f0ab19b. This step makes sure no future change re-routes
        # `--help` or `--version` through the daemon path again.
        run: |
          set -euo pipefail
          for flag in --help -h --version -V; do
            echo "::group::kuri ${flag}"
            # Run with hard 5 s timeout; help/version must exit fast.
            output=$(timeout 5s ./zig-out/bin/kuri "${flag}" 2>&1) && rc=$? || rc=$?
            echo "${output}"
            echo "exit=${rc}"
            if [ "${rc}" -ne 0 ]; then
              echo "::error::kuri ${flag} returned non-zero (${rc}) — should print and exit 0"
              exit 1
            fi
            # Match the actual log lines emitted by the daemon path
            # (`std.log.info(...)` prefixes them with "info: "), not the
            # help text — which legitimately documents Chrome-related env
            # vars and would otherwise false-positive.
            if echo "${output}" | grep -qE "^info: (launching managed Chrome|listening on|launched Chrome|connecting to existing Chrome)"; then
              echo "::error::kuri ${flag} appears to have entered daemon startup. See issue #156."
              exit 1
            fi
            # Confirm at least one expected line was printed.
            if [ "${flag}" = "--help" ] || [ "${flag}" = "-h" ]; then
              echo "${output}" | grep -q "USAGE" || { echo "::error::kuri ${flag} did not print USAGE"; exit 1; }
            else
              echo "${output}" | grep -q "kuri " || { echo "::error::kuri ${flag} did not print version"; exit 1; }
            fi
            echo "::endgroup::"
          done

  startup-smoke:
    runs-on: ubuntu-latest

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Install Zig 0.16.0
        uses: mlugg/setup-zig@v2
        with:
          version: 0.16.0

      - name: Install Chrome
        uses: browser-actions/setup-chrome@v2
        with:
          install-dependencies: true

      - name: Build
        run: zig build -Doptimize=ReleaseSafe

      - name: Startup smoke test
        run: |
          set -euo pipefail
          ./zig-out/bin/kuri > kuri.log 2>&1 &
          kuri_pid=$!
          cleanup() {
            kill "${kuri_pid}" >/dev/null 2>&1 || true
            wait "${kuri_pid}" >/dev/null 2>&1 || true
            cat kuri.log
          }
          trap cleanup EXIT

          for _ in $(seq 1 30); do
            if curl -sf http://127.0.0.1:8080/health > health.json; then
              break
            fi
            sleep 1
          done

          # /health is intentionally unauthenticated (liveness probe).
          curl -sf http://127.0.0.1:8080/health | tee health.json

          # All other routes now require Authorization: Bearer <token>.
          # Token is auto-generated to ~/.kuri/api.token on first launch.
          # Also assert that /tabs WITHOUT auth is rejected with 401, so a
          # regression that re-opens the credential dump fails this job.
          token=$(./zig-out/bin/kuri token)
          unauth_status=$(curl -s -o /dev/null -w '%{http_code}' http://127.0.0.1:8080/tabs)
          if [ "${unauth_status}" != "401" ]; then
            echo "expected /tabs without auth to return 401, got ${unauth_status}" >&2
            exit 1
          fi
          curl -sf -H "Authorization: Bearer ${token}" http://127.0.0.1:8080/tabs | tee tabs.json

          grep '"ok":true' health.json
          grep '"tabs":1' health.json
          grep '"id":"' tabs.json

  windows-cross-compile:
    # Verifies the Windows port stays buildable (issue #153). A native
    # Windows runtime smoke test is out of scope for this job — Chrome
    # automation, daemonization, and signal handling are all stubbed
    # with `error.UnsupportedOnWindows` on Windows for now. This job
    # exists so a future refactor that re-introduces an ungated POSIX
    # call (`fork`, `std.c.open`, raw `setsockopt`/`read` on a socket)
    # fails CI instead of silently regressing the Windows build.
    runs-on: ubuntu-latest

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Install Zig 0.16.0
        uses: mlugg/setup-zig@v2
        with:
          version: 0.16.0

      - name: Cache Zig build artifacts
        uses: actions/cache@v4
        with:
          path: |
            .zig-cache
            ~/.cache/zig
          key: zig-windows-cross-${{ hashFiles('build.zig', 'build.zig.zon') }}
          restore-keys: |
            zig-windows-cross-

      - name: Cross-compile for x86_64-windows-gnu
        run: zig build -Dtarget=x86_64-windows-gnu -Doptimize=ReleaseSafe

      - name: Verify Windows executables were produced
        run: |
          set -euo pipefail
          for bin in kuri kuri-agent kuri-browse kuri-fetch; do
            path="zig-out/bin/${bin}.exe"
            if [ ! -f "${path}" ]; then
              echo "::error::missing ${path}"
              exit 1
            fi
            file "${path}" | tee -a windows-build.txt
            if ! file "${path}" | grep -q 'PE32+ executable .* for MS Windows'; then
              echo "::error::${path} is not a Windows PE binary"
              exit 1
            fi
          done