name: CultMesh portability and performance

on:
  push:
    branches:
      - main
      - "codex/**"
  pull_request:
  workflow_dispatch:

jobs:
  getting-started:
    name: ${{ matrix.os }} one-command multiplayer onboarding
    runs-on: ${{ matrix.os }}
    timeout-minutes: 30
    strategy:
      fail-fast: false
      matrix:
        os: [windows-latest, ubuntu-latest]

    steps:
      - name: Check out CultLib
        uses: actions/checkout@v4
        with:
          path: CultLib

      - name: Check out the matching Eve contract
        uses: actions/checkout@v4
        with:
          repository: GameCult/Eve
          # Eve main is the contract this sample is written against; the codex
          # branch this used to pin was never merged and stopped on 2026-08-25.
          ref: ${{ vars.EVE_INTEGRATION_REF || 'main' }}
          path: Eve

      - name: Set up .NET
        uses: actions/setup-dotnet@v4
        with:
          dotnet-version: 10.0.x

      - name: Set up Node.js
        uses: actions/setup-node@v4
        with:
          node-version: 24

      - name: Run the documented one-command checkpoint
        shell: pwsh
        run: ./CultLib/scripts/verify-eve-getting-started.ps1 -EveRoot ./Eve

  reactive-and-resource-lifetime:
    name: ${{ matrix.os }} reactive semantics and leases
    runs-on: ${{ matrix.os }}
    timeout-minutes: 30
    strategy:
      fail-fast: false
      matrix:
        os: [windows-latest, ubuntu-latest]

    steps:
      - name: Check out CultLib
        uses: actions/checkout@v4

      - name: Set up .NET
        uses: actions/setup-dotnet@v4
        with:
          dotnet-version: 10.0.x

      - name: Set up Node.js
        uses: actions/setup-node@v4
        with:
          node-version: 24
          cache: npm

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: "3.12"

      - name: Install TypeScript workspace dependencies
        run: npm install --no-package-lock

      - name: Install Python CultLib packages
        run: python -m pip install -e packages/cultcache-py -e packages/cultnet-py -e packages/cultmesh-py

      - name: Verify explicit reactive scheduling across runtimes
        shell: pwsh
        run: ./scripts/verify-reactive-document-scaling.ps1

      - name: Measure representative reactive workload
        shell: pwsh
        run: ./scripts/measure-reactive-document-performance.ps1 -Quick -SkipRuntimeBuild

      - name: Churn 100,000 distinct document leases
        run: >-
          dotnet test tests/GameCult.Mesh.Tests/GameCult.Mesh.Tests.csproj
          --filter FullyQualifiedName~Document_OneHundredThousandDistinctLeaseCyclesLeaveNoResourcesOrCallbacks
          --logger "console;verbosity=minimal"

      # The TypeScript side of the CultMesh authority rules. This job is the
      # only one that runs on both Windows and Linux for main, codex/** and
      # pull requests: cultnet-interop.yml is windows-latest and main-only, so
      # until these steps existed the shared verifier's tests never ran on
      # Linux at all, and the browser client's never ran in CI on any OS.
      # packages/cultnet-ts verifies both vector files (content.test.ts judges both
      # C# content files, the Rust one and its own); cultmesh-browser proves
      # the browser client reads the shared rules rather than its own, and that its content reader releases only verified
      # bytes, requesting the same URLs as the C# HTTPS connector.
      # No workflow ran cultcache-ts's tests, and its test script listed two files by hand while a third sat compiled
      # and unrun. The wiring check fails when any TypeScript test file is run by no script, and the cache's own suite
      # runs here beside the packages built on it.
      - name: Check that every TypeScript test file is run by its package
        run: node scripts/check-typescript-tests-wired.mjs

      - name: Verify the CultCache document owner with the TypeScript cache
        run: npm run test --workspace packages/cultcache-ts

      # Packs the four TypeScript packages and installs them into a clean consumer, so a package that builds but does
      # not install or load fails here.
      - name: Verify the packed TypeScript packages install and load from a clean consumer
        run: npm run test:pack:ts

      - name: Verify the CultMesh authority rules with the TypeScript verifier
        run: npm run test --workspace packages/cultnet-ts

      # cultmesh-browser's test compiles test/interop, which imports cultmesh-ts/content, so cultmesh-ts builds first,
      # as in scripts/run-typescript-workspaces.mjs.
      # The realtime frame codec and the HTTP content chunk provider (content.test.ts,
      # its answers over node:http). The codec's byte parity rests on two vector files,
      # contracts/cultmesh/realtime-frame-vectors.json written by the C#
      # reference and decoded by this step, and realtime-frame-vectors.ts-written.json
      # written by this codec and decoded by the C# step below. Neither half ran
      # in CI on any OS until these two steps existed, so a codec that agreed
      # only with itself would have gone green.
      - name: Verify the realtime frame codec and the content provider with the TypeScript runtime
        run: npm run test --workspace packages/cultmesh-ts

      - name: Verify the browser client against the shared TypeScript verifier
        run: npm run test --workspace packages/cultmesh-browser

      # Both directions of the CultMesh authority vectors: the C#-written
      # file (contracts/cultmesh/authority-route-vectors.json) and the
      # TypeScript-signed file (authority-route-vectors.ts-signed.json) are
      # verified by the C# reference here; the TypeScript side verifies both
      # in the step above. CULTMESH_WRITE_VECTORS is never set in CI: the
      # committed files are the contract.
      - name: Verify the CultMesh authority vectors with the C# reference
        run: >-
          dotnet test tests/GameCult.Mesh.Tests/GameCult.Mesh.Tests.csproj
          --filter FullyQualifiedName~AuthorityProof
          --logger "console;verbosity=minimal"

      # The other half of the frame parity: the C# reference decodes and
      # re-encodes the vector file the TypeScript codec wrote. A fixture
      # authored on one side alone would only agree with itself.
      - name: Verify the realtime frame vectors with the C# reference
        run: >-
          dotnet test tests/GameCult.Mesh.Tests/GameCult.Mesh.Tests.csproj
          --filter FullyQualifiedName~RealtimeWireProtocol
          --logger "console;verbosity=minimal"

      # The content plane: the reference writes the manifest and record-key
      # vectors and judges the manifests the TypeScript packer wrote
      # (content-vectors.ts-written.json). This suite also holds the C#/Rust
      # content parity, which no CI step ran before this one. CULTNET_WRITE_VECTORS
      # is never set in CI: the committed files are the contract.
      - name: Verify the content vectors with the C# reference
        run: >-
          dotnet test tests/GameCult.Mesh.Tests/GameCult.Mesh.Tests.csproj
          --filter FullyQualifiedName~CultMeshContentVectorTests
          --logger "console;verbosity=minimal"

      # The cross-process HTTPS content parity: the C# transfer service over the unmodified HTTPS connector and the
      # TypeScript reader fetch from the TypeScript provider in its own process. Both refuse bytes tampered in flight,
      # and the provider refuses a corrupt store.
      - name: Verify HTTPS content parity across C#, the TypeScript provider and the TypeScript reader
        run: npm run test:interop --workspace packages/cultmesh-browser