current.yml

name: Current

permissions:
  contents: read

on:
  push:
    branches:
      - 'main'
      - '*-stable'
    tags:
      - '!*'
  pull_request:
    branches:
      - '*'
  workflow_dispatch:

concurrency:
  group: '${{ github.workflow }}-${{ github.ref }}'
  cancel-in-progress: true

jobs:
  detect:
    name: Detect changed gems
    runs-on: ubuntu-latest
    outputs:
      count: ${{ steps.changed-gems.outputs.count }}
      matrix: ${{ steps.changed-gems.outputs.matrix }}
      summary: ${{ steps.changed-gems.outputs.summary }}
      release_mode: ${{ steps.changed-gems.outputs.release_mode }}
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
      - name: Install nomono for Gemfile evaluation
        # The contract tests evaluate real Gemfiles, which bootstrap nomono for *_DEV wiring.
        run: gem install --user-install nomono --version '>= 1.1.18'
      - name: Validate typed core workflow contract
        run: python3 -m unittest discover -s .github/tests -v
      - name: Detect changed gems
        id: changed-gems
        shell: bash
        env:
          BASE_SHA: ${{ github.event.pull_request.base.sha || github.event.before }}
        run: |
          set -euo pipefail

          base_sha="${BASE_SHA:-}"
          if [[ -z "${base_sha}" || "${base_sha}" =~ ^0+$ ]]; then
            base_sha="$(git rev-parse HEAD^ 2>/dev/null || git rev-list --max-parents=0 HEAD)"
          fi

          changed_files="${RUNNER_TEMP}/changed-files.txt"
          git diff --name-only "${base_sha}...HEAD" > "${changed_files}"

          python3 - "${changed_files}" "${GITHUB_OUTPUT}" "${GITHUB_EVENT_PATH}" <<'PY'
          import json
          import pathlib
          import sys

          changed_files_path = pathlib.Path(sys.argv[1])
          github_output = pathlib.Path(sys.argv[2])
          event_path = pathlib.Path(sys.argv[3])
          changed = [line.strip() for line in changed_files_path.read_text().splitlines() if line.strip()]
          event = json.loads(event_path.read_text())
          message = event.get("head_commit", {}).get("message", "")
          release_mode = (
              "validation" if "[kettle-family:aggregate-ci]" in message else
              "member" if "[kettle-family:aggregate-member]" in message else
              ""
          )

          all_gems = sorted(
              str(path)
              for path in pathlib.Path("gems").iterdir()
              if path.is_dir() and any(path.glob("*.gemspec"))
          )
          gems = sorted(
              {
                  "/".join(path.split("/")[:2])
                  for path in changed
                  if path.startswith("gems/") and len(path.split("/")) > 2
              }
          )
          gems = [gem for gem in gems if gem in all_gems]

          family_input_changed = any(
              path.startswith(".github/") or path in {
                  "Gemfile",
                  "Gemfile.lock",
                  ".structuredmerge/fixtures.lock",
                  ".structuredmerge/benchmark-fixtures.lock",
                  ".github/workflows/current.yml",
              }
              for path in changed
          )
          if family_input_changed and not release_mode:
              gems = all_gems

          # Aggregate family releases validate the root suite once before
          # publishing members. The marker is written only by kettle-family;
          # ordinary and independent releases retain the changed-gem matrix.
          if release_mode:
              gems = []

          matrix = {"gem": gems}
          summary = ", ".join(gems) if gems else "No changed gem suites selected"

          with github_output.open("a", encoding="utf-8") as output:
              output.write(f"count={len(gems)}\n")
              output.write(f"matrix={json.dumps(matrix, separators=(',', ':'))}\n")
              output.write(f"summary={summary}\n")
              output.write(f"release_mode={release_mode}\n")

          print(f"Changed files: {len(changed)}")
          print(f"Selected gem suites: {summary}")
          print(f"Aggregate release mode: {release_mode or 'none'}")
          PY

  gem-suite:
    name: Gem suite with core artifact (${{ matrix.gem }})
    needs: [detect, typed-core]
    if: ${{ needs.detect.outputs.count != '0' && needs.detect.outputs.release_mode == '' }}
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix: ${{ fromJson(needs.detect.outputs.matrix) }}
    env:
      BUNDLE_GEMFILE: ${{ github.workspace }}/${{ matrix.gem }}/ci_core.gemfile
      KETTLE_FAMILY_BUNDLE_GEMFILE: ${{ github.workspace }}/${{ matrix.gem }}/ci_core.gemfile
      STRUCTUREDMERGE_CI_GEM_DIR: ${{ github.workspace }}/${{ matrix.gem }}
      STRUCTUREDMERGE_CI_DEP_HEADS: "false"
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Clone sibling fixtures repo
        shell: bash
        run: |
          set -euo pipefail
          fixtures_repository="$(ruby -ryaml -e 'puts YAML.load_file(".structuredmerge/fixtures.lock").fetch("repository")')"
          fixtures_branch="$(ruby -ryaml -e 'puts YAML.load_file(".structuredmerge/fixtures.lock").fetch("branch")')"
          fixtures_revision="$(ruby -ryaml -e 'puts YAML.load_file(".structuredmerge/fixtures.lock").fetch("revision")')"
          git clone --filter=blob:none --no-checkout "${fixtures_repository}" ../fixtures
          git -C ../fixtures fetch origin "refs/heads/${fixtures_branch}:refs/remotes/origin/${fixtures_branch}"
          git -C ../fixtures checkout --detach "${fixtures_revision}"
          test "$(git -C ../fixtures rev-parse HEAD)" = "${fixtures_revision}"
          git -C ../fixtures merge-base --is-ancestor "${fixtures_revision}" "refs/remotes/origin/${fixtures_branch}"
      - name: Setup Ruby
        uses: appraisal-rb/setup-ruby-flash@6f8ad36ba7488db591541483afb5464d01e8861b # v2.14
        with:
          ruby-version: "4.0"
          bundler: latest
          bundler-cache: false
          working-directory: ${{ matrix.gem }}
          pre-bundle-gems: |
            nomono --source https://gem.coop --source https://rubygems.org
      - name: Install verified typed core artifact
        uses: ./.github/actions/typed-core
      - name: Install dependencies
        working-directory: ${{ matrix.gem }}
        env:
          K_JEM_TEMPLATING: true
          STRUCTUREDMERGE_DEV: ${{ github.workspace }}/gems
        run: |
          bundle config set frozen false
          for attempt in 1 2 3; do
            if bundle install --jobs 4 --retry 8; then
              exit 0
            fi

            if [[ "${attempt}" -lt 3 ]]; then
              sleep "$((attempt * 5))"
            fi
          done

          exit 1
      - name: Verify installed typed core loads
        env:
          K_JEM_TEMPLATING: true
          STRUCTUREDMERGE_DEV: ${{ github.workspace }}/gems
        run: bundle exec ruby .github/verify_typed_core.rb
      - name: Run checks
        working-directory: ${{ matrix.gem }}
        env:
          K_JEM_TEMPLATING: true
          K_SOUP_COV_DO: false
          STRUCTUREDMERGE_DEV: ${{ github.workspace }}/gems
        run: timeout 12m bundle exec kettle-test

  typed-core:
    name: Typed core artifact @ HEAD (pre-publication)
    needs: detect
    if: ${{ needs.detect.outputs.count != '0' && needs.detect.outputs.release_mode == '' }}
    runs-on: ubuntu-latest
    timeout-minutes: 30
    env:
      CARGO_BUILD_JOBS: "1"
      CARGO_INCREMENTAL: "0"
      CARGO_PROFILE_DEV_DEBUG: "0"
      CARGO_PROFILE_TEST_DEBUG: "0"
      CARGO_TARGET_DIR: ${{ github.workspace }}/kernel/tmp/typed-core-target
    steps:
      - name: Checkout Ruby provider candidate
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          path: native-ruby
          persist-credentials: false
      - name: Checkout kernel HEAD
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          repository: structuredmerge/structuredmerge
          ref: main
          path: kernel
          persist-credentials: false
      - name: Record kernel revision
        working-directory: kernel
        run: git rev-parse HEAD
      - name: Setup Rust
        uses: dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8
        with:
          toolchain: stable
      - name: Setup Ruby
        uses: ruby/setup-ruby@e1bd6146574da5e0795075b5319b300edb30c5b0 # v1.333.0
        with:
          ruby-version: "4.0"
          bundler-cache: false
      - name: Build committed typed bindings and export platform gem
        working-directory: kernel/packages/ruby
        shell: bash
        run: |
          set -euo pipefail
          ulimit -c 0
          mkdir -p ../../tmp
          export TMPDIR="${GITHUB_WORKSPACE}/kernel/tmp"
          bundle install --jobs 4 --retry 8
          bundle exec rake compile
          bundle exec ruby ../../workspace-scripts/check_core_ruby_artifact.rb --package-only ../../tmp/core-export
          cp ../../workspace-scripts/verify_core_ruby_export.rb ../../tmp/core-export/
          git -C ../.. rev-parse HEAD > ../../tmp/core-export/kernel-revision.txt
      - name: Package candidate Psych provider without publication
        working-directory: native-ruby
        shell: bash
        run: |
          set -euo pipefail
          ulimit -c 0
          provider_dir="${GITHUB_WORKSPACE}/kernel/tmp/psych-provider"
          support_dir="${GITHUB_WORKSPACE}/kernel/tmp/psych-provider-support"
          mkdir -p "${provider_dir}" "${support_dir}"
          # Package the provider plus its candidate sibling closure. Sibling gems
          # pin each other to the exact checkout version, which a release-bumped
          # branch has not published yet; the kernel gate installs the closure
          # from these archives into its isolated gem home and validates that it
          # satisfies the provider's runtime requirements.
          ruby -rrubygems/package -e '
            provider_root, provider_dir, support_dir = ARGV
            gems_root = File.expand_path("..", provider_root)
            load_spec = lambda do |dir|
              Dir.chdir(dir) { Gem::Specification.load("#{File.basename(dir)}.gemspec") }
            end
            build_archive = lambda do |spec, dir, dest|
              Dir.chdir(dir) do
                target = File.join(dest, "#{spec.full_name}.gem")
                abort "refusing to overwrite provider archive #{target}" if File.exist?(target)
                Gem::Package.build(spec, false, false, target)
              end
            end
            provider = load_spec.call(provider_root)
            abort "unexpected provider gem" unless provider && provider.name == "psych-merge"
            abort "typed parser host missing" unless provider.files.include?("lib/psych/merge/core_parser_host.rb")
            build_archive.call(provider, provider_root, provider_dir)
            packaged = { provider.name => true }
            queue = provider.dependencies.select { |dependency| dependency.type == :runtime }.map(&:name)
            until queue.empty?
              name = queue.shift
              next if packaged[name]

              packaged[name] = true
              sibling = File.join(gems_root, name)
              next unless File.file?(File.join(sibling, "#{name}.gemspec"))

              spec = load_spec.call(sibling)
              build_archive.call(spec, sibling, support_dir)
              queue.concat(spec.dependencies.select { |dependency| dependency.type == :runtime }.map(&:name))
            end
          ' "${GITHUB_WORKSPACE}/native-ruby/gems/psych-merge" "${provider_dir}" "${support_dir}"
      - name: Verify candidate through full installed Ruby kernel gates
        working-directory: kernel
        shell: bash
        run: |
          set -euo pipefail
          ulimit -c 0
          export TMPDIR="${GITHUB_WORKSPACE}/kernel/tmp"
          mapfile -t providers < <(find tmp/psych-provider -maxdepth 1 -name '*.gem' -print)
          test "${#providers[@]}" -eq 1
          test -d tmp/psych-provider-support
          ruby workspace-scripts/check_core_ruby_artifact.rb \
            --provider-gem "${providers[0]}" \
            --provider-support-dir tmp/psych-provider-support 2>&1 | tee tmp/psych-native-provider.log
      - name: Upload native-provider evidence
        if: always()
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: psych-native-provider-head
          path: |
            kernel/tmp/psych-native-provider.log
            kernel/tmp/core-ruby-artifact-*/report.json
            kernel/tmp/core-ruby-artifact-*/failure.json
            kernel/tmp/core-ruby-artifact-*/Gemfile.lock
          if-no-files-found: warn
          retention-days: 7
      - name: Upload typed core export
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: structuredmerge-core-head
          path: kernel/tmp/core-export/*
          if-no-files-found: error
          retention-days: 7
      - name: Remove disposable compiler output
        if: always()
        shell: bash
        run: |
          if [ -d kernel/tmp/typed-core-target ]; then
            rm -r -- kernel/tmp/typed-core-target
          fi

  dep-heads:
    name: Deps @ HEAD (${{ matrix.gem }})
    needs:
      - detect
      - typed-core
    if: ${{ needs.detect.outputs.count != '0' && needs.detect.outputs.release_mode == '' }}
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix: ${{ fromJson(needs.detect.outputs.matrix) }}
    env:
      BUNDLE_GEMFILE: ${{ github.workspace }}/${{ matrix.gem }}/ci_core.gemfile
      KETTLE_FAMILY_BUNDLE_GEMFILE: ${{ github.workspace }}/${{ matrix.gem }}/ci_core.gemfile
      STRUCTUREDMERGE_CI_GEM_DIR: ${{ github.workspace }}/${{ matrix.gem }}
      STRUCTUREDMERGE_CI_DEP_HEADS: "true"
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Clone sibling fixtures repo
        shell: bash
        run: |
          set -euo pipefail
          fixtures_repository="$(ruby -ryaml -e 'puts YAML.load_file(".structuredmerge/fixtures.lock").fetch("repository")')"
          fixtures_branch="$(ruby -ryaml -e 'puts YAML.load_file(".structuredmerge/fixtures.lock").fetch("branch")')"
          fixtures_revision="$(ruby -ryaml -e 'puts YAML.load_file(".structuredmerge/fixtures.lock").fetch("revision")')"
          git clone --filter=blob:none --no-checkout "${fixtures_repository}" ../fixtures
          git -C ../fixtures fetch origin "refs/heads/${fixtures_branch}:refs/remotes/origin/${fixtures_branch}"
          git -C ../fixtures checkout --detach "${fixtures_revision}"
          test "$(git -C ../fixtures rev-parse HEAD)" = "${fixtures_revision}"
          git -C ../fixtures merge-base --is-ancestor "${fixtures_revision}" "refs/remotes/origin/${fixtures_branch}"
      - name: Setup Ruby
        uses: appraisal-rb/setup-ruby-flash@6f8ad36ba7488db591541483afb5464d01e8861b # v2.14
        with:
          ruby-version: "4.0"
          bundler: latest
          bundler-cache: false
          working-directory: ${{ matrix.gem }}
          pre-bundle-gems: |
            nomono --source https://gem.coop --source https://rubygems.org
      - name: Install verified typed core artifact
        uses: ./.github/actions/typed-core
      - name: Install dependencies
        working-directory: ${{ matrix.gem }}
        env:
          K_JEM_TEMPLATING: true
          STRUCTUREDMERGE_DEV: ${{ github.workspace }}/gems
        run: |
          bundle config set frozen false
          for attempt in 1 2 3; do
            if bundle install --jobs 4 --retry 8; then
              exit 0
            fi

            if [[ "${attempt}" -lt 3 ]]; then
              sleep "$((attempt * 5))"
            fi
          done

          exit 1
      - name: Verify installed typed core loads
        env:
          K_JEM_TEMPLATING: true
          STRUCTUREDMERGE_DEV: ${{ github.workspace }}/gems
        run: bundle exec ruby .github/verify_typed_core.rb
      - name: Run checks
        working-directory: ${{ matrix.gem }}
        env:
          K_JEM_TEMPLATING: true
          K_SOUP_COV_DO: false
          STRUCTUREDMERGE_DEV: ${{ github.workspace }}/gems
        run: timeout 12m bundle exec kettle-test

  coverage:
    name: Coverage with core artifact (${{ matrix.gem }})
    needs: [detect, typed-core]
    if: ${{ needs.detect.outputs.count != '0' && needs.detect.outputs.release_mode == '' }}
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix: ${{ fromJson(needs.detect.outputs.matrix) }}
    env:
      BUNDLE_GEMFILE: ${{ github.workspace }}/${{ matrix.gem }}/ci_core.gemfile
      KETTLE_FAMILY_BUNDLE_GEMFILE: ${{ github.workspace }}/${{ matrix.gem }}/ci_core.gemfile
      STRUCTUREDMERGE_CI_GEM_DIR: ${{ github.workspace }}/${{ matrix.gem }}
      STRUCTUREDMERGE_CI_DEP_HEADS: "false"
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Clone sibling fixtures repo
        shell: bash
        run: |
          set -euo pipefail
          fixtures_repository="$(ruby -ryaml -e 'puts YAML.load_file(".structuredmerge/fixtures.lock").fetch("repository")')"
          fixtures_branch="$(ruby -ryaml -e 'puts YAML.load_file(".structuredmerge/fixtures.lock").fetch("branch")')"
          fixtures_revision="$(ruby -ryaml -e 'puts YAML.load_file(".structuredmerge/fixtures.lock").fetch("revision")')"
          git clone --filter=blob:none --no-checkout "${fixtures_repository}" ../fixtures
          git -C ../fixtures fetch origin "refs/heads/${fixtures_branch}:refs/remotes/origin/${fixtures_branch}"
          git -C ../fixtures checkout --detach "${fixtures_revision}"
          test "$(git -C ../fixtures rev-parse HEAD)" = "${fixtures_revision}"
          git -C ../fixtures merge-base --is-ancestor "${fixtures_revision}" "refs/remotes/origin/${fixtures_branch}"
      - name: Setup Ruby
        uses: appraisal-rb/setup-ruby-flash@6f8ad36ba7488db591541483afb5464d01e8861b # v2.14
        with:
          ruby-version: "4.0"
          bundler: latest
          bundler-cache: false
          working-directory: ${{ matrix.gem }}
          pre-bundle-gems: |
            nomono --source https://gem.coop --source https://rubygems.org
      - name: Install verified typed core artifact
        uses: ./.github/actions/typed-core
      - name: Install dependencies
        working-directory: ${{ matrix.gem }}
        env:
          K_JEM_TEMPLATING: true
          STRUCTUREDMERGE_DEV: ${{ github.workspace }}/gems
        run: |
          bundle config set frozen false
          for attempt in 1 2 3; do
            if bundle install --jobs 4 --retry 8; then
              exit 0
            fi

            if [[ "${attempt}" -lt 3 ]]; then
              sleep "$((attempt * 5))"
            fi
          done

          exit 1
      - name: Verify installed typed core loads
        env:
          K_JEM_TEMPLATING: true
          STRUCTUREDMERGE_DEV: ${{ github.workspace }}/gems
        run: bundle exec ruby .github/verify_typed_core.rb
      - name: Load coverage thresholds
        shell: bash
        working-directory: ${{ matrix.gem }}
        run: |
          set -euo pipefail
          for key in K_SOUP_COV_MIN_BRANCH K_SOUP_COV_MIN_LINE K_SOUP_COV_MIN_HARD; do
            value="$(sed -nE "s/^${key}[[:space:]]*=[[:space:]]*\"([^\"]*)\".*/\\1/p" mise.toml 2>/dev/null | head -1)"
            if [[ -n "${value}" ]]; then
              echo "${key}=${value}" >> "${GITHUB_ENV}"
            fi
          done
      - name: Run checks with coverage
        working-directory: ${{ matrix.gem }}
        env:
          K_JEM_TEMPLATING: true
          K_SOUP_COV_COMMAND_NAME: Test Coverage
          K_SOUP_COV_DO: true
          K_SOUP_COV_FORMATTERS: xml,rcov,lcov,tty
          K_SOUP_COV_MULTI_FORMATTERS: true
          STRUCTUREDMERGE_DEV: ${{ github.workspace }}/gems
        run: timeout 20m bundle exec kettle-test
      - name: Verify coverage reports
        working-directory: ${{ matrix.gem }}
        run: |
          test -s coverage/lcov.info
          test -s coverage/coverage.xml

  family-suite:
    name: StructuredMerge family suite
    needs: detect
    if: ${{ needs.detect.outputs.release_mode == 'validation' }}
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Clone sibling fixtures repo
        shell: bash
        run: |
          set -euo pipefail
          fixtures_repository="$(ruby -ryaml -e 'puts YAML.load_file(".structuredmerge/fixtures.lock").fetch("repository")')"
          fixtures_branch="$(ruby -ryaml -e 'puts YAML.load_file(".structuredmerge/fixtures.lock").fetch("branch")')"
          fixtures_revision="$(ruby -ryaml -e 'puts YAML.load_file(".structuredmerge/fixtures.lock").fetch("revision")')"
          git clone --filter=blob:none --no-checkout "${fixtures_repository}" ../fixtures
          git -C ../fixtures fetch origin "refs/heads/${fixtures_branch}:refs/remotes/origin/${fixtures_branch}"
          git -C ../fixtures checkout --detach "${fixtures_revision}"
          test "$(git -C ../fixtures rev-parse HEAD)" = "${fixtures_revision}"
          git -C ../fixtures merge-base --is-ancestor "${fixtures_revision}" "refs/remotes/origin/${fixtures_branch}"
      - name: Setup Ruby
        uses: appraisal-rb/setup-ruby-flash@6f8ad36ba7488db591541483afb5464d01e8861b # v2.14
        with:
          ruby-version: ruby
          bundler: latest
          bundler-cache: false
          pre-bundle-gems: |
            nomono --source https://gem.coop --source https://rubygems.org
      - name: Install dependencies
        env:
          K_JEM_TEMPLATING: true
          STRUCTUREDMERGE_DEV: ${{ github.workspace }}/gems
        run: |
          bundle config set frozen false
          for attempt in 1 2 3; do
            if bundle install --jobs 4 --retry 8; then
              exit 0
            fi

            if [[ "${attempt}" -lt 3 ]]; then
              sleep "$((attempt * 5))"
            fi
          done

          exit 1
      - name: Run family suite
        env:
          K_JEM_TEMPLATING: true
          KETTLE_FAMILY_BUNDLE_GEMFILE: ${{ github.workspace }}/Gemfile
          STRUCTUREDMERGE_DEV: ${{ github.workspace }}/gems
        run: timeout 20m bundle exec kettle-test

  benchmark-dev:
    name: StructuredMerge dev benchmark
    needs: detect
    if: ${{ needs.detect.outputs.release_mode == '' }}
    runs-on: ubuntu-latest
    env:
      BUNDLE_GEMFILE: ${{ github.workspace }}/gems/ast-merge-git/Appraisal.root.gemfile
      K_JEM_TEMPLATING: true
      STRUCTUREDMERGE_DEV: ${{ github.workspace }}/gems
      STRUCTUREDMERGE_CORE_DEV: ${{ github.workspace }}/kernel
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
      - name: Checkout kernel for the local core override
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          repository: structuredmerge/structuredmerge
          ref: main
          path: kernel
          persist-credentials: false
      - name: Clone benchmark corpus
        shell: bash
        run: |
          set -euo pipefail
          lock=".structuredmerge/benchmark-fixtures.lock"
          repository="$(ruby -ryaml -e 'puts YAML.safe_load_file(ARGV.fetch(0)).fetch("repository")' "${lock}")"
          tag="$(ruby -ryaml -e 'puts YAML.safe_load_file(ARGV.fetch(0)).fetch("tag")' "${lock}")"
          revision="$(ruby -ryaml -e 'puts YAML.safe_load_file(ARGV.fetch(0)).fetch("revision")' "${lock}")"
          git clone --filter=blob:none --no-checkout "${repository}" ../benchmark-fixtures
          git -C ../benchmark-fixtures fetch --depth 1 origin "refs/tags/${tag}:refs/tags/${tag}"
          git -C ../benchmark-fixtures checkout --detach "${revision}"
          test "$(git -C ../benchmark-fixtures rev-parse HEAD)" = "${revision}"
          test "$(git -C ../benchmark-fixtures rev-parse "refs/tags/${tag}^{commit}")" = "${revision}"
      - name: Setup Ruby
        uses: appraisal-rb/setup-ruby-flash@6f8ad36ba7488db591541483afb5464d01e8861b # v2.14
        env:
          BUNDLE_GEMFILE: ${{ github.workspace }}/gems/ast-merge-git/Appraisal.root.gemfile
          K_JEM_TEMPLATING: true
          STRUCTUREDMERGE_DEV: ${{ github.workspace }}/gems
          STRUCTUREDMERGE_CORE_DEV: ${{ github.workspace }}/kernel
        with:
          ruby-version: ruby
          bundler: latest
          bundler-cache: false
          main-bundle-install: false
          working-directory: gems/ast-merge-git
          appraisal-name: benchmark-dev
          appraisal-root-gemfile: Appraisal.root.gemfile
          pre-bundle-gems: |
            nomono --source https://gem.coop --source https://rubygems.org
      - name: Compile the kernel Ruby binding
        working-directory: kernel/packages/ruby
        shell: bash
        env:
          BUNDLE_GEMFILE: ${{ github.workspace }}/kernel/packages/ruby/Gemfile
        run: |
          set -euo pipefail
          ulimit -c 0
          export CARGO_BUILD_JOBS="1" CARGO_INCREMENTAL="0"
          export CARGO_TARGET_DIR="${GITHUB_WORKSPACE}/kernel/tmp/benchmark-core-target"
          mkdir -p ../../tmp
          bundle install --jobs 4 --retry 8
          bundle exec rake compile
      - name: Run affected-capability benchmark
        working-directory: gems/ast-merge-git
        env:
          BASE_SHA: ${{ github.event.pull_request.base.sha || github.event.before }}
          K_JEM_TEMPLATING: true
          STRUCTUREDMERGE_DEV: ${{ github.workspace }}/gems
          STRUCTUREDMERGE_CORE_DEV: ${{ github.workspace }}/kernel
        run: |
          set -euo pipefail

          base_sha="${BASE_SHA:-}"
          if [[ -z "${base_sha}" || "${base_sha}" =~ ^0+$ ]]; then
            base_sha="$(git -C "${GITHUB_WORKSPACE}" rev-parse HEAD^ 2>/dev/null || git -C "${GITHUB_WORKSPACE}" rev-list --max-parents=0 HEAD)"
          fi

          mapfile -t changed_paths < <(git -C "${GITHUB_WORKSPACE}" diff --name-only "${base_sha}...HEAD")
          changed_path_args=()
          for path in "${changed_paths[@]}"; do
            changed_path_args+=(--changed-path "${path}")
          done

          lock="${GITHUB_WORKSPACE}/.structuredmerge/benchmark-fixtures.lock"
          corpus_relative="$(ruby -ryaml -e 'puts YAML.safe_load_file(ARGV.fetch(0)).fetch("corpus")' "${lock}")"
          corpus="${GITHUB_WORKSPACE}/../benchmark-fixtures/${corpus_relative}"
          report="${PWD}/tmp/ci-benchmark/report.json"
          raw_report="${report}.raw"
          mkdir -p "$(dirname "${report}")"

          set +e
          timeout 5m bundle exec appraisal benchmark-dev bundle exec ast-merge-git benchmark report \
            --corpus "${corpus}" \
            --profile dev \
            --tmp-root "${PWD}/tmp/ci-benchmark/run" \
            "${changed_path_args[@]}" > "${raw_report}"
          benchmark_status=$?
          set -e

          test -s "${raw_report}"
          # Appraisal prints its Bundler version and command before the child's
          # stdout. Keep the artifact as the benchmark's JSON report.
          # shellcheck disable=SC2016
          ruby -rjson -e '
            raw = File.read(ARGV.fetch(0))
            schema_marker = /"schema_version"\s*:\s*"structuredmerge\.benchmark\.report\/v1"/
            marker_match = schema_marker.match(raw)
            unless marker_match
              warn "Benchmark stdout tail:\n#{raw.lines.last(30).join}"
              abort "Benchmark report JSON was not found in Appraisal output"
            end
            report_start = raw.rindex("{", marker_match.begin(0))
            report = JSON.parse(raw[report_start..])
            File.write(ARGV.fetch(1), JSON.pretty_generate(report))
            selected = report.dig("selection", "selected_case_ids")
            effectiveness = report.dig("dimensions", "effectiveness")
            coverage = report.dig("dimensions", "coverage")
            File.open(ENV.fetch("GITHUB_STEP_SUMMARY"), "a") do |summary|
              summary.puts "## StructuredMerge dev benchmark"
              summary.puts
              summary.puts "- Selected cases: #{selected.length}"
              summary.puts "- Executed candidate cases: #{coverage.fetch("executed_candidate_cases")}"
              summary.puts "- Candidate safety gate: #{report.dig("dimensions", "safety", "gate")}"
              summary.puts "- Hard gate failed: #{report.fetch("hard_gate_failed")}"
              summary.puts "- Scalar score: none"
              summary.puts
              summary.puts "| Outcome | Results |"
              summary.puts "| --- | ---: |"
              effectiveness.each { |outcome, count| summary.puts "| `#{outcome}` | #{count} |" }
            end
          ' "${raw_report}" "${report}"

          exit "${benchmark_status}"
      - name: Upload benchmark report
        if: ${{ always() }}
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: structuredmerge-dev-benchmark-${{ github.sha }}
          path: gems/ast-merge-git/tmp/ci-benchmark/report.json
          if-no-files-found: warn
          retention-days: 30

  rbs:
    name: RBS
    needs: detect
    if: ${{ needs.detect.outputs.release_mode == '' }}
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Setup Ruby
        uses: ruby/setup-ruby@e1bd6146574da5e0795075b5319b300edb30c5b0 # v1.333.0
        with:
          ruby-version: ruby
          bundler-cache: false
      - name: Validate RBS Environment
        shell: bash
        run: |
          ruby -rrbs -rpathname -e '
            failures = []
            sig_dirs = Dir.glob("gems/*/sig").select { |path| File.directory?(path) }.sort
            sig_dirs.each do |sig_dir|
              gem_dir = File.dirname(sig_dir)
              print "Validating #{gem_dir}... "
              loader = RBS::EnvironmentLoader.new
              loader.add(path: Pathname(sig_dir))
              RBS::Environment.from_loader(loader).resolve_type_names
              puts "OK"
            rescue StandardError => error
              puts "FAILED"
              failures << [gem_dir, error]
            end

            failures.each do |gem_dir, error|
              warn "#{gem_dir}: #{error.class}: #{error.message}"
            end
            abort "RBS validation failed for #{failures.length} gem(s)" unless failures.empty?
          '

  tslp-cold-start:
    name: TSLP cold-start
    needs: detect
    if: ${{ needs.detect.outputs.release_mode == '' }}
    runs-on: ubuntu-latest
    env:
      BUNDLE_GEMFILE: ${{ github.workspace }}/gems/tree_haver/Appraisal.root.gemfile
      K_JEM_TEMPLATING: true
      STRUCTUREDMERGE_DEV: ${{ github.workspace }}/gems
      STRUCTUREDMERGE_CORE_DEV: ${{ github.workspace }}/kernel
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Checkout kernel for the local core override
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          repository: structuredmerge/structuredmerge
          ref: main
          path: kernel
          persist-credentials: false
      - name: Setup Ruby
        uses: appraisal-rb/setup-ruby-flash@6f8ad36ba7488db591541483afb5464d01e8861b # v2.14
        env:
          BUNDLE_GEMFILE: ${{ github.workspace }}/gems/tree_haver/Appraisal.root.gemfile
          K_JEM_TEMPLATING: true
          STRUCTUREDMERGE_DEV: ${{ github.workspace }}/gems
          STRUCTUREDMERGE_CORE_DEV: ${{ github.workspace }}/kernel
        with:
          ruby-version: ruby
          bundler: latest
          bundler-cache: false
          main-bundle-install: false
          working-directory: gems/tree_haver
          appraisal-name: tslp-cold-start
          appraisal-root-gemfile: Appraisal.root.gemfile
          pre-bundle-gems: |
            nomono --source https://gem.coop --source https://rubygems.org
      - name: Compile the kernel Ruby binding
        working-directory: kernel/packages/ruby
        shell: bash
        env:
          BUNDLE_GEMFILE: ${{ github.workspace }}/kernel/packages/ruby/Gemfile
        run: |
          set -euo pipefail
          ulimit -c 0
          export CARGO_BUILD_JOBS="1" CARGO_INCREMENTAL="0"
          export CARGO_TARGET_DIR="${GITHUB_WORKSPACE}/kernel/tmp/tslp-core-target"
          mkdir -p ../../tmp
          bundle install --jobs 4 --retry 8
          bundle exec rake compile
      - name: Run cold-start TSLP checks
        working-directory: gems/tree_haver
        env:
          K_JEM_TEMPLATING: true
          K_SOUP_COV_DO: false
          STRUCTUREDMERGE_DEV: ${{ github.workspace }}/gems
          STRUCTUREDMERGE_CORE_DEV: ${{ github.workspace }}/kernel
        run: |
          set -euo pipefail
          export TREE_SITTER_LANGUAGE_PACK_CACHE_DIR
          TREE_SITTER_LANGUAGE_PACK_CACHE_DIR="$(mktemp -d "${RUNNER_TEMP}/tslp-cold-start.XXXXXX")"
          bundle exec appraisal tslp-cold-start bundle exec rspec spec/grammar_finder_spec.rb spec/backends/tslp_spec.rb --format progress

  check:
    name: Check
    needs:
      - detect
      - gem-suite
      - typed-core
      - dep-heads
      - coverage
      - family-suite
      - benchmark-dev
      - rbs
      - tslp-cold-start
    if: ${{ always() }}
    runs-on: ubuntu-latest
    steps:
      - name: Summarize changed-gem checks
        shell: bash
        env:
          SELECTED_GEMS: ${{ needs.detect.outputs.summary }}
          RELEASE_MODE: ${{ needs.detect.outputs.release_mode }}
          DETECT_RESULT: ${{ needs.detect.result }}
          GEM_SUITE_RESULT: ${{ needs.gem-suite.result }}
          TYPED_CORE_RESULT: ${{ needs.typed-core.result }}
          DEP_HEADS_RESULT: ${{ needs.dep-heads.result }}
          COVERAGE_RESULT: ${{ needs.coverage.result }}
          FAMILY_SUITE_RESULT: ${{ needs.family-suite.result }}
          BENCHMARK_DEV_RESULT: ${{ needs.benchmark-dev.result }}
          RBS_RESULT: ${{ needs.rbs.result }}
          TSLP_COLD_START_RESULT: ${{ needs.tslp-cold-start.result }}
        run: |
          set -euo pipefail
          echo "Selected gem suites: ${SELECTED_GEMS}"
          echo "Detect result: ${DETECT_RESULT}"
          echo "Gem suite result: ${GEM_SUITE_RESULT}"
          echo "Typed core artifact result: ${TYPED_CORE_RESULT}"
          echo "Deps @ HEAD result: ${DEP_HEADS_RESULT}"
          echo "Coverage result: ${COVERAGE_RESULT}"
          echo "Family suite result: ${FAMILY_SUITE_RESULT}"
          echo "Dev benchmark result: ${BENCHMARK_DEV_RESULT}"
          echo "RBS result: ${RBS_RESULT}"
          echo "TSLP cold-start result: ${TSLP_COLD_START_RESULT}"

          if [[ "${DETECT_RESULT}" != "success" ]]; then
            exit 1
          fi
          if [[ "${RELEASE_MODE}" == "member" ]]; then
            echo "Aggregate member release: CI validation completed before publishing."
            exit 0
          fi

          if [[ "${FAMILY_SUITE_RESULT}" == "success" ]]; then
            [[ "${GEM_SUITE_RESULT}" == "skipped" ]] || exit 1
            [[ "${TYPED_CORE_RESULT}" == "skipped" ]] || exit 1
            [[ "${DEP_HEADS_RESULT}" == "skipped" ]] || exit 1
            [[ "${COVERAGE_RESULT}" == "skipped" ]] || exit 1
            [[ "${RBS_RESULT}" == "skipped" ]] || exit 1
            [[ "${BENCHMARK_DEV_RESULT}" == "skipped" ]] || exit 1
            [[ "${TSLP_COLD_START_RESULT}" == "skipped" ]] || exit 1
            exit 0
          fi

          for result in "${RBS_RESULT}" "${BENCHMARK_DEV_RESULT}" "${TSLP_COLD_START_RESULT}"; do
            [[ "${result}" == "success" ]] || exit 1
          done

          for result in "${GEM_SUITE_RESULT}" "${TYPED_CORE_RESULT}" "${DEP_HEADS_RESULT}" "${COVERAGE_RESULT}"; do
            case "${result}" in
              success|skipped)
                ;;
              *)
                exit 1
                ;;
            esac
          done