# .github/workflows/ci.yml · Zero-Secret OIDC JWKS + Tombstone Regressions + 1.4s Agent Wakeup
name: CI & Governed Chinwag Agent Wakeup
on: [push, pull_request]

permissions:
  id-token: write   # Hardware OIDC JWKS attestation (zero long-lived private keys)
  contents: read

jobs:
  test-matrix:
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, ubuntu-24.04-arm]
    steps:
      - uses: actions/checkout@v4

      # 1. Replay all Tombstone trajectory regression cassettes in <50ms ($0 LLM spend, 0 network calls)
      - name: Run Offline Tombstone Cassette Regressions (<50ms, $0)
        uses: emunlabs/chinwag-ci@v1
        with:
          org: emunlabs
          mode: test-regressions
          regressions-dir: .chinwag/regressions

      # 2. Wrap test suite with Pre-Encryption Secret Scrubber, Fork Quarantine & 1.4s Encrypted Agent Wakeup
      - name: Run Test Matrix with chinwag-ci (1.4s Encrypted Agent Wakeup)
        uses: emunlabs/chinwag-ci@v1
        env:
          CHINWAG_CI_ORG_TOKEN: ${{ secrets.CHINWAG_CI_ORG_TOKEN }}
        with:
          org: emunlabs
          mode: wrap
          hold-for-patch: 90
          quarantine-fork: true
          command: cargo test --workspace --all-targets

# .gitlab-ci.yml · Zero-Secret CI_JOB_JWT_V2 OIDC + Static chinwag-ci Runner
stages:
  - regressions
  - test

tombstone-regressions:
  stage: regressions
  script:
    - chinwag-ci test-regressions --dir .chinwag/regressions --json

cargo-test-matrix:
  stage: test
  parallel:
    matrix:
      - ARCH: ["x86_64", "aarch64"]
  id_tokens:
    CI_JOB_JWT_V2:
      aud: https://mesh.chinwag.sh
  script:
    - |
      chinwag-ci wrap \
        --org emunlabs \
        --hold-for-patch 90 \
        -- cargo test --workspace --all-targets

chinwag-ci selftest --json
chinwag-ci test-regressions --dir .chinwag/regressions --json