desktop-swift-ci.yml

name: Desktop Swift CI

on:
  push:
    branches: main
  pull_request:
    branches: main
  # A later backend/docs commit must not make the last path-selected Desktop
  # Swift verdict look current. Run against default-branch HEAD every day at an
  # off-round UTC minute; the selector treats this as a full health event.
  schedule:
    - cron: "17 5 * * *"
  # Recovery hatch. `plan-desktop-release.py` requires this workflow's checks on the
  # exact source SHA, so any interruption — the workflow being disabled, a run cancelled
  # by concurrency, an infrastructure blip — leaves that SHA permanently unreleasable:
  # push events do not replay, and neither a force-push nor a PR close/reopen produces a
  # run for a commit already on main. Manual dispatch is the only way to re-mint the
  # evidence without an unrelated commit. Manual dispatch is path-independent so
  # it still compiles a HEAD whose final commit only touched another component.
  workflow_dispatch:

concurrency:
  # Supersede stale revisions of the same PR, but never let a later main push
  # cancel the exact-SHA evidence consumed by desktop release planning.
  group: desktop-swift-${{ github.event.pull_request.number || github.sha }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

jobs:
  changes:
    name: Detect Desktop Swift Changes
    runs-on: ubuntu-latest
    outputs:
      diff_base: ${{ steps.changed.outputs.diff_base }}
      should_run: ${{ steps.changed.outputs.should_run }}
      should_run_static: ${{ steps.changed.outputs.should_run_static }}
      should_run_tests: ${{ steps.changed.outputs.should_run_tests }}
      should_release_compile: ${{ steps.changed.outputs.should_release_compile }}
      should_notification_release_regression: ${{ steps.changed.outputs.should_notification_release_regression }}
      desktop_swift_changed_files: ${{ steps.changed.outputs.desktop_swift_changed_files }}
    steps:
      - name: Checkout code
        uses: actions/checkout@v7
        with:
          fetch-depth: 0

      - name: Detect changed paths
        id: changed
        run: |
          if [ "${{ github.event_name }}" = "pull_request" ]; then
            # Resolve the base live against the checkout (matching detect-changes)
            # rather than the event-payload base.sha, which can be stale for a
            # queued run (FC-stale-event-payload-diff-base, #10785).
            DIFF_BASE="origin/${{ github.base_ref }}"
          else
            DIFF_BASE="${{ github.event.before }}"
          fi
          if [ -z "$DIFF_BASE" ] || [[ "$DIFF_BASE" =~ ^0+$ ]]; then
            DIFF_BASE="$(git rev-parse HEAD^)"
          fi

          FILES=$(scripts/changed-files "$DIFF_BASE"...HEAD)
          echo "$FILES"
          echo "diff_base=$DIFF_BASE" >> "$GITHUB_OUTPUT"

          IMPACT_FILES=$(mktemp)
          printf '%s\n' "$FILES" > "$IMPACT_FILES"
          python3 scripts/pre_push_ci_prediction.py \
            --changed-files "$IMPACT_FILES" \
            --base "$DIFF_BASE" \
            --event "${{ github.event_name }}" \
            --github-output "$GITHUB_OUTPUT"

          # Static macOS work is owned by the deterministic manifest. Querying
          # it exclusively prevents portable checks from moving back onto this
          # scarce runner while preserving their Linux Repo Checks route.
          python3 .github/scripts/run_checks.py \
            --lane ci \
            --platform macos \
            --exclusive-platform \
            --base "$DIFF_BASE" \
            --skip-pr-body-checks \
            --changed-files "$IMPACT_FILES" \
            --output json > /tmp/macos-manifest-selection.json
          SHOULD_RUN_STATIC=$(python3 - <<'PY'
          import json
          import sys
          from pathlib import Path

          selection = json.loads(Path("/tmp/macos-manifest-selection.json").read_text())
          for check in selection["checks"]:
              print(
                  f"macOS manifest selection: {check['id']} via {', '.join(check['matched_paths'])}: {check['reason']}",
                  file=sys.stderr,
              )
          print(str(bool(selection["checks"])).lower())
          PY
          )
          echo "should_run_static=$SHOULD_RUN_STATIC" >> "$GITHUB_OUTPUT"

          # The PR test lane defers ratcheted slow suites to the full lane
          # (every main push and the scheduled health run) unless this diff
          # touches their own inputs. Ship the exact deferral-relevant subset
          # to the runner: test sources, the package manifest, and the runner
          # scripts whose change must re-baseline the whole suite selection.
          DESKTOP_SWIFT_CHANGED=$(printf '%s\n' "$FILES" | grep -Ex \
            'desktop/macos/(Desktop/Tests/[^ ]+\.swift|Desktop/Package\.(swift|resolved)|test\.sh|scripts/(run-swift-ci\.sh|swift-test-suites\.sh|swift-test-slow-suites\.json|swift-test-skip-ratchet\.py))' \
            || true)
          {
            echo "desktop_swift_changed_files<<DESKTOP_SWIFT_CHANGED_EOF"
            printf '%s\n' "$DESKTOP_SWIFT_CHANGED"
            echo "DESKTOP_SWIFT_CHANGED_EOF"
          } >> "$GITHUB_OUTPUT"

  # Hosted macOS capacity is deliberately scarce. Run static contracts and the
  # optional full suite as steps in one selected job, rather than claiming two
  # runners in parallel. The stable Ubuntu aggregate below remains the exact
  # release-gate check name.
  desktop-swift-verify:
    name: Desktop Swift Static & Test Contracts
    needs: changes
    if: ${{ needs.changes.outputs.should_run_static == 'true' || needs.changes.outputs.should_run_tests == 'true' }}
    runs-on: macos-15
    # Bounds manifest checks, launcher coverage, and the debug suite — a
    # wedge-guard, not a lane budget: the ceiling must admit one legitimate
    # cold-tools run (~15 min from-source bootstrap ahead of the full lane,
    # which still executes every suite on this branch's own runner-changing
    # diffs). Two runs were cancelled by tighter ceilings before completing.
    timeout-minutes: 60
    steps:
      - name: Checkout code
        uses: actions/checkout@v7
        with:
          # Static-check diffing needs full history; blob:none keeps that while
          # skipping the ~1.25 GB of blob download that made this checkout cost
          # a macOS-runner minute per run.
          fetch-depth: 0
          filter: blob:none

      - name: Select and assert pinned Xcode 16.4
        run: desktop/macos/scripts/run-swift-ci.sh --select-toolchain

      - name: Restore Swift formatter and linter tools
        # Restored for the tests lane too, not only static: the launcher
        # script tests exercise the pinned swift-format binary, and without
        # the restore a tests-only diff pays a ~15 min from-source rebuild.
        # The -v2 prefix deliberately abandons entries the old workflow
        # saved before any consumer had built the tools: an exact-key hit on
        # an empty archive suppressed every later save (run 34295159347).
        if: ${{ always() && !cancelled() && (needs.changes.outputs.should_run_static == 'true' || needs.changes.outputs.should_run_tests == 'true') }}
        id: swift-tools-cache
        uses: actions/cache/restore@v6
        with:
          path: |
            ~/.cache/omi-swift-format
            ~/.cache/omi-swiftlint
          key: ${{ runner.os }}-desktop-swift-tools-v2-xcode164-${{ hashFiles('desktop/macos/scripts/swift-format-wrapper.sh', 'desktop/macos/scripts/swiftlint-wrapper.sh') }}
          restore-keys: |
            ${{ runner.os }}-desktop-swift-tools-v2-xcode164-

      - name: Warm pinned formatter and linter tools
        # One explicit bootstrap instead of whichever launcher test happens
        # to touch a wrapper first. A cache miss pays the ~15 min from-source
        # build here, visibly, and the save right below captures it before
        # any launcher test runs (three #13219 runs each rebuilt the tools
        # inside the launcher step and lost them).
        if: ${{ always() && !cancelled() && (needs.changes.outputs.should_run_static == 'true' || needs.changes.outputs.should_run_tests == 'true') }}
        id: swift_tools_warm
        run: |
          desktop/macos/scripts/swift-format-wrapper.sh bootstrap
          desktop/macos/scripts/swiftlint-wrapper.sh bootstrap

      - name: Save Swift formatter and linter tools after warm-up
        if: ${{ always() && !cancelled() && (needs.changes.outputs.should_run_static == 'true' || needs.changes.outputs.should_run_tests == 'true') && steps.swift-tools-cache.outputs.cache-hit != 'true' }}
        uses: actions/cache/save@v6
        with:
          path: |
            ~/.cache/omi-swift-format
            ~/.cache/omi-swiftlint
          key: ${{ runner.os }}-desktop-swift-tools-v2-xcode164-${{ hashFiles('desktop/macos/scripts/swift-format-wrapper.sh', 'desktop/macos/scripts/swiftlint-wrapper.sh') }}

      - name: Install uv for manifest checks
        if: ${{ always() && !cancelled() && needs.changes.outputs.should_run_static == 'true' }}
        uses: astral-sh/setup-uv@ecd24dd710f2fb0dca1693a67af11fc4a5c5ec84
        with:
          # Exact version resolves locally; an unset version means "latest",
          # which fetches the astral-sh/versions manifest and has hard-failed
          # CI on that network call. Matches backend/Dockerfile UV_VERSION.
          version: "0.11.13"

      - name: Run macOS-scoped manifest checks
        if: ${{ always() && !cancelled() && needs.changes.outputs.should_run_static == 'true' }}
        id: macos_manifest_checks
        run: |
          MANIFEST_ARGS=()
          if [ "${{ github.event_name }}" = "pull_request" ]; then
            # Repo Checks owns PR-body metadata. This macOS-only lane still
            # passes --skip-changelog so it does not depend on labels; the
            # checker itself no longer treats that skip as an exemption for
            # production desktop paths (SCA-343 / #11778).
            MANIFEST_ARGS+=(--skip-changelog)
          fi
          python3 .github/scripts/run_checks.py \
            --lane ci \
            --platform macos \
            --exclusive-platform \
            --base "${{ needs.changes.outputs.diff_base }}" \
            --skip-pr-body-checks \
            "${MANIFEST_ARGS[@]}"

      # The formatter/linter tools cache save waits until after the launcher
      # tests below: on a tests-only diff the manifest lane never runs and the
      # from-source bootstrap happens inside the launcher tests, so a save
      # placed here would cache nothing and every run would rebuild.
      # A Desktop/.build archive is about 5.3 GB. GitHub scopes those archives
      # to a PR ref, so they miss for normal new commits and spend over a minute
      # uploading without reducing a subsequent run. Retain only SwiftPM's
      # dependency cache, which is small and reusable when the manifest matches.
      - name: Restore SwiftPM dependency cache
        if: ${{ always() && !cancelled() && needs.changes.outputs.should_run_tests == 'true' }}
        id: swiftpm-cache
        uses: actions/cache/restore@v6
        with:
          path: |
            ~/Library/Caches/org.swift.swiftpm
          key: ${{ runner.os }}-desktop-swift-build-xcode164-${{ hashFiles('desktop/macos/Desktop/Package.swift', 'desktop/macos/Desktop/Package.resolved') }}
          restore-keys: |
            ${{ runner.os }}-desktop-swift-build-xcode164-

      - name: Install Swift system dependencies
        if: ${{ always() && !cancelled() && needs.changes.outputs.should_run_tests == 'true' }}
        run: brew install actionlint pkg-config webp

      # Debug build+test only on the PR critical path. Release compile is a
      # separate job (main push, scheduled health, manual dispatch, or a PR
      # that touches Package.swift/Package.resolved) so ordinary PRs do not
      # pay for a second configuration — or a second hosted Mac — that tests
      # never consume. This step runs BEFORE the launcher tests on purpose:
      # its prebuild leaves a warm Desktop/.build, so the launcher suite's
      # `swift build --build-tests` fixtures (feature-sentinel negative
      # control) compile incrementally instead of paying a second cold
      # package build (measured 21 min on run 34301327490-era shapes).
      - name: Test desktop Swift app
        if: ${{ always() && !cancelled() && needs.changes.outputs.should_run_tests == 'true' }}
        id: desktop_swift_tests
        working-directory: desktop/macos
        env:
          # Each isolated worker receives a copy-on-write clone of the prebuilt
          # SwiftPM scratch directory, so filtered suites do not contend on the
          # shared Desktop/.build lock. Batching collapsed per-invocation
          # SwiftPM startup (the reason two workers were the measured ceiling),
          # so three workers now match the runner's three cores; measure-block
          # suites carry a doubled per-suite budget to absorb the added CPU
          # contention. Evidence: PR #12247's runs. Drop back to "2" if the
          # performance harness starts timing out.
          OMI_SWIFT_TEST_SUITE_WORKERS: "3"
          OMI_SWIFT_TEST_SUITE_TIMEOUT_SECONDS: "300"
          # Per-invocation overhead (SwiftPM startup + xctest host launch)
          # dominates the suite step: ~35 invocations at batch 25 measured
          # 27-30 min on three workers while the tests themselves execute in
          # minutes. The deferred slow tail empties the budget-eaters out of
          # batches, so CI carries twice the suites per invocation; the local
          # default stays 25. Every invocation logs its wall seconds, so a
          # regression here is visible in the run log itself.
          OMI_SWIFT_TEST_SUITE_BATCH_SIZE: "50"
          # PRs defer ratcheted slow suites (swift-test-slow-suites.json) to
          # the full lane unless this diff touches their own inputs; pushes,
          # scheduled health runs, and manual dispatch always run everything.
          OMI_SWIFT_TEST_LANE: ${{ github.event_name == 'pull_request' && 'pr' || 'full' }}
          OMI_SWIFT_TEST_CHANGED_FILES: ${{ needs.changes.outputs.desktop_swift_changed_files }}
          # The PR lane also defers the serial and solo clusters: their
          # isolation contract costs one ~30s invocation per member for
          # sub-second tests, sequentially, after every worker exits
          # (24 invocations / 12.9 min on run 34306382692). Declaring files
          # and ratcheted subject watch paths still wake them; the full lane
          # always executes them.
          OMI_SWIFT_TEST_PR_LANE_DEFER_SERIAL: "1"
        run: ./scripts/run-swift-ci.sh --test

      - name: Desktop launcher script tests
        if: ${{ always() && !cancelled() && needs.changes.outputs.should_run_tests == 'true' }}
        id: desktop_launcher_tests
        working-directory: desktop/macos
        run: |
          # Discovery, not a hardcoded list — a new tests/test-*.sh runs here
          # automatically, mirroring swift-test-suites.sh's auto-discovery.
          # Three-way parallel (the hosted runner has 3 cores): the serial loop
          # cost 9.3 min p50, which was 13% of all macOS-runner demand. Each
          # test logs to its own file so parallel output cannot interleave;
          # failing logs are replayed in full at the end.
          log_dir="$(mktemp -d)"
          # The skip hand list stays a `case` pattern: check-launcher-test-skips.py
          # parses this exact shape to hold it equal to the # discovery-skip markers.
          for t in tests/test-*.sh; do
            case "$t" in
              tests/test-mounted-navigation-latency.sh|tests/test-named-bundle-resources.sh)
                continue
                ;;
            esac
            printf '%s\n' "$t"
          done \
          | xargs -P 3 -I{} bash -c '
              t="$1"
              log_dir="$2"
              log="$log_dir/$(basename "$t").log"
              started=$SECONDS
              if bash "$t" >"$log" 2>&1; then
                echo "== PASS $t ($((SECONDS - started))s)"
                # Per-test logs are replayed only on failure, so a passing
                # test that paid a from-source bootstrap (~15 min) or another
                # hidden slow path was invisible: test-swift-format-wrapper
                # passed in 1240s on run 34301327490 with a warm tools cache.
                grep -m1 -E "Bootstrapping swift|cache (HIT|stale)" "$log" | sed "s|^|   [$t] |" || true
              else
                echo "== FAIL $t ($((SECONDS - started))s)"
                touch "$log.failed"
              fi
            ' _ {} "$log_dir"
          failed=0
          for marker in "$log_dir"/*.failed; do
            [ -e "$marker" ] || continue
            failed=1
            log="${marker%.failed}"
            echo "--- $(basename "$log" .log) output ---"
            cat "$log"
          done
          exit "$failed"

      # Preserve resolved dependency downloads after a failed test command, but
      # do not archive Desktop/.build: its PR-scoped 5.3 GB cache misses in
      # ordinary new-commit runs and increases billed macOS time on every save.
      - name: Save SwiftPM dependency cache after test attempt
        if: ${{ always() && !cancelled() && needs.changes.outputs.should_run_tests == 'true' && steps.swiftpm-cache.outputs.cache-hit != 'true' }}
        uses: actions/cache/save@v6
        with:
          path: |
            ~/Library/Caches/org.swift.swiftpm
          key: ${{ runner.os }}-desktop-swift-build-xcode164-${{ hashFiles('desktop/macos/Desktop/Package.swift', 'desktop/macos/Desktop/Package.resolved') }}

      - name: Require independent macOS phase verdicts
        if: ${{ always() && !cancelled() }}
        env:
          STATIC_REQUIRED: ${{ needs.changes.outputs.should_run_static }}
          TESTS_REQUIRED: ${{ needs.changes.outputs.should_run_tests }}
          STATIC_OUTCOME: ${{ steps.macos_manifest_checks.outcome }}
          LAUNCHER_OUTCOME: ${{ steps.desktop_launcher_tests.outcome }}
          TEST_OUTCOME: ${{ steps.desktop_swift_tests.outcome }}
        run: |
          require_success() {
            local required="$1"
            local name="$2"
            local outcome="$3"
            if [ "$required" = true ] && [ "$outcome" != success ]; then
              echo "FAIL: $name did not succeed (outcome=$outcome)" >&2
              return 1
            fi
          }

          require_success "$STATIC_REQUIRED" "macOS manifest checks" "$STATIC_OUTCOME"
          require_success "$TESTS_REQUIRED" "desktop launcher script tests" "$LAUNCHER_OUTCOME"
          require_success "$TESTS_REQUIRED" "desktop Swift tests" "$TEST_OUTCOME"

  desktop-swift:
    # Keep this name a literal: desktop release planning looks this check up by
    # exact name on the source SHA. GitHub does not evaluate `name:` for a
    # SKIPPED job, so an expression here publishes the raw expression text as
    # the check name — which made the required check *absent* rather than
    # skipped on every commit that did not touch desktop paths, and left the
    # planner reporting "missing" instead of the truth.
    name: Desktop Swift Build & Tests
    needs: [changes, desktop-swift-verify, desktop-swift-release-compile]
    if: ${{ always() && needs.changes.outputs.should_run == 'true' }}
    runs-on: ubuntu-latest
    steps:
      - name: Require static contracts and Swift tests
        env:
          VERIFY_RESULT: ${{ needs.desktop-swift-verify.result }}
          RELEASE_RESULT: ${{ needs.desktop-swift-release-compile.result }}
          STATIC_REQUIRED: ${{ needs.changes.outputs.should_run_static }}
          TESTS_REQUIRED: ${{ needs.changes.outputs.should_run_tests }}
          RELEASE_REQUIRED: ${{ needs.changes.outputs.should_release_compile == 'true' || needs.changes.outputs.should_notification_release_regression == 'true' }}
        run: |
          if [ "$STATIC_REQUIRED" = true ] || [ "$TESTS_REQUIRED" = true ]; then
            test "$VERIFY_RESULT" = success
          else
            test "$VERIFY_RESULT" = skipped
          fi

          # The release-mode lane (whole-module-optimization compile and the
          # UserNotifications release regression) now reports only through the
          # Release Compile job, so this required check must hard-fail on it
          # too — otherwise a release-only Sendable break merges on a green
          # debug lane again (#11373/#11374).
          if [ "$RELEASE_REQUIRED" = true ]; then
            test "$RELEASE_RESULT" = success
          else
            test "$RELEASE_RESULT" = skipped
          fi

  desktop-swift-release-compile:
    # Literal for the same reason as `desktop-swift` above.
    name: Desktop Swift Release Compile
    needs: changes
    # Ordinary PRs no longer claim this second hosted Mac: a release compile
    # holds it for ~25 min, and one runner per PR halved concurrent macos-15
    # demand against the ~5-runner cap that was producing 60-97 min queues
    # (2026-09-08). The lane still runs for every main push, the scheduled
    # health run, manual dispatch, PRs that change the package manifest (the
    # inputs most likely to shift whole-module behavior), and notification
    # boundary paths — the notification flag is gated on both outputs so a
    # future pathspec change cannot silently skip the regression's runner.
    if: ${{ needs.changes.outputs.should_release_compile == 'true' || needs.changes.outputs.should_notification_release_regression == 'true' }}
    runs-on: macos-15
    timeout-minutes: 60
    steps:
      - name: Checkout code
        uses: actions/checkout@v7
        with:
          fetch-depth: 1

      - name: Select and assert pinned Xcode 16.4
        run: desktop/macos/scripts/run-swift-ci.sh --select-toolchain

      # Same dependency cache as the verify job: without it every release
      # compile re-resolves all SwiftPM dependencies (~1 min of clone traffic).
      - name: Restore SwiftPM dependency cache
        id: release-swiftpm-cache
        uses: actions/cache/restore@v6
        with:
          path: |
            ~/Library/Caches/org.swift.swiftpm
          key: ${{ runner.os }}-desktop-swift-build-xcode164-${{ hashFiles('desktop/macos/Desktop/Package.swift', 'desktop/macos/Desktop/Package.resolved') }}
          restore-keys: |
            ${{ runner.os }}-desktop-swift-build-xcode164-

      # No Desktop/.build build-products cache, by measurement: the release
      # compile step took 23-25 min on every recent run whether a 5.3 GB
      # archive hit exactly, partially, or not at all (whole-module
      # optimization recompiles on any source change, and runners are
      # ephemeral). Worse, each main-push save of that 5.3 GB archive evicted
      # the small swift-format/swiftlint tool caches from the repository's
      # 10 GB cache budget, which made the verify job's launcher tests rebuild
      # swift-format from source (~15 min) on cache misses.

      - name: Install Swift system dependencies
        run: brew install pkg-config webp

      - name: Release compile
        working-directory: desktop/macos
        run: ./scripts/run-swift-ci.sh --release-compile

      # Runs here, not in the verify job: the regression needs release-mode
      # artifacts, and building them twice on two hosted Macs cost ~31 min per
      # notification-boundary change. The release planner requires this job's
      # check ("Desktop Swift Release Compile") by exact name on the source
      # SHA, and the Build & Tests aggregate hard-fails on this job's result,
      # so both release tagging and PR merges still gate on it.
      - name: Test UserNotifications callback regression in release mode
        if: ${{ needs.changes.outputs.should_notification_release_regression == 'true' }}
        working-directory: desktop/macos
        run: ./scripts/run-swift-ci.sh --release-notification-regression

      - name: Save SwiftPM dependency cache
        if: ${{ github.event_name == 'push' && steps.release-swiftpm-cache.outputs.cache-hit != 'true' }}
        uses: actions/cache/save@v6
        with:
          path: |
            ~/Library/Caches/org.swift.swiftpm
          key: ${{ runner.os }}-desktop-swift-build-xcode164-${{ hashFiles('desktop/macos/Desktop/Package.swift', 'desktop/macos/Desktop/Package.resolved') }}