---
name: 'lint'

on:
  pull_request:
    paths-ignore:
      - 'docs/**'
      - 'examples/**'
      - 'README.md'
      - '**/*.md'
      # golangci-lint runs new-from-merge-base, so a diff with no touched Go
      # lines can only ever be a no-op. See .agents/ci-caching.md.
      - 'gallery/**'
  push:
    branches:
      - master

concurrency:
  group: ci-lint-${{ github.event.pull_request.number || github.sha }}-${{ github.repository }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

jobs:
  golangci-lint:
    # Self-hosted for PUSH only, and only in the canonical repo.
    #
    # This workflow also runs on pull_request, which for a fork PR means
    # executing untrusted contributor code. That must never land on a
    # self-hosted runner, so anything that is not a push to mudler/LocalAI stays
    # on the ephemeral hosted pool. Pushes to master are trusted code that has
    # already been reviewed and merged.
    #
    # Why at all: the hosted pool is shared account-wide and starved for 35
    # straight minutes on 2026-07-31 while arc-runner-set kept completing jobs.
    # Lint is small and runs on every commit, so it is a good candidate to move
    # off the contended pool.
    # REVERTED to hosted: the arc-runner-set image has git, curl, unzip, tar,
    # ldd and python3, but NOT make (nor gcc). Measured on run 30637392862,
    # where the preflight below named both. Re-route here once the runner image
    # ships a C toolchain and make; the preflight stays so the next attempt
    # fails by name in one second instead of opaquely mid-build.
    runs-on: ubuntu-latest
    steps:
      - name: Preflight - required host tools
        # The hosted images ship these; a self-hosted container image may not.
        # Check up front so a missing tool reports itself by name instead of
        # surfacing as an opaque failure inside `make protogen-go` (which needs
        # curl + unzip for protoc) or `make lint`.
        run: |
          missing=""
          for t in git curl unzip make tar; do
            command -v "$t" >/dev/null 2>&1 || missing="$missing $t"
          done
          echo "runner: ${RUNNER_NAME:-unknown}  os: $(uname -sm)"
          if [ -n "$missing" ]; then
            echo "::error::missing required tools on this runner:$missing"
            exit 1
          fi
          echo "all required tools present"
      - uses: actions/checkout@v7
        with:
          # Full history so golangci-lint's new-from-merge-base can reach
          # origin/master and compute the diff against it.
          fetch-depth: 0
      - uses: actions/setup-go@v5
        with:
          go-version: '1.26.x'
          cache: false
      - name: install golangci-lint
        run: |
          curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh \
            | sh -s -- -b "$(go env GOPATH)/bin" v2.11.4
      - name: generate grpc proto sources
        # pkg/grpc/proto/*.go is generated, not checked in. Several packages
        # import it, so without this step typecheck fails project-wide.
        run: make protogen-go
      - name: stub react-ui dist for go:embed
        # core/http/app.go has //go:embed react-ui/dist/*; the glob needs at
        # least one non-hidden entry to satisfy typecheck. We don't run
        # `make react-ui` here because lint doesn't need the real bundle.
        run: |
          mkdir -p core/http/react-ui/dist
          touch core/http/react-ui/dist/index.html
      - name: lint
        run: make lint

  build-scripts:
    # The image packaging scripts encode invariants that only surface inside a
    # container build (a missing transitive dep, a partial cuDNN family). Their
    # shell tests need nothing but bash + gcc + ldd, so run them on every PR
    # rather than waiting on a multi-GB cross-arch backend image build.
    #
    # Push-only self-hosted routing, same fork-safety reasoning as
    # golangci-lint above.
    # REVERTED to hosted: the arc-runner-set image has git, curl, unzip, tar,
    # ldd and python3, but NOT make (nor gcc). Measured on run 30637392862,
    # where the preflight below named both. Re-route here once the runner image
    # ships a C toolchain and make; the preflight stays so the next attempt
    # fails by name in one second instead of opaquely mid-build.
    runs-on: ubuntu-latest
    steps:
      - name: Preflight - required host tools
        # This job additionally needs a C toolchain: the packaging-script tests
        # compile a throwaway binary and inspect it with ldd.
        run: |
          missing=""
          for t in git make gcc ldd python3; do
            command -v "$t" >/dev/null 2>&1 || missing="$missing $t"
          done
          echo "runner: ${RUNNER_NAME:-unknown}  os: $(uname -sm)"
          if [ -n "$missing" ]; then
            echo "::error::missing required tools on this runner:$missing"
            exit 1
          fi
          echo "all required tools present"
      - uses: actions/checkout@v7
      - name: run packaging script tests
        run: make test-build-scripts

      # The backend matrix path filter fails silently: a miss emits an empty
      # matrix, every job goes green, and the change reaches no image (#10946).
      # Its tests need only node, so they ride along with this job.
      - uses: actions/setup-node@v7
        with:
          node-version: '20'
      - name: run CI script tests
        run: make test-ci-scripts

      # The shared python backend helpers (Options[] parsing, engine-arg
      # mapping, model reference resolution) are stdlib-only, so their tests
      # ride along here instead of waiting on a multi-GB backend image build.
      - name: run shared python backend helper tests
        run: make test-python-helpers