weavatrix-refactor 1.0.13

name: CI

on:
  push:
  pull_request:

permissions:
  contents: read

env:
  CARGO_TERM_COLOR: always

jobs:
  quality:
    runs-on: ubuntu-24.04
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
        with:
          persist-credentials: false
      - uses: dtolnay/rust-toolchain@2c7215f132e9ebf062739d9130488b56d53c060c # 2026-07-29
        with:
          toolchain: 1.89.0
          components: rustfmt, clippy
      - name: Check formatting
        run: cargo fmt --all -- --check
      - name: Run strict Clippy
        run: cargo clippy --locked --all-targets -- -D warnings
      - name: Verify the product architecture with its own engine
        run: cargo test --locked the_product_architecture_passes_its_internal_engine
      # server.json is what an MCP registry reads. It named the 0.1.x npm package long after this
      # became a Rust host, so the two are now checked against each other.
      - name: Verify the crate and the MCP manifest agree on the version
        shell: bash
        run: |

          cargo metadata --locked --no-deps --format-version 1 |
            node -e "let s='';process.stdin.on('data',d=>s+=d).on('end',()=>{const m=JSON.parse(s);const p=m.packages.find(x=>x.name==='weavatrix-refactor');const r=require('./server.json');const pkg=(r.packages||[])[0]||{};if(!p||p.version!==r.version||pkg.version!==r.version){console.error({cargo:p&&p.version,server:r.version,package:pkg.version});process.exit(1)}})"

  test:
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-24.04, windows-2025, macos-15]
    runs-on: ${{ matrix.os }}
    timeout-minutes: 45
    steps:
      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
        with:
          persist-credentials: false
      - uses: dtolnay/rust-toolchain@2c7215f132e9ebf062739d9130488b56d53c060c # 2026-07-29
        with:
          toolchain: 1.89.0
      - run: cargo test --locked --all-targets
      - run: cargo run --quiet --locked -- --version

  package:
    runs-on: ubuntu-24.04
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
        with:
          persist-credentials: false
      - uses: dtolnay/rust-toolchain@2c7215f132e9ebf062739d9130488b56d53c060c # 2026-07-29
        with:
          toolchain: 1.89.0
      - name: Verify the package manifest carries the promised files
        shell: bash
        run: |

          set -euo pipefail
          listing="$(cargo package --list)"
          for required in README.md LICENSE server.json contract/refactor-tools.v1.json; do
            grep -qxF "$required" <<<"$listing" \
              || { echo "$required is missing from the package" >&2; echo "$listing" >&2; exit 1; }
          done
      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
        with:
          node-version: 24
          package-manager-cache: false
      # The npm package is a second artifact from the same source, so it is checked here rather
      # than only at release time - a broken launcher would otherwise surface on a tag.
      - name: Assemble the npm package around the release binary
        shell: bash
        run: |

          set -euo pipefail
          cargo build --release --locked
          node scripts/build-npm-packages.mjs current linux-x64 target/release/weavatrix-refactor
          npm pack ./npm/dist/weavatrix-refactor --dry-run --json |
            node scripts/npm-pack-json.mjs require-files README.md LICENSE server.json bin/weavatrix-refactor.mjs bin/weavatrix-refactor-mcp.mjs
          node --test scripts/npm-pack-json.test.mjs scripts/plugin-manifests.test.mjs
      - name: Reject lifecycle scripts and runtime dependencies
        shell: bash
        run: |

          node -e "const p=require('./npm/dist/weavatrix-refactor/package.json');if(p.scripts||p.dependencies||p.optionalDependencies)process.exit(1)"
          ! find npm/dist/weavatrix-refactor -type f -path '*node_modules*' -print -quit | grep .
      - name: Verify the assembled launcher starts the native binary
        shell: bash
        run: |

          set -euo pipefail
          VERSION="$(node -p "require('./npm/weavatrix-refactor/package.json').version")"
          ENGINE="$(node -p "require('./npm/weavatrix-refactor/package.json').weavatrixEngineVersion")"
          REFACTOR="$(node -p "require('./npm/weavatrix-refactor/package.json').weavatrixRefactorVersion")"
          CONTRACT="$(node -p "require('./contract/refactor-tools.v1.json').contractVersion")"
          ACTUAL="$(node npm/dist/weavatrix-refactor/bin/weavatrix-refactor.mjs --version)"
          EXPECTED="weavatrix-refactor $VERSION (engine $ENGINE, refactor $REFACTOR, contract v$CONTRACT)"
          [[ "$ACTUAL" == "$EXPECTED" ]] || { echo "got: $ACTUAL"; echo "want: $EXPECTED"; exit 1; }

  security:
    runs-on: ubuntu-24.04
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
        with:
          persist-credentials: false
      - uses: taiki-e/install-action@18b1216eba7f8039b0f8d131d5473787f0edce68 # v2
        with:
          tool: cargo-audit
      - run: cargo audit --deny warnings