PaperClipAI/.github/workflows/ci-incremental-qualification.yml

name: Incremental CI qualification

on:
  pull_request:
    paths:
      - package.json
      - turbo.json
      - .github/ci-task-matrix.json
      - .github/scripts/ci-plan.mjs
      - .github/scripts/ci-diff.mjs
      - .github/scripts/ci-inputs.mjs
      - .github/scripts/tests/ci-plan.test.mjs
      - .github/actions/run-ci-task/**
      - .github/workflows/ci-routing.yml
      - .github/workflows/pr-trusted.yml
      - .github/workflows/ci-incremental-qualification.yml
      - scripts/ci/**

permissions:
  contents: read

concurrency:
  group: incremental-ci-proof-${{ github.event.pull_request.number }}
  cancel-in-progress: true

jobs:
  qualify_test_selection:
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        with:
          persist-credentials: false
      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
        with:
          node-version: 24
          package-manager-cache: false
      - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86
        with:
          version: 9.15.4
      - uses: ./.github/actions/setup-ci-dependencies
      - name: Prove conservative graphs, exact partitions, manifests and failure fallbacks
        run: node --test scripts/ci/test-selection*.test.mjs scripts/ci/vitest-impact-report.integration.test.mjs
      - name: Qualify selection against the real Paperclip workspace
        env:
          NODE_ENV: test
          VITEST: 'true'
        run: |
          node --input-type=module <<'NODE'
          import assert from 'node:assert/strict';
          import { readFileSync } from 'node:fs';
          import { execFileSync } from 'node:child_process';
          import { planTasks } from './.github/scripts/ci-plan.mjs';
          import { createTestSelection } from './scripts/ci/select-tests.mjs';
          const config = JSON.parse(readFileSync('turbo.json', 'utf8'));
          const lanes = JSON.parse(readFileSync('.github/ci-task-matrix.json', 'utf8'));
          const head = execFileSync('git', ['rev-parse', 'HEAD'], { encoding: 'utf8' }).trim();
          for (const [file, project, related] of [
            ['ui/src/pages/Inbox.tsx', '@paperclipai/ui', 'ui/src/pages/Inbox.test.tsx'],
            ['server/src/middleware/auth.ts', '@paperclipai/server', 'server/src/__tests__/agent-auth-middleware.test.ts'],
            ['server/src/storage/config.test.ts', '@paperclipai/server', 'server/src/storage/config.test.ts'],
          ]) {
            const selected = await createTestSelection(planTasks({ config, lanes, paths: [file, "doc/DEVELOPING.md", "doc/plans/2026-10-30-ci-proof.md"] }), head);
            const graph = selected.graphs.find(graph => graph.project === project);
            assert.ok(graph.related.includes(related));
            assert.ok(graph.alwaysRun.length > 0, 'Filesystem contracts must remain covered');
            assert.ok(graph.selected.length < graph.inventory.length, 'The real workspace must support narrowing');
            console.log(file, JSON.stringify(selected.plan.testSelection.stats, null, 2));
          }
          NODE

  qualify:
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        with:
          persist-credentials: false
          fetch-depth: 0
      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
        with:
          node-version: 24
          package-manager-cache: false
      - name: Install isolated qualification tools
        run: npm install --prefix "$RUNNER_TEMP/ci-tools" --no-audit --no-fund turbo@2.11.10 pnpm@9.15.4
      - name: Prove planning and required checks
        run: node --test .github/scripts/tests/ci-plan.test.mjs .github/scripts/tests/ci-routing.test.mjs
      - name: Prove real cache reuse and invalidation
        env:
          PAPERCLIP_CI_TEST_TURBO: ${{ runner.temp }}/ci-tools/node_modules/.bin/turbo
        run: PATH="$RUNNER_TEMP/ci-tools/node_modules/.bin:$PATH" node --test scripts/ci/cache.integration.test.mjs
      - name: Check the real repository task graph
        env:
          CI_TURBO_BIN: ${{ runner.temp }}/ci-tools/node_modules/.bin/turbo
        run: |
          node --input-type=module <<'NODE'
          import { readFileSync, writeFileSync } from 'node:fs';
          import { execFileSync } from 'node:child_process';
          import assert from 'node:assert/strict';
          import { executionPlan } from './scripts/ci/execution-plan.mjs';
          const config = JSON.parse(readFileSync('turbo.json', 'utf8'));
          for (const task of ['ci:server', 'ci:db', 'ci:runner-rust']) {
            const plan = executionPlan(config, task, []);
            const file = process.env.RUNNER_TEMP + '/ci-task-config.json';
            writeFileSync(file, JSON.stringify(plan.config));
            const result = execFileSync(process.env.CI_TURBO_BIN, ['run', plan.target, '--root-turbo-json', file,
              '--dry=json', '--cache-dir=.turbo/cache', '--', ...plan.args], { encoding: 'utf8', maxBuffer: 16 * 1024 * 1024 });
            assert.ok(JSON.parse(result).tasks.some((task) => task.taskId === plan.target));
          }
          NODE
      - name: Explain this pull request's plan
        env:
          CI_INCREMENTAL_MODE: shadow
          BASE_SHA: ${{ github.event.pull_request.base.sha }}
          MERGE_SHA: ${{ github.sha }}
        run: node .github/scripts/ci-plan.mjs "$BASE_SHA" "$MERGE_SHA"