name: test / smoke / starter

# PR build-sanity gate (model B, §e / Phase 5) PLUS the post-merge 6h
# floating-dependency breakage detector. The eventual live dashboard signal
# for starter health comes from the harness HTTP-probing the deployed
# (sleepable) Railway starter services — but those S5 Railway services do
# NOT exist yet, so this `schedule` cron remains the ONLY post-merge
# detector that catches a starter broken by a floating transitive dependency
# or an upstream CopilotKit release. We KEEP the 6h cron (and the harness
# alert path, alerts/alert-engine.ts → #oss-alerts, carries the
# scheduled-failure Slack signal too) until S5 starter-service probing is
# confirmed live, at which point the cron can be retired in favour of the
# harness signal. The fast pre-merge build-sanity gate is the
# `pull_request` trigger on examples/integrations/**: it builds + smoke-
# tests each starter offline against aimock on every starter change. The
# post-merge GHCR `:latest` publish that feeds the Railway services lives in
# showcase_build.yml's build-starters job (push:main, §b stage 1), so it is
# intentionally NOT duplicated here.
on:
  schedule:
    # Every 6h — post-merge floating-dependency / upstream-release breakage
    # detector. Stays until S5 harness probing of live Railway starter
    # services is confirmed, then retire in favour of the harness signal.
    - cron: "0 */6 * * *"
  workflow_run:
    workflows: ["publish / release"]
    types: [completed]
  pull_request:
    paths:
      - "examples/integrations/**"
      - ".github/workflows/test_smoke-starter.yml"
  workflow_dispatch: {}

permissions:
  contents: read
  packages: read

jobs:
  smoke-starter:
    runs-on: ubuntu-latest
    timeout-minutes: 20
    env:
      SLACK_WEBHOOK: ${{ secrets.SLACK_WEBHOOK_OSS_ALERTS }}
    strategy:
      matrix:
        starter:
          - langgraph-python
          - mastra
          - langgraph-js
          - crewai-crews
          - pydantic-ai
          - adk
          - agno
          - llamaindex
          - langgraph-fastapi
          - strands-python
          - ms-agent-framework-python
          - ms-agent-framework-dotnet
      fail-fast: false

    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
        with:
          fetch-depth: 1
          lfs: false
          persist-credentials: false

      - name: Run starter smoke tests
        working-directory: examples/integrations/${{ matrix.starter }}
        env:
          STARTER: ${{ matrix.starter }}
          # Starters whose SDK can't be intercepted by aimock (currently
          # google-adk — google-genai ignores endpoint overrides) need a
          # real provider key. docker-compose.test.yml for those starters
          # reads this via `${GOOGLE_API_KEY:-test-key-for-aimock}` so
          # unaffected starters still run offline against aimock.
          GOOGLE_API_KEY: ${{ secrets.GOOGLE_API_KEY }}
        run: |
          docker compose -f docker-compose.test.yml up --abort-on-container-exit --exit-code-from tests

      - name: Capture failure cause
        if: failure()
        id: failure-cause
        working-directory: examples/integrations/${{ matrix.starter }}
        env:
          EVENT_NAME: ${{ github.event_name }}
          PR_NUMBER: ${{ github.event.pull_request.number }}
          PR_USER_LOGIN: ${{ github.event.pull_request.user.login }}
          PR_TITLE: ${{ github.event.pull_request.title }}
          PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
        run: |
          {
            echo "summary<<CAUSE_EOF"

            # Capture error from container logs (containers still running at this point)
            build_err=$(docker compose -f docker-compose.test.yml logs app 2>&1 | grep -E "ERR_|Error:|error:|Build error|failed to" | head -3)
            agent_err=$(docker compose -f docker-compose.test.yml logs agent 2>&1 | grep -E "Error:|Traceback|ModuleNotFoundError|ImportError" | head -3)
            test_err=$(docker compose -f docker-compose.test.yml logs tests 2>&1 | grep -E "✘|FAIL|Error:|expect\(" | head -5)

            if [ -n "$build_err" ]; then
              echo "Build failure:"
              echo "$build_err"
            elif [ -n "$agent_err" ]; then
              echo "Agent crash:"
              echo "$agent_err"
            elif [ -n "$test_err" ]; then
              echo "Test failure:"
              echo "$test_err"
            else
              echo "Unknown failure — check run logs"
            fi

            echo ""

            # Identify recent changes that may have caused the failure
            if [ "$EVENT_NAME" = "pull_request" ]; then
              echo "Triggered by PR #${PR_NUMBER} (${PR_USER_LOGIN}): ${PR_TITLE}"
              echo "Head: ${PR_HEAD_SHA}"
            elif [ "$EVENT_NAME" = "schedule" ] || [ "$EVENT_NAME" = "workflow_run" ]; then
              # Use GitHub API instead of git log (avoids needing deep clone)
              echo "Recent commits touching this starter (last 12h):"
              gh api "repos/${{ github.repository }}/commits?path=examples/integrations/${{ matrix.starter }}&since=$(date -u -d '12 hours ago' +%Y-%m-%dT%H:%M:%SZ 2>/dev/null || date -u -v-12H +%Y-%m-%dT%H:%M:%SZ)&per_page=5" \
                --jq '.[] | "\(.sha[0:7]) \(.commit.message | split("\n")[0])"' 2>/dev/null || true
              starter_commits=$(gh api "repos/${{ github.repository }}/commits?path=examples/integrations/${{ matrix.starter }}&since=$(date -u -d '12 hours ago' +%Y-%m-%dT%H:%M:%SZ 2>/dev/null || date -u -v-12H +%Y-%m-%dT%H:%M:%SZ)&per_page=1" --jq 'length' 2>/dev/null || echo "0")
              if [ "$starter_commits" = "0" ]; then
                echo "No starter code changes — likely a floating dependency update or upstream CopilotKit release"
                echo "Recent releases:"
                gh api "repos/${{ github.repository }}/releases?per_page=3" \
                  --jq '.[] | "\(.tag_name) (\(.published_at[0:10]))"' 2>/dev/null | head -3 || true
              fi
            fi
            echo "CAUSE_EOF"
          } >> "$GITHUB_OUTPUT"

      - name: Tear down
        if: always()
        working-directory: examples/integrations/${{ matrix.starter }}
        run: docker compose -f docker-compose.test.yml down -v

      - name: Upload test artifacts on failure
        if: failure()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: smoke-starter-${{ matrix.starter }}
          path: showcase/tests/test-results/
          retention-days: 7

      # Sanitize the failure summary and stash it in $GITHUB_ENV so the
      # inline Slack payload can reference it via `env.summary`. We don't
      # write to a payload file because slackapi/slack-github-action@v2.1.0
      # rejects payload files that don't end in `.json`/`.yaml`/`.yml`
      # (mktemp produces extensionless files), and `jq --rawfile` can also
      # crash under `set -e` on edge-case inputs, leaving an empty/missing
      # payload and silently suppressing the alert. Inline `payload:` with
      # `toJSON(format(...))` sidesteps both failure modes — quotes,
      # backslashes, newlines in the summary are safely JSON-encoded by
      # toJSON, and there's no intermediate file to mishandle. This is the
      # same pattern used in test_smoke-starter-deployed.yml (PR #4068) and
      # showcase_validate.yml.
      - name: Prepare Slack alert fields
        if: failure() && env.SLACK_WEBHOOK != '' && (github.event_name == 'schedule' || github.event_name == 'workflow_run')
        env:
          SUMMARY_RAW: ${{ steps.failure-cause.outputs.summary }}
        run: |
          # Strip ANSI sequences (SGR, OSC, and G0/G1 charset designators), then truncate
          # to 200 bytes and drop any trailing partial UTF-8 bytes so we don't emit mojibake.
          SUMMARY=$(printf '%s' "$SUMMARY_RAW" | head -3 \
            | sed -E 's/\x1b\[[0-9;?]*[A-Za-z]//g; s/\x1b\][^\x07]*\x07//g; s/\x1b[()][A-Za-z0-9]//g' \
            | head -c 200 | iconv -f UTF-8 -t UTF-8//IGNORE)
          if [ -z "$SUMMARY" ]; then
            SUMMARY="(no failure detail captured — see job log)"
          fi
          # Emit via heredoc so embedded `=`, quotes, or newlines don't
          # break KEY=VALUE parsing in $GITHUB_ENV.
          {
            echo "summary<<EOF_SUMMARY_7a4c"
            printf '%s\n' "$SUMMARY"
            echo "EOF_SUMMARY_7a4c"
          } >> "$GITHUB_ENV"

      - name: Alert Slack on failure
        if: failure() && env.SLACK_WEBHOOK != '' && (github.event_name == 'schedule' || github.event_name == 'workflow_run')
        uses: slackapi/slack-github-action@0d95c9a7becc1e6e297d76df9bc735c44f4cbcbc # v3.0.5
        with:
          webhook: ${{ secrets.SLACK_WEBHOOK_OSS_ALERTS }}
          webhook-type: incoming-webhook
          # NOTE: `\n` is NOT an escape sequence in GitHub Actions expression
          # string literals — `format()` would emit the two literal characters
          # backslash+n, which `toJSON` then encodes as `\\n`, so Slack renders
          # a literal "\n" instead of a line break. Inject real newlines via
          # `fromJSON('"\n"')` ({6}) so `toJSON` encodes them as a single `\n`
          # that Slack honors. The code-fence delimiters sit on their own lines
          # so the summary renders as a proper code block.
          payload: |
            { "text": ${{ toJSON(format(':x: `[ci:{2}]` *Starter smoke test failing: {0}*{6}<{1}/{2}/actions/runs/{3}|View run> · <{1}/{2}/actions/runs/{3}/job/{4}|View job>{6}```{6}{5}{6}```', matrix.starter, github.server_url, github.repository, github.run_id, github.job, env.summary, fromJSON('"\n"'))) }} }