ci.yml

name: Continuous Integration

on:
  push:
    branches:
      - main
  pull_request:
    branches:
      - main
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: ci-${{ github.event_name == 'workflow_dispatch' && github.run_id || github.event.pull_request.number || github.ref }}
  cancel-in-progress: true

jobs:
  policy:
    name: Repository policy
    runs-on: ubuntu-latest
    steps:
      - name: Check out repository
        uses: actions/checkout@v6
        with:
          fetch-depth: 0

      - name: Validate repository policy
        shell: bash
        env:
          BASE_SHA: ${{ github.event.pull_request.base.sha || github.event.before }}
          HEAD_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
        run: |
          if [ -z "${BASE_SHA}" ]; then
            git fetch origin main
            BASE_SHA="$(git merge-base origin/main "${HEAD_SHA}")"
          elif ! git cat-file -e "${BASE_SHA}^{commit}" 2>/dev/null; then
            BASE_SHA="$(git rev-list --max-parents=0 "${HEAD_SHA}")"
          fi
          git diff --check "${BASE_SHA}" "${HEAD_SHA}"
          python -m unittest discover -s .github/scripts -p 'test_*.py'
          python .github/scripts/validate_agent_skills.py
          python .github/scripts/check_integration_policy.py \
            --event-name "${{ github.event_name }}" \
            --base-ref "${{ github.base_ref }}" \
            --head-ref "${{ github.head_ref }}" \
            --head-repository \
              "${{ github.event.pull_request.head.repo.full_name || github.repository }}" \
            --repository "${{ github.repository }}" \
            --base-sha "${BASE_SHA}" \
            --head-sha "${HEAD_SHA}"

  platform-matrix:
    name: MATLAB / ${{ matrix.label }} / ${{ matrix.release }} / ${{ matrix.shard }}
    needs: policy
    if: github.event_name != 'push'
    runs-on: ${{ matrix.os }}
    timeout-minutes: 100
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: ubuntu-22.04
            id: linux
            label: Linux
            release: R2022b
            shard: All profiles
            shard_id: all
            profiles: headless,gui,isolated
            run_headless: true
            run_gui: true
            run_isolated: true
            claim: Supported MATLAB floor on the pinned Linux runner and legacy graphics/export paths
          - os: ubuntu-latest
            id: linux
            label: Linux
            release: latest
            shard: All profiles
            shard_id: all
            profiles: headless,gui,isolated
            run_headless: true
            run_gui: true
            run_isolated: true
            claim: Current MATLAB and Ubuntu integration, including virtual-display graphics
          - os: windows-2022
            id: windows
            label: Windows
            release: R2022b
            shard: All profiles
            shard_id: all
            profiles: headless,gui,isolated
            run_headless: true
            run_gui: true
            run_isolated: true
            claim: Supported MATLAB floor on Windows, including native file and off-screen graphics behavior
          - os: windows-latest
            id: windows
            label: Windows
            release: latest
            shard: Core
            shard_id: core
            profiles: headless,isolated
            run_headless: true
            run_gui: false
            run_isolated: true
            claim: Current MATLAB and Windows product, SDK, export, and path-isolation evidence
          - os: windows-latest
            id: windows
            label: Windows
            release: latest
            shard: Hidden GUI
            shard_id: gui
            profiles: gui
            run_headless: false
            run_gui: true
            run_isolated: false
            claim: Current MATLAB and Windows native App, graphics, and export evidence
          - os: macos-14
            id: macos
            label: macOS
            release: latest
            shard: Core
            shard_id: core
            profiles: headless,isolated
            run_headless: true
            run_gui: false
            run_isolated: true
            claim: Current Apple Silicon product, SDK, export, and path-isolation evidence
          - os: macos-14
            id: macos
            label: macOS
            release: latest
            shard: Hidden GUI
            shard_id: gui
            profiles: gui
            run_headless: false
            run_gui: true
            run_isolated: false
            claim: Current Apple Silicon native App, graphics, and export evidence
    steps:
      - name: Check out repository
        uses: actions/checkout@v6
        with:
          fetch-depth: 2

      - name: Set up clean MATLAB runtime
        uses: matlab-actions/setup-matlab@v3
        with:
          release: ${{ matrix.release }}

      - name: Start Linux virtual display
        if: runner.os == 'Linux'
        shell: bash
        run: |
          Xvfb :99 -screen 0 1920x1080x24 -nolisten tcp \
            > "${RUNNER_TEMP}/xvfb.log" 2>&1 &
          xvfb_pid=$!
          echo "DISPLAY=:99" >> "${GITHUB_ENV}"
          sleep 1
          if ! kill -0 "${xvfb_pid}"; then
            cat "${RUNNER_TEMP}/xvfb.log"
            exit 1
          fi

      - name: Prepare MATLAB artifact directories
        shell: bash
        run: |
          mkdir -p artifacts/logs/headless artifacts/logs/gui artifacts/logs/isolated
          if [ "${RUNNER_OS}" = "Linux" ]; then
            mkdir -p "${HOME}/Documents/MATLAB"
          fi

      - name: Run full non-GUI validation
        if: matrix.run_headless
        id: headless
        continue-on-error: true
        timeout-minutes: 30
        uses: matlab-actions/run-build@v3
        with:
          tasks: headless
          startup-options: -logfile artifacts/logs/headless/matlab.log

      - name: Run hidden GUI validation
        if: matrix.run_gui
        id: gui
        continue-on-error: true
        timeout-minutes: 30
        uses: matlab-actions/run-build@v3
        with:
          tasks: gui
          startup-options: -logfile artifacts/logs/gui/matlab.log

      - name: Run path-isolation validation
        if: matrix.run_isolated
        id: isolated
        continue-on-error: true
        timeout-minutes: 30
        uses: matlab-actions/run-build@v3
        with:
          tasks: isolated
          startup-options: -logfile artifacts/logs/isolated/matlab.log

      - name: Summarize platform validation
        if: always()
        shell: bash
        run: |
          python .github/scripts/summarize_junit.py \
            --platform "${{ matrix.label }}" \
            --release "${{ matrix.release }}" \
            --runner "${{ matrix.os }}" \
            --shard "${{ matrix.shard }}" \
            --profiles "${{ matrix.profiles }}" \
            --claim "${{ matrix.claim }}" \
            --artifact-name "matlab-${{ matrix.id }}-${{ matrix.release }}-${{ matrix.shard_id }}" \
            --headless-outcome "${{ steps.headless.outcome }}" \
            --gui-outcome "${{ steps.gui.outcome }}" \
            --isolated-outcome "${{ steps.isolated.outcome }}"

      - name: Upload platform artifacts
        if: always()
        uses: actions/upload-artifact@v7
        with:
          name: matlab-${{ matrix.id }}-${{ matrix.release }}-${{ matrix.shard_id }}
          if-no-files-found: warn
          retention-days: 14
          path: |
            artifacts/test-results/**
            artifacts/debug/**
            artifacts/gui/**
            artifacts/logs/**

      - name: Require every scheduled validation profile
        if: always()
        shell: bash
        run: |
          if [ '${{ matrix.run_headless }}' = 'true' ]; then
            test '${{ steps.headless.outcome }}' = 'success'
          fi
          if [ '${{ matrix.run_gui }}' = 'true' ]; then
            test '${{ steps.gui.outcome }}' = 'success'
          fi
          if [ '${{ matrix.run_isolated }}' = 'true' ]; then
            test '${{ steps.isolated.outcome }}' = 'success'
          fi

  docs-check:
    name: Documentation check
    needs: policy
    if: github.event_name != 'push'
    runs-on: ubuntu-latest
    timeout-minutes: 20
    steps:
      - name: Check out repository
        uses: actions/checkout@v6

      - name: Set up clean MATLAB runtime
        uses: matlab-actions/setup-matlab@v3
        with:
          release: latest

      - name: Verify generated documentation
        uses: matlab-actions/run-build@v3
        with:
          tasks: docsCheck

  ci-gate:
    name: CI Gate
    if: always()
    needs:
      - policy
      - platform-matrix
      - docs-check
    runs-on: ubuntu-latest
    steps:
      - name: Require all validation profiles
        shell: bash
        run: |
          test '${{ needs.policy.result }}' = 'success'
          if [ '${{ github.event_name }}' != 'push' ]; then
            test '${{ needs.platform-matrix.result }}' = 'success'
            test '${{ needs.docs-check.result }}' = 'success'
          fi