ci.yml

name: CI

on:
  push:
    branches: [main]
  pull_request:

jobs:
  test:
    name: Typecheck, test, build (${{ matrix.os }})
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, macos-latest, windows-latest]
    runs-on: ${{ matrix.os }}
    steps:
      - uses: actions/checkout@v7
      - uses: pnpm/action-setup@v6
      - uses: actions/setup-node@v7
        with:
          node-version-file: .nvmrc
          cache: pnpm
      - run: pnpm install --frozen-lockfile
      - run: pnpm typecheck
      - run: pnpm test
      - run: pnpm build
      - name: Windows start-up scripts parse, install and uninstall
        if: runner.os == 'Windows'
        shell: pwsh
        run: |
          foreach ($f in Get-ChildItem deploy/windows/*.ps1) {
            $errors = $null
            [System.Management.Automation.Language.Parser]::ParseFile($f.FullName, [ref]$null, [ref]$errors) | Out-Null
            if ($errors) { $errors; exit 1 }
          }
          # 改名前装的任务：重装时要被清掉，否则两个网关抢同一个端口
          Register-ScheduledTask -TaskName 'OpenGrokBot gateway' -Action (New-ScheduledTaskAction -Execute 'cmd.exe' -Argument '/c exit 0') -Force | Out-Null
          powershell -NoProfile -ExecutionPolicy Bypass -File deploy/windows/install-task.ps1
          if (Get-ScheduledTask -TaskName 'OpenGrokBot gateway' -ErrorAction SilentlyContinue) { 'old task left behind'; exit 1 }
          $task = Get-ScheduledTask -TaskName 'OpenSuperBot gateway'
          if ($task.Actions[0].Arguments -notmatch 'start-gateway\.ps1') { "unexpected action: $($task.Actions[0].Arguments)"; exit 1 }
          if ($task.Principal.LogonType -ne 'Interactive') { "unexpected logon type: $($task.Principal.LogonType)"; exit 1 }
          powershell -NoProfile -ExecutionPolicy Bypass -File deploy/windows/install-task.ps1 -Uninstall
          if (Get-ScheduledTask -TaskName 'OpenSuperBot gateway' -ErrorAction SilentlyContinue) { 'task still registered'; exit 1 }

  local-computer:
    # 本机模式（不用 Docker）对着真浏览器、真沙箱走一遍：文件、浏览器、截屏流、登录窗口、命令行开关与沙箱边界。
    # 每台 runner 上都装好了 Chrome，所以也顺带验了各平台找系统浏览器的路径。
    name: Local computer smoke (${{ matrix.os }})
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, macos-latest, windows-latest]
    runs-on: ${{ matrix.os }}
    steps:
      - uses: actions/checkout@v7
      - uses: pnpm/action-setup@v6
      - uses: actions/setup-node@v7
        with:
          node-version-file: .nvmrc
          cache: pnpm
      - run: pnpm install --frozen-lockfile
      - name: bubblewrap and a virtual display (Linux)
        if: runner.os == 'Linux'
        run: |
          sudo apt-get update
          sudo apt-get install -y bubblewrap xvfb
          # Ubuntu 23.10+ 默认不许普通程序建用户命名空间：装上文档里给用户的那份 AppArmor 配置
          if [ "$(cat /proc/sys/kernel/apparmor_restrict_unprivileged_userns 2>/dev/null)" = "1" ]; then
            sudo cp deploy/linux/bwrap.apparmor /etc/apparmor.d/bwrap
            sudo apparmor_parser -r /etc/apparmor.d/bwrap
          fi
      - name: Smoke (Linux, on a virtual display)
        if: runner.os == 'Linux'
        run: xvfb-run -a pnpm --filter @opensuperbot/gateway run smoke:local
      - name: Smoke
        if: runner.os != 'Linux'
        run: pnpm --filter @opensuperbot/gateway run smoke:local

  audit:
    name: Dependency audit
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - uses: pnpm/action-setup@v6
      - uses: actions/setup-node@v7
        with:
          node-version-file: .nvmrc
      # 只看锁文件，不装依赖。高危及以上才算失败；中低危交给 Dependabot 的周更 PR。
      - run: pnpm audit --audit-level high

  bot-image:
    name: Bot computer image
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - run: docker build -t opensuperbot/bot:dev docker/bot
      - name: Fonts, timezone data and supervisor are in the image
        run: |
          docker run --rm --entrypoint sh opensuperbot/bot:dev -c \
            'fc-list | grep -qi wqy && fc-list | grep -qi "noto color emoji" && test -d /usr/share/zoneinfo && bash -n /opt/entrypoint.sh && node --check /opt/shim.mjs'