open-standards/.github/workflows/wai-app.yml

name: wai-app and Create

# WAI's widgets for joule-ui and Create (wai/wai-app), and the line language they take a
# program in (joule-ui SPEC §11):
#
#   unit   wai-app's tests (its registry, its rules, the guide, the export's files, the
#          runtime read by its listing, the bridge), clippy with warnings as errors, its
#          WebAssembly surface checked for wasm32; the line language's independent verifier
#          over the conformance pack, and its mutations refused; the page modules' unit tests
#          (the renderer, the model streams). `wai create --from app.oui`, `wai app check` and
#          `wai mcp --toolset app` are wai-rs's tests/cli_app.rs, in wai-conformance;
#   e2e    Create in the host's browser (wai/wai-app/e2e/run.sh), served by `wai dev --show`:
#          a recorded stream renders as it arrives, the room joins a real room service, a chat
#          and a poll go through it, the page's sealed log verifies, Export hands over app.oui,
#          `wai create --from app.oui` makes the project and `wai app check` passes on it and
#          refuses it broken, `wai dev` runs the project's own room where a host and a viewer
#          answer a poll the room's clock signs, the refused lines never render, the visitor's
#          own model is called with their key alone, and `wai mcp --toolset app` streams into
#          the page through its bridge.
#
# The line language's own tests and its pack test run in standards-build (joule-ui-rs).
#
# Push filters match the push's delta, so every path the jobs read is listed.

concurrency:
  group: ${{ github.workflow }}-${{ github.event_name == 'push' && github.sha || github.ref }}
  cancel-in-progress: true

on:
  push:
    branches: [main]
    paths:
      - 'wai/wai-app/**'
      - 'joule-ui/**'
      - 'wai/wai-live-web/**'
      - 'wai/wai-rs/**'
      - 'joule-code/joule-code-rs/crates/joule-moq-web/**'
      - 'joule-code/joule-code-rs/crates/joule-moq/**'
      - 'joule-code/joule-code-rs/crates/joule-moq-relay/**'
      - 'joule-code/joule-code-rs/crates/joule-moq-room/**'
      - 'joule-code/joule-code-rs/crates/jwp/**'
      - 'joule-code/joule-code-rs/Cargo.toml'
      - 'joule-code/joule-code-rs/Cargo.lock'
      - 'wai/quickstart/build-web.sh'
      - 'rust-toolchain.toml'
      - '.github/workflows/wai-app.yml'
  pull_request:
    paths:
      - 'wai/wai-app/**'
      - 'joule-ui/**'
      - 'wai/wai-live-web/**'
      - 'wai/wai-rs/**'
      - 'joule-code/joule-code-rs/crates/joule-moq-web/**'
      - 'joule-code/joule-code-rs/crates/joule-moq/**'
      - 'joule-code/joule-code-rs/crates/joule-moq-relay/**'
      - 'joule-code/joule-code-rs/crates/joule-moq-room/**'
      - 'joule-code/joule-code-rs/crates/jwp/**'
      - 'joule-code/joule-code-rs/Cargo.toml'
      - 'joule-code/joule-code-rs/Cargo.lock'
      - 'wai/quickstart/build-web.sh'
      - 'rust-toolchain.toml'
      - '.github/workflows/wai-app.yml'

jobs:
  # Forgejo matches `paths:` against the push delta, so a rebase fires this workflow
  # whatever the pull request changes. This job reads the pull request's own diff against
  # the paths above (scripts/pr-touches-paths.py, which fails open).
  relevant:
    name: wai-app · does this change touch it
    runs-on: gate
    outputs:
      run: ${{ steps.gate.outputs.run }}
    steps:
      - uses: actions/checkout@v5
        with:
          fetch-depth: 0
      - id: gate
        run: |
          set -euo pipefail
          r=$(python3 scripts/pr-touches-paths.py .github/workflows/wai-app.yml \
                "${{ github.event.pull_request.base.sha }}" \
                "${{ github.event.pull_request.head.sha }}")
          echo "this change touches wai-app: $r"
          echo "run=$r" >> "$GITHUB_OUTPUT"

  # Nothing here needs macOS: it runs on the linux runner, leaving the macOS host to the
  # browser job.
  unit:
    name: wai-app · tests, clippy, the line language's verifier (linux)
    needs: relevant
    if: needs.relevant.outputs.run == 'true'
    runs-on: linux
    timeout-minutes: 60
    steps:
      - uses: actions/checkout@v5
      - name: Install Rust 1.99.1
        shell: bash
        run: |
          export PATH="$HOME/.cargo/bin:$PATH"
          command -v rustup >/dev/null 2>&1 || \
            curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --profile minimal --default-toolchain 1.99.1
          rustup toolchain install 1.99.1 --profile minimal --component clippy
          rustup default 1.99.1
          echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"
      - name: Tests and clippy
        shell: bash
        working-directory: wai/wai-app
        run: |
          set -euo pipefail
          rustup target add wasm32-unknown-unknown
          nice -n 10 cargo test --locked 2>&1 | tee "$RUNNER_TEMP/test.log"
          grep -qE '^test result: ok\. [1-9][0-9]* passed; 0 failed' "$RUNNER_TEMP/test.log" || { echo "::error::no test ran"; exit 1; }
          nice -n 10 cargo clippy --locked --all-targets -- -D warnings
          nice -n 10 cargo clippy --locked --lib --target wasm32-unknown-unknown --no-default-features --features web -- -D warnings
      - name: The line language's independent verifier, and its mutations
        shell: bash
        run: |
          set -euo pipefail
          python3 -I joule-ui/conformance/lang_verify.py
          python3 -I joule-ui/conformance/lang_verify.py --mutations
      - name: The page modules
        shell: bash
        run: node --test wai/wai-app/web/web.test.mjs

  e2e:
    name: wai-app · Create, browser end-to-end (macos)
    needs: relevant
    if: needs.relevant.outputs.run == 'true'
    runs-on: macos
    timeout-minutes: 90
    steps:
      - uses: actions/checkout@v5
      # launchd's PATH omits cargo on the macOS host runner.
      - name: Put cargo on PATH
        shell: bash
        run: echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"
      # Pinned to the wasm-bindgen the crates pin: the CLI and the crate must match.
      - name: wasm32 target and wasm-bindgen CLI 0.2.127
        shell: bash
        run: |
          set -euo pipefail
          rustup target add wasm32-unknown-unknown
          cargo install --locked wasm-bindgen-cli --version 0.2.127
      - name: Create in the browser
        shell: bash
        env:
          BROWSER_BIN: /Applications/Google Chrome.app/Contents/MacOS/Google Chrome  # allow-name: the macOS runner's browser executable, a file path
          CREATE_E2E_OUT: ${{ runner.temp }}/wai-create
        run: |
          set -euo pipefail
          test -x "$BROWSER_BIN" || { echo "::error::this runner has no browser at $BROWSER_BIN"; exit 1; }
          mg=/Volumes/macos_4TB_external_1/wai-build/bin/memguard
          if [ -x "$mg" ]; then export MEMGUARD="$mg"; fi
          nice -n 10 bash wai/wai-app/e2e/run.sh 2>&1 | tee "$RUNNER_TEMP/create-e2e.log"
          grep -qE '^create e2e: [1-9][0-9]* passed, 0 failed$' "$RUNNER_TEMP/create-e2e.log" \
            || { echo "::error::the Create end-to-end run did not pass"; exit 1; }