desktop-swift-ci.yml

name: Desktop Swift CI

on:
  push:
    branches: main
  pull_request:
    branches: main
  # A later backend/docs commit must not make the last path-selected Desktop
  # Swift verdict look current. Run against default-branch HEAD every day at an
  # off-round UTC minute; the selector treats this as a full health event.
  schedule:
    - cron: "17 5 * * *"
  # Recovery hatch. `plan-desktop-release.py` requires this workflow's checks on the
  # exact source SHA, so any interruption — the workflow being disabled, a run cancelled
  # by concurrency, an infrastructure blip — leaves that SHA permanently unreleasable:
  # push events do not replay, and neither a force-push nor a PR close/reopen produces a
  # run for a commit already on main. Manual dispatch is the only way to re-mint the
  # evidence without an unrelated commit. Manual dispatch is path-independent so
  # it still compiles a HEAD whose final commit only touched another component.
  workflow_dispatch:

concurrency:
  # Supersede stale revisions of the same PR, but never let a later main push
  # cancel the exact-SHA evidence consumed by desktop release planning.
  group: desktop-swift-${{ github.event.pull_request.number || github.sha }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

jobs:
  changes:
    name: Detect Desktop Swift Changes
    runs-on: ubuntu-latest
    outputs:
      diff_base: ${{ steps.changed.outputs.diff_base }}
      should_run: ${{ steps.changed.outputs.should_run }}
      should_run_static: ${{ steps.changed.outputs.should_run_static }}
      should_run_tests: ${{ steps.changed.outputs.should_run_tests }}
      should_release_compile: ${{ steps.changed.outputs.should_release_compile }}
      should_notification_release_regression: ${{ steps.changed.outputs.should_notification_release_regression }}
    steps:
      - name: Checkout code
        uses: actions/checkout@v7
        with:
          fetch-depth: 0

      - name: Detect changed paths
        id: changed
        run: |
          if [ "${{ github.event_name }}" = "pull_request" ]; then
            # Resolve the base live against the checkout (matching detect-changes)
            # rather than the event-payload base.sha, which can be stale for a
            # queued run (FC-stale-event-payload-diff-base, #10785).
            DIFF_BASE="origin/${{ github.base_ref }}"
          else
            DIFF_BASE="${{ github.event.before }}"
          fi
          if [ -z "$DIFF_BASE" ] || [[ "$DIFF_BASE" =~ ^0+$ ]]; then
            DIFF_BASE="$(git rev-parse HEAD^)"
          fi

          FILES=$(scripts/changed-files "$DIFF_BASE"...HEAD)
          echo "$FILES"
          echo "diff_base=$DIFF_BASE" >> "$GITHUB_OUTPUT"

          IMPACT_FILES=$(mktemp)
          printf '%s\n' "$FILES" > "$IMPACT_FILES"
          python3 scripts/pre_push_ci_prediction.py \
            --changed-files "$IMPACT_FILES" \
            --base "$DIFF_BASE" \
            --event "${{ github.event_name }}" \
            --github-output "$GITHUB_OUTPUT"

          # Static macOS work is owned by the deterministic manifest. Querying
          # it exclusively prevents portable checks from moving back onto this
          # scarce runner while preserving their Linux Repo Checks route.
          python3 .github/scripts/run_checks.py \
            --lane ci \
            --platform macos \
            --exclusive-platform \
            --base "$DIFF_BASE" \
            --skip-pr-body-checks \
            --changed-files "$IMPACT_FILES" \
            --output json > /tmp/macos-manifest-selection.json
          SHOULD_RUN_STATIC=$(python3 - <<'PY'
          import json
          import sys
          from pathlib import Path

          selection = json.loads(Path("/tmp/macos-manifest-selection.json").read_text())
          for check in selection["checks"]:
              print(
                  f"macOS manifest selection: {check['id']} via {', '.join(check['matched_paths'])}: {check['reason']}",
                  file=sys.stderr,
              )
          print(str(bool(selection["checks"])).lower())
          PY
          )
          echo "should_run_static=$SHOULD_RUN_STATIC" >> "$GITHUB_OUTPUT"

  # Hosted macOS capacity is deliberately scarce. Run static contracts and the
  # optional full suite as steps in one selected job, rather than claiming two
  # runners in parallel. The stable Ubuntu aggregate below remains the exact
  # release-gate check name.
  desktop-swift-verify:
    name: Desktop Swift Static & Test Contracts
    needs: changes
    if: ${{ needs.changes.outputs.should_run_static == 'true' || needs.changes.outputs.should_run_tests == 'true' }}
    runs-on: macos-15
    # Bounds manifest checks, launcher coverage, and the full debug suite.
    # (The release-mode UserNotifications regression lives in the Release
    # Compile job, next to the release build it consumes.) Generous headroom
    # so a successful final link is not cancelled by the job deadline.
    timeout-minutes: 90
    steps:
      - name: Checkout code
        uses: actions/checkout@v7
        with:
          # Static-check diffing needs full history; blob:none keeps that while
          # skipping the ~1.25 GB of blob download that made this checkout cost
          # a macOS-runner minute per run.
          fetch-depth: 0
          filter: blob:none

      - name: Select and assert pinned Xcode 16.4
        run: desktop/macos/scripts/run-swift-ci.sh --select-toolchain

      - name: Restore Swift formatter and linter tools
        if: ${{ always() && !cancelled() && needs.changes.outputs.should_run_static == 'true' }}
        id: swift-tools-cache
        uses: actions/cache/restore@v6
        with:
          path: |
            ~/.cache/omi-swift-format
            ~/.cache/omi-swiftlint
          key: ${{ runner.os }}-desktop-swift-tools-xcode164-${{ hashFiles('desktop/macos/scripts/swift-format-wrapper.sh', 'desktop/macos/scripts/swiftlint-wrapper.sh') }}
          restore-keys: |
            ${{ runner.os }}-desktop-swift-tools-xcode164-

      - name: Install uv for manifest checks
        if: ${{ always() && !cancelled() && needs.changes.outputs.should_run_static == 'true' }}
        uses: astral-sh/setup-uv@ecd24dd710f2fb0dca1693a67af11fc4a5c5ec84
        with:
          # Exact version resolves locally; an unset version means "latest",
          # which fetches the astral-sh/versions manifest and has hard-failed
          # CI on that network call. Matches backend/Dockerfile UV_VERSION.
          version: "0.11.13"

      - name: Run macOS-scoped manifest checks
        if: ${{ always() && !cancelled() && needs.changes.outputs.should_run_static == 'true' }}
        id: macos_manifest_checks
        run: |
          MANIFEST_ARGS=()
          if [ "${{ github.event_name }}" = "pull_request" ]; then
            # Repo Checks owns PR-body metadata. This macOS-only lane still
            # passes --skip-changelog so it does not depend on labels; the
            # checker itself no longer treats that skip as an exemption for
            # production desktop paths (SCA-343 / #11778).
            MANIFEST_ARGS+=(--skip-changelog)
          fi
          python3 .github/scripts/run_checks.py \
            --lane ci \
            --platform macos \
            --exclusive-platform \
            --base "${{ needs.changes.outputs.diff_base }}" \
            --skip-pr-body-checks \
            "${MANIFEST_ARGS[@]}"

      - name: Save Swift formatter and linter tools after checks
        if: ${{ always() && !cancelled() && needs.changes.outputs.should_run_static == 'true' && steps.swift-tools-cache.outputs.cache-hit != 'true' }}
        uses: actions/cache/save@v6
        with:
          path: |
            ~/.cache/omi-swift-format
            ~/.cache/omi-swiftlint
          key: ${{ runner.os }}-desktop-swift-tools-xcode164-${{ hashFiles('desktop/macos/scripts/swift-format-wrapper.sh', 'desktop/macos/scripts/swiftlint-wrapper.sh') }}

      # A Desktop/.build archive is about 5.3 GB. GitHub scopes those archives
      # to a PR ref, so they miss for normal new commits and spend over a minute
      # uploading without reducing a subsequent run. Retain only SwiftPM's
      # dependency cache, which is small and reusable when the manifest matches.
      - name: Restore SwiftPM dependency cache
        if: ${{ always() && !cancelled() && needs.changes.outputs.should_run_tests == 'true' }}
        id: swiftpm-cache
        uses: actions/cache/restore@v6
        with:
          path: |
            ~/Library/Caches/org.swift.swiftpm
          key: ${{ runner.os }}-desktop-swift-build-xcode164-${{ hashFiles('desktop/macos/Desktop/Package.swift', 'desktop/macos/Desktop/Package.resolved') }}
          restore-keys: |
            ${{ runner.os }}-desktop-swift-build-xcode164-

      - name: Install Swift system dependencies
        if: ${{ always() && !cancelled() && needs.changes.outputs.should_run_tests == 'true' }}
        run: brew install actionlint pkg-config webp

      - name: Desktop launcher script tests
        if: ${{ always() && !cancelled() && needs.changes.outputs.should_run_tests == 'true' }}
        id: desktop_launcher_tests
        working-directory: desktop/macos
        run: |
          # Discovery, not a hardcoded list — a new tests/test-*.sh runs here
          # automatically, mirroring swift-test-suites.sh's auto-discovery.
          # Three-way parallel (the hosted runner has 3 cores): the serial loop
          # cost 9.3 min p50, which was 13% of all macOS-runner demand. Each
          # test logs to its own file so parallel output cannot interleave;
          # failing logs are replayed in full at the end.
          log_dir="$(mktemp -d)"
          # The skip hand list stays a `case` pattern: check-launcher-test-skips.py
          # parses this exact shape to hold it equal to the # discovery-skip markers.
          for t in tests/test-*.sh; do
            case "$t" in
              tests/test-mounted-navigation-latency.sh|tests/test-named-bundle-resources.sh)
                continue
                ;;
            esac
            printf '%s\n' "$t"
          done \
            | xargs -P 3 -I{} bash -c '
                t="$1"
                log_dir="$2"
                log="$log_dir/$(basename "$t").log"
                if bash "$t" >"$log" 2>&1; then
                  echo "== PASS $t"
                else
                  echo "== FAIL $t"
                  touch "$log.failed"
                fi
              ' _ {} "$log_dir"
          failed=0
          for marker in "$log_dir"/*.failed; do
            [ -e "$marker" ] || continue
            failed=1
            log="${marker%.failed}"
            echo "--- $(basename "$log" .log) output ---"
            cat "$log"
          done
          exit "$failed"

      # Debug build+test only on the PR critical path. Release compile is a
      # separate job (main push, or PRs that touch Package.swift) so we do not
      # pay for a second configuration that tests never consume.
      - name: Test desktop Swift app
        if: ${{ always() && !cancelled() && needs.changes.outputs.should_run_tests == 'true' }}
        id: desktop_swift_tests
        working-directory: desktop/macos
        env:
          # Each isolated worker receives a copy-on-write clone of the prebuilt
          # SwiftPM scratch directory, so filtered suites do not contend on the
          # shared Desktop/.build lock. Batching collapsed per-invocation
          # SwiftPM startup (the reason two workers were the measured ceiling),
          # so three workers now match the runner's three cores; measure-block
          # suites carry a doubled per-suite budget to absorb the added CPU
          # contention. Evidence: PR #12247's runs. Drop back to "2" if the
          # performance harness starts timing out.
          OMI_SWIFT_TEST_SUITE_WORKERS: "3"
          OMI_SWIFT_TEST_SUITE_TIMEOUT_SECONDS: "300"
        run: ./scripts/run-swift-ci.sh --test

      # Preserve resolved dependency downloads after a failed test command, but
      # do not archive Desktop/.build: its PR-scoped 5.3 GB cache misses in
      # ordinary new-commit runs and increases billed macOS time on every save.
      - name: Save SwiftPM dependency cache after test attempt
        if: ${{ always() && !cancelled() && needs.changes.outputs.should_run_tests == 'true' && steps.swiftpm-cache.outputs.cache-hit != 'true' }}
        uses: actions/cache/save@v6
        with:
          path: |
            ~/Library/Caches/org.swift.swiftpm
          key: ${{ runner.os }}-desktop-swift-build-xcode164-${{ hashFiles('desktop/macos/Desktop/Package.swift', 'desktop/macos/Desktop/Package.resolved') }}

      - name: Require independent macOS phase verdicts
        if: ${{ always() && !cancelled() }}
        env:
          STATIC_REQUIRED: ${{ needs.changes.outputs.should_run_static }}
          TESTS_REQUIRED: ${{ needs.changes.outputs.should_run_tests }}
          STATIC_OUTCOME: ${{ steps.macos_manifest_checks.outcome }}
          LAUNCHER_OUTCOME: ${{ steps.desktop_launcher_tests.outcome }}
          TEST_OUTCOME: ${{ steps.desktop_swift_tests.outcome }}
        run: |
          require_success() {
            local required="$1"
            local name="$2"
            local outcome="$3"
            if [ "$required" = true ] && [ "$outcome" != success ]; then
              echo "FAIL: $name did not succeed (outcome=$outcome)" >&2
              return 1
            fi
          }

          require_success "$STATIC_REQUIRED" "macOS manifest checks" "$STATIC_OUTCOME"
          require_success "$TESTS_REQUIRED" "desktop launcher script tests" "$LAUNCHER_OUTCOME"
          require_success "$TESTS_REQUIRED" "desktop Swift tests" "$TEST_OUTCOME"

  desktop-swift:
    # Keep this name a literal: desktop release planning looks this check up by
    # exact name on the source SHA. GitHub does not evaluate `name:` for a
    # SKIPPED job, so an expression here publishes the raw expression text as
    # the check name — which made the required check *absent* rather than
    # skipped on every commit that did not touch desktop paths, and left the
    # planner reporting "missing" instead of the truth.
    name: Desktop Swift Build & Tests
    needs: [changes, desktop-swift-verify, desktop-swift-release-compile]
    if: ${{ always() && needs.changes.outputs.should_run == 'true' }}
    runs-on: ubuntu-latest
    steps:
      - name: Require static contracts and Swift tests
        env:
          VERIFY_RESULT: ${{ needs.desktop-swift-verify.result }}
          RELEASE_RESULT: ${{ needs.desktop-swift-release-compile.result }}
          STATIC_REQUIRED: ${{ needs.changes.outputs.should_run_static }}
          TESTS_REQUIRED: ${{ needs.changes.outputs.should_run_tests }}
          RELEASE_REQUIRED: ${{ needs.changes.outputs.should_release_compile == 'true' || needs.changes.outputs.should_notification_release_regression == 'true' }}
        run: |
          if [ "$STATIC_REQUIRED" = true ] || [ "$TESTS_REQUIRED" = true ]; then
            test "$VERIFY_RESULT" = success
          else
            test "$VERIFY_RESULT" = skipped
          fi

          # The release-mode lane (whole-module-optimization compile and the
          # UserNotifications release regression) now reports only through the
          # Release Compile job, so this required check must hard-fail on it
          # too — otherwise a release-only Sendable break merges on a green
          # debug lane again (#11373/#11374).
          if [ "$RELEASE_REQUIRED" = true ]; then
            test "$RELEASE_RESULT" = success
          else
            test "$RELEASE_RESULT" = skipped
          fi

  desktop-swift-release-compile:
    # Literal for the same reason as `desktop-swift` above.
    name: Desktop Swift Release Compile
    needs: changes
    # The notification flag is structurally a subset of should_release_compile
    # (every notification input is a releasable desktop path), but gate on both
    # so a future pathspec change cannot silently skip the regression's runner.
    if: ${{ needs.changes.outputs.should_release_compile == 'true' || needs.changes.outputs.should_notification_release_regression == 'true' }}
    runs-on: macos-15
    timeout-minutes: 60
    steps:
      - name: Checkout code
        uses: actions/checkout@v7
        with:
          fetch-depth: 1

      - name: Select and assert pinned Xcode 16.4
        run: desktop/macos/scripts/run-swift-ci.sh --select-toolchain

      # Same dependency cache as the verify job: without it every release
      # compile re-resolves all SwiftPM dependencies (~1 min of clone traffic).
      - name: Restore SwiftPM dependency cache
        id: release-swiftpm-cache
        uses: actions/cache/restore@v6
        with:
          path: |
            ~/Library/Caches/org.swift.swiftpm
          key: ${{ runner.os }}-desktop-swift-build-xcode164-${{ hashFiles('desktop/macos/Desktop/Package.swift', 'desktop/macos/Desktop/Package.resolved') }}
          restore-keys: |
            ${{ runner.os }}-desktop-swift-build-xcode164-

      # Unlike the verify job's Desktop/.build (PR-scoped, always misses), this
      # cache is written from main pushes, so it is readable by every PR and
      # every later main push. A warm restore turns the ~20 min cold release
      # build into an incremental one.
      - name: Restore release build products
        id: release-build-cache
        uses: actions/cache/restore@v6
        with:
          path: desktop/macos/Desktop/.build
          key: ${{ runner.os }}-desktop-swift-release-xcode164-${{ hashFiles('desktop/macos/Desktop/Package.swift', 'desktop/macos/Desktop/Package.resolved') }}-${{ github.sha }}
          restore-keys: |
            ${{ runner.os }}-desktop-swift-release-xcode164-${{ hashFiles('desktop/macos/Desktop/Package.swift', 'desktop/macos/Desktop/Package.resolved') }}-
            ${{ runner.os }}-desktop-swift-release-xcode164-

      - name: Install Swift system dependencies
        run: brew install pkg-config webp

      - name: Release compile
        working-directory: desktop/macos
        run: ./scripts/run-swift-ci.sh --release-compile

      # Runs here, not in the verify job: the regression needs release-mode
      # artifacts, and building them twice on two hosted Macs cost ~31 min per
      # notification-boundary change. The release planner requires this job's
      # check ("Desktop Swift Release Compile") by exact name on the source
      # SHA, and the Build & Tests aggregate hard-fails on this job's result,
      # so both release tagging and PR merges still gate on it.
      - name: Test UserNotifications callback regression in release mode
        if: ${{ needs.changes.outputs.should_notification_release_regression == 'true' }}
        working-directory: desktop/macos
        run: ./scripts/run-swift-ci.sh --release-notification-regression

      - name: Save SwiftPM dependency cache
        if: ${{ github.event_name == 'push' && steps.release-swiftpm-cache.outputs.cache-hit != 'true' }}
        uses: actions/cache/save@v6
        with:
          path: |
            ~/Library/Caches/org.swift.swiftpm
          key: ${{ runner.os }}-desktop-swift-build-xcode164-${{ hashFiles('desktop/macos/Desktop/Package.swift', 'desktop/macos/Desktop/Package.resolved') }}

      # Save only from main pushes: PR-scoped saves are unreadable by other
      # refs and would spend upload minutes for nothing.
      - name: Save release build products
        if: ${{ github.event_name == 'push' }}
        uses: actions/cache/save@v6
        with:
          path: desktop/macos/Desktop/.build
          key: ${{ runner.os }}-desktop-swift-release-xcode164-${{ hashFiles('desktop/macos/Desktop/Package.swift', 'desktop/macos/Desktop/Package.resolved') }}-${{ github.sha }}