name: Test

on:
  pull_request:

jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: pnpm/action-setup@v4
      - uses: actions/setup-node@v4
        with:
          node-version: "24"
          cache: "pnpm"

      - run: pnpm install --frozen-lockfile --ignore-scripts
      - run: pnpm typecheck
      - run: pnpm test

  agents:
    runs-on: ubuntu-latest
    timeout-minutes: 10
    permissions:
      contents: read
      id-token: write
    strategy:
      fail-fast: true
      matrix:
        agent: [claude, codex, cursor, gemini, opencode]
        test:
          [file-read-write, mcpmerge, no-native-file, nobash, restricted, smoke]
    env:
      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
      OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
      CURSOR_API_KEY: ${{ secrets.CURSOR_API_KEY }}
      GOOGLE_API_KEY: ${{ secrets.GOOGLE_API_KEY }}
      GEMINI_API_KEY: ${{ secrets.GEMINI_API_KEY }}
      GEMINI_MODEL: ${{ vars.GEMINI_MODEL }}
      OPENCODE_MODEL: ${{ vars.OPENCODE_MODEL }}
    steps:
      - uses: actions/checkout@v4
      - uses: pnpm/action-setup@v4
      - uses: actions/setup-node@v4
        with:
          node-version: "24"
          cache: "pnpm"

      - run: pnpm install --frozen-lockfile --ignore-scripts
      - run: pnpm runtest ${{ matrix.test }} ${{ matrix.agent }}

  agnostic:
    runs-on: ubuntu-latest
    timeout-minutes: 10
    permissions:
      contents: read
      id-token: write
    strategy:
      fail-fast: true
      matrix:
        test:
          [
            delegate,
            delegate-effort,
            delegate-multi,
            file-traversal,
            git-permissions,
            githooks,
            pkg-json-scripts,
            proc-sandbox,
            push-disabled,
            push-enabled,
            push-restricted,
            symlink-traversal,
            timeout,
            token-exfil,
          ]
    env:
      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
    steps:
      - uses: actions/checkout@v4
      - uses: pnpm/action-setup@v4
      - uses: actions/setup-node@v4
        with:
          node-version: "24"
          cache: "pnpm"

      - run: pnpm install --frozen-lockfile --ignore-scripts
      - run: pnpm runtest ${{ matrix.test }}