fix(pre-commit-guard): detect langs from staged files, not repo config #377

Workflow file for this run

	name: vibeguard-ci

	on:
	pull_request:
	push:
	branches:
	- main

	permissions:
	contents: read

	# Opt in to Node 24 runtime for JavaScript actions ahead of the 2026-09-16
	# forced cutover. GitHub's deprecation notice states this is the supported
	# way to silence the "Node.js 20 actions are deprecated" warnings until all
	# third-party actions (e.g. benchmark-action/github-action-benchmark@v1)
	# publish Node 24–compatible releases.
	env:
	FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"

	defaults:
	run:
	shell: bash

	jobs:
	validate-and-test:
	name: CI (${{ matrix.os }})
	runs-on: ${{ matrix.os }}
	timeout-minutes: 20

	strategy:
	fail-fast: false
	matrix:
	os: [ubuntu-latest, macos-latest]

	steps:
	# Must run before checkout so Windows does not convert LF→CRLF in .sh files
	- name: Configure Git line endings (Windows)
	if: runner.os == 'Windows'
	run: git config --global core.autocrlf false

	- name: Checkout
	uses: actions/checkout@v4

	- name: Configure Git identity (for tests that create commits)
	run: \|
	git config --global user.name "CI"
	git config --global user.email "ci@vibeguard.test"

	- name: Setup Node
	uses: actions/setup-node@v4
	with:
	node-version: "20"

	- name: Setup Python
	uses: actions/setup-python@v5
	with:
	python-version: "3.11"

	- name: Install bash 4+ (macOS)
	if: runner.os == 'macOS'
	shell: bash
	run: \|
	brew install bash
	echo "Bash: $(bash --version \| head -1)"

	- name: Install ast-grep
	if: runner.os != 'Windows'
	shell: bash
	run: \|
	if command -v ast-grep >/dev/null 2>&1; then
	echo "ast-grep already installed: $(ast-grep --version)"
	exit 0
	fi
	if [[ "$(uname -s)" == "Darwin" ]]; then
	brew install ast-grep
	else
	# Linux: compile from source (Rust is pre-installed on GitHub Actions)
	cargo install ast-grep --locked
	fi
	echo "Installed: $(ast-grep --version)"

	# --- Shell-based validation ---
	# Skipped on Windows: these scripts check Unix file-permission bits ([ -x ])
	# which have no meaning on NTFS and would produce false-positive passes.
	- name: Validate guard scripts
	if: runner.os != 'Windows'
	shell: bash
	run: bash scripts/ci/validate-guards.sh

	- name: Validate hook scripts
	if: runner.os != 'Windows'
	shell: bash
	run: bash scripts/ci/validate-hooks.sh

	- name: Validate rule files
	shell: bash
	run: bash scripts/ci/validate-rules.sh

	- name: Validate canonical rule language
	if: runner.os != 'Windows'
	shell: bash
	run: bash scripts/ci/validate-canonical-rule-language.sh

	- name: Validate generated rule docs
	if: runner.os != 'Windows'
	shell: bash
	run: bash scripts/ci/validate-generated-rule-docs.sh

	- name: Validate manifest contract
	shell: bash
	run: bash scripts/ci/validate-manifest-contract.sh

	# --- Cross-platform contract validation (Python-embedded shell scripts) ---
	# Uses Git Bash on Windows; Python 3 is available from setup-python above.
	- name: Validate doc paths
	shell: bash
	run: bash scripts/ci/validate-doc-paths.sh

	- name: Validate doc command paths
	shell: bash
	run: bash scripts/ci/validate-doc-command-paths.sh

	- name: Validate doc freshness
	if: runner.os != 'Windows'
	shell: bash
	run: bash scripts/verify/doc-freshness-check.sh --strict

	# Install pnpm and uv so that the hook rewrite tests (npm→pnpm,
	# pip→uv) exercise the tool-availability guard added in pre-bash-guard.sh.
	- name: Install pnpm and uv (hook rewrite tests)
	shell: bash
	run: \|
	npm install -g pnpm
	python3 -m pip install uv

	# --- Regression tests ---
	# Skipped on Windows: the test harness uses Unix path assumptions,
	# mktemp patterns, and hook scripts that rely on native bash behaviour.
	- name: Hook regression tests
	shell: bash
	env:
	VIBEGUARD_TEST_UPDATED_INPUT: "1"
	run: bash tests/test_hooks.sh

	- name: Codex runtime regression tests
	shell: bash
	run: bash tests/test_codex_runtime.sh

	- name: Manifest contract regression tests
	shell: bash
	run: bash tests/test_manifest_contract.sh

	- name: Eval contract regression tests
	shell: bash
	run: bash tests/test_eval_contract.sh

	- name: Rust guard regression tests
	shell: bash
	run: bash tests/test_rust_guards.sh

	- name: Setup regression tests
	shell: bash
	run: bash tests/test_setup.sh

	- name: Hook health regression tests
	shell: bash
	run: bash tests/test_hook_health.sh

	- name: Stats regression tests
	if: runner.os != 'Windows'
	shell: bash
	run: bash tests/test_stats.sh

	- name: Quality grader regression tests
	if: runner.os != 'Windows'
	shell: bash
	run: bash tests/test_quality_grader.sh

	- name: Local contract gate regression tests
	if: runner.os != 'Windows'
	shell: bash
	run: bash tests/test_local_contract_gate.sh

	- name: Guard unit tests
	shell: bash
	run: bash tests/unit/run_all.sh

	- name: Hook precision tests
	shell: bash
	run: bash tests/run_precision.sh --all --csv

	- name: Validate precision thresholds
	shell: bash
	run: bash scripts/ci/validate-precision-thresholds.sh

	- name: Precision tracker regression tests
	shell: bash
	run: bash tests/test_precision_tracker.sh

	- name: Hook performance static analysis
	shell: bash
	run: bash scripts/ci/validate-hook-perf.sh

	- name: Hook latency benchmark
	shell: bash
	run: bash tests/bench_hook_latency.sh --sla=500 --runs=3

	- name: Upload benchmark results
	if: runner.os == 'Linux'
	uses: actions/upload-artifact@v4
	with:
	name: bench-output
	path: bench-output.json
	if-no-files-found: ignore

	- name: VibeGuard Benchmark (fast)
	shell: bash
	run: bash scripts/benchmark.sh --mode=fast

	windows-smoke:
	# Keep this job name aligned with the protected required check while the
	# Windows job intentionally runs only cross-platform contract smoke tests.
	name: CI (windows-latest)
	runs-on: windows-latest
	timeout-minutes: 10
	defaults:
	run:
	shell: bash
	steps:
	- name: Configure Git line endings
	run: git config --global core.autocrlf false

	- name: Checkout
	uses: actions/checkout@v4

	- name: Setup Python
	uses: actions/setup-python@v5
	with:
	python-version: "3.11"

	- name: Validate manifest contract
	run: bash scripts/ci/validate-manifest-contract.sh

	- name: Validate doc paths
	run: bash scripts/ci/validate-doc-paths.sh

	- name: Validate doc command paths
	run: bash scripts/ci/validate-doc-command-paths.sh

	- name: Manifest contract regression tests
	run: bash tests/test_manifest_contract.sh

	- name: Eval contract regression tests
	run: bash tests/test_eval_contract.sh

	benchmark-report:
	name: Benchmark Report
	runs-on: ubuntu-latest
	needs: validate-and-test
	# Isolated job so write tokens are not exposed to the shell-heavy CI steps above.
	permissions:
	contents: write
	pull-requests: write
	steps:
	- name: Checkout
	uses: actions/checkout@v4

	- name: Download benchmark results
	uses: actions/download-artifact@v4
	with:
	name: bench-output
	path: .

	- name: Store benchmark results
	if: hashFiles('bench-output.json') != ''
	uses: benchmark-action/github-action-benchmark@v1
	with:
	name: Hook Latency (P95)
	tool: customSmallerIsBetter
	output-file-path: bench-output.json
	github-token: ${{ secrets.GITHUB_TOKEN }}
	auto-push: ${{ github.ref == 'refs/heads/main' }}
	alert-threshold: "150%"
	comment-on-alert: true
	fail-on-alert: false
	comment-always: ${{ github.event_name == 'pull_request' }}
	# gh-pages branch now exists (created 2026-04-17); let the action fetch it
	skip-fetch-gh-pages: false

Navigation Menu

fix(pre-commit-guard): detect langs from staged files, not repo config #377

Workflow file

fix(pre-commit-guard): detect langs from staged files, not repo config #377

Uh oh!

Workflow file for this run